Knowledgebase
How TLS Delivery occurs

Overview

This page describes TLS behavior from a Proofpoint Sender and Recipient point of view.

In both cases below, we do recommend that the filters created be for the recipient

TLS Outbound

This is the Proofpoint sender's perspective.

Most customers will want to utilize TLS for outbound, to ensure a secure mail transport.

  • By default, the Proofpoint Essentials outbound relay will use opportunistic TLS for initial sending.
  • If the recipient server is not accepting our TLS session, we will fallback to standard transport and deliver anyway.

If an outbound filter is created then the condition should be based on the recipient domain (not the Proofpoint customer). The action should be 'Nothing,' and the secondary action can be:

  • "Enforce completely secure SMTP delivery"
    • The sender must have a valid certificate in place.
    • The domain name using to send must match the exact same domain on the certificate, unless it is a wild card certifcate.
    • If there is no certificate, we will not delivery the email.
  • "Enforce only TLS on SMTP delivery"
    • No certificate required. The downstream server simply needs to accept the traffic over TLS.
    • If the downstream server does not accept TLS, we will not deliver the email.

TLS Inbound

This is the Proofpoint recipient's perspective.

This is to ensure that mail from the Proofpoint environment to the customer's mail server environment is over TLS. By default, we attempt this over TLS to begin with.

If an inbound filter is created then the condition should be based on the recipient (the Proofpoint customer), the action should be 'Nothing' and the secondary action can be:

  • "Enforce completely secure SMTP delivery"
    • same as above. Valid certificate with domains matching required, or we will not deliver.
  • "Enforce only TLS on SMTP delivery"
    • Also similar. No certificate required, but the server we are passing the mail off to needs to accept the TLS connection, or we will not deliver.
(14 vote(s))
This article was helpful
This article was not helpful

Comments (0)