Overview
At times when a partner is cutting over from Proofpoint, they may find that inbound mail doesn't correctly follow MX, despite MX having been pointed to us. This will occur specifically for email sent from a Proofpoint domain, to a domain that still resides in Proofpoint (while simultaneously now also residing in Mailprotector). Most commonly this will present a mailflow issue when a new partner is testing Mailprotector on their partner account, which can't yet be removed from Proofpoint since it is tied to their reseller.
Problem
The problem arises when the receiving environment is adjusted to only allow mail from Mailprotector's inbound relay, as would normally be the best practice. A change in ingress firewall rules or inbound connector can result in Proofpoint delivery being blocked. Proofpoint routes messages which are internal to their service through their equivalent of our inbound mail destination, resulting in them attempting delivery directly to the receiving domain's mail server without any consideration of MX.
Solution
The partner will need to re-add Proofpoint's IPs to their rules and connectors to resolve this mailflow issue, and will need to keep those IPs in place until they've migrated all domains away from Proofpoint and can close their reseller account. It's worth noting that while this technically isn't a "Mailprotector problem" this is an excellent opportunity to demonstrate the kind of support that we provide, so any tips we can give them in the right direction may help lock in a new partner.
Comments