How TLS Delivery Occurs

TLS Outbound

This is Proofpoint's sender perspective

Most customers will want to utilize TLS for outbound, to ensure a secure mail transport.

• By default, the Proofpoint Essentials outbound relay will use opportunistic TLS for initial sending.
• If the recipient server is not accepting our TLS session, we will fallback to standard transport and deliver anyway.

If an outbound filter is created then the condition should be based on the recipient domain (not the Proofpoint customer). The action should be Nothing, and the secondary action can be either of the following options:

Enforce Completely Secure SMTP Delivery

• The sender must have a valid certificate in place.
• The domain name using to send must match the exact same domain on the certificate, unless it is a wild card certificate.
• If there is no certificate, we will not delivery the email.

 Enforce Only TLS on SMTP Delivery

• No certificate required. The downstream server simply needs to accept the traffic over TLS.
• If the downstream server does not accept TLS, we will not deliver the email.

TLS Inbound 

This is Proofpoint's recipient perspective and ensures that mail from the Proofpoint environment to the customer's mail server environment is over TLS. By default, we attempt this over TLS to begin with.

If an inbound filter is created then the condition should be based on the recipient (the Proofpoint customer), the action should be 'Nothing' and the secondary action can be:

Enforce Completely Secure SMTP Delivery

• Same as above. Valid certificate with domains matching required, or we will not deliver.

Enforce Only TLS on SMTP Delivery

•  Similar to above. No certificate required, but the server we are passing the mail off to needs to accept the TLS connection, or we will not deliver.