Step 4: Configure Google Workspace for Proofpoint

Before you start

• The domain is added in Proofpoint as type Relay, with the delivery destination set to the Google host.
• Mailboxes, groups and aliases have been imported. Proofpoint has no directory sync for Google Workspace, so this comes from the CSV in Step 3.
• You have the Proofpoint sending IP ranges for your region, from the Connection Details article.
• You are signed in to the Google Admin console as a super admin.

1. Configure the inbound gateway

1. Go to Apps → Google Workspace → Gmail → Spam, phishing and malware.
2. Select the top level organization on the left.
3. Hover to the right of Inbound gateway and click the pencil icon when it appears.

4. Under Gateway IPs, click ADD and enter one range at a time.

Add two sets of ranges:

• Every Proofpoint sending range for your region. Take these from the Connection Details article rather than from memory or from another customer's tenant. That article is the single source of truth and these ranges do change.
• Google's own ranges. These allow mail that Google generates itself, such as Drive sharing notifications, Calendar invitations and comment notifications, which does not pass through the relay.

5. Check Automatically detect external IP (recommended).
6. Check Require TLS for connections from the email gateways listed above.
7. Leave Reject all mail not from gateway IPs unchecked for now. This is turned on after cutover, in Step 6.

8. Click Save, then enable the inbound gateway.

2. Update safety settings

1. Still in the Google Admin console, go to Apps → Google Workspace → Gmail.
2. Click Safety to expand the options.
3. Leave Attachments and Links & external images as they are. Proofpoint does not replace these.
4. Turn off every option under Spoofing and authentication.
5. Uncheck Apply future recommended settings automatically.

Once mail arrives from Proofpoint rather than from the original sender, Google's own spoofing and authentication checks are looking at the wrong hop. Leaving them on produces delivery failures that report as a DMARC problem, which sends people looking at DNS when the cause is here.

3. Configure the outbound gateway

1. Go to Apps → Google Workspace → Gmail → Hosts.
2. Click Add Route.
3. Give it a name such as Outbound for Proofpoint Essentials.
4. In the Outbound Gateway field, enter the smart host for your region.

US customers:  outbound-us1.ppe-hosted.com
EU customers:  outbound-eu1.ppe-hosted.com

5. Click Save.

Now create the routing rule that sends outbound mail to it.

1. Go to Apps → Google Workspace → Gmail → Routing. Click Configure, or Add Another Rule if one already exists.
2. Enter a name such as Outbound Through Proofpoint.
3. Under Email messages to affect, select Outbound.
4. Under For the above types of messages, do the following, check Change route and Also reroute spam, then select the outbound route from the drop-down.
5. Click Show options.
6. Under B. Account types to affect, select Users, Groups and Unrecognized / Catch-all.
7. Under C. Envelope Filter, check Only affect specific envelope senders, then change the drop-down from Single email address to Pattern match.
8. In the Regexp field, enter the domain with the dot escaped.

example\.com

9. Click Save at the bottom of the page.

4. Configure internal routing

Internal mail needs its own route so that messages between the customer's own users are not sent out to Proofpoint and back.

1. Go to Apps → Google Workspace → Gmail → Hosts. Click Add Route.
2. For Name, enter Internal Google Workspace.
3. Leave the drop-down on Single host. Enter aspmx.l.google.com in the first field and 25 in the port field beside it.
4. Leave Perform MX lookup on host unchecked.
5. Check Require mail to be transmitted via a secure (TLS) connection (Recommended), Require CA signed certificate (Recommended) and Validate certificate hostname (Recommended).
6. Click Save.

Then add the matching routing rule.

1. Scroll down to Routing and click Configure, or Add Another Rule if one already exists.
2. Enter a name such as Internal Routing.
3. Under Email messages to affect, check Internal - Sending.
4. Under Route, check Change route and select Internal Google Workspace from the drop-down.
5. Click Show options.
6. Under B. Account types to affect, check Users and Groups.
7. Under C. Envelope Filter, check Only affect specific envelope senders, then change the drop-down to Pattern match.
8. Under Regexp, enter the domain with the dot escaped, exactly as in the outbound rule.
9. Click Save.

5. Allow time for changes to propagate

Google applies most admin console changes within a few minutes. Changes made in Proofpoint take longer to propagate, and propagation runs on the hour and on the half hour. Where a change depends on both, Proofpoint sets the pace, so allow up to thirty minutes before testing.

Proceed to next step: Step 5: Test Mail Flow