Skip to main content
My preferencesSign out
Proofpoint, Inc.

Set-up for Success: What to Do Prior to Mail Flow Cutover

This guide provides an overview of product features and related technologies. In addition, it contains recommendations on best practices, tutorials for getting started, and troubleshooting information for common situations.


Please keep in mind that turning services on and off adhere to a specific time frame. Please see the Timing KB for more information.

Tip #1: Prepare the MX Record 

  • Set the TTL of your MX record down to as low as your DNS provider will allow. 

Go Daddy will allow this to be set as low as 600 seconds 10 minutes. 

  • The results of doing this are that after making the cutover to Proofpoint mail flow will take and resume in as short a period as possible. 

  • Make sure you have an SPF Entry that is only Proofpoint or that also includes Proofpoint if you have third parties that send out email on your behalf. 

    • SPF for US Customersv=spf1 ~all
    • SPF for EU Customers: v=spf1 ~all 

Tip #2: Onboard Users Prior to Mail Flow Cutover 

Proofpoint Essentials offers several User Discovery methods. We suggest you discover users prior to mail flow cutover to ensure that we can immediately pass mail. Consider the following questions:

  • Do you want to send a Welcome Email?  If not, see How to Disable Welcome Emails
  • Which User Discovery tool do you want to use? We recommend the following hierarchy, based on the effectiveness of each tool: 
  1. Office 365 Active Directory Sync

  2. Active Directory LDAP Sync 

  3. CSV Import 

  4. SMTP Discovery (we suggest only using this tool as a last resort and for a limited time)

Created vs Other

Outside of SMTP Discovery, Proofpoint will only allow emails in for the specific email addresses created. The outside item is if the user is disabled, then we would also reject as if the email was not created.

Tip #3: Verify Domain 

Verify that you control the domain within the Proofpoint UI. See How to Verify a Domain

Tip #4: Adding Sending Servers 

Add in any and all of your sending servers under Company before you take and cut your mailflow over. This also includes turning up Managed Hosted services for either of Office 365 or Google Apps. This can be done in the UI by navigating to Company Settings > Domains > New Sending Servers

Tips #5: Enable Mail Relay Prior to MX Record Change 

Prior to changing your MX record, take and enable relay for your domain for at least 30-60 minutes in the Proofpoint Web UI. You can accomplish this by going to Company Settings > Domains and clicking the button to the right of your domain until it is shown as green like this example:  

Tip #6: Lock Down O365 to only allow email from Proofpoint

Ensure that the client's O365 environment will only accept mail from Proofpoint: How to Lock Down O365