Proofpoint in front of Exchange Online: what a mail gateway migration really costs
- The problem
- Phishing and impersonation were getting past the native filter and into inboxes.
- What I built
- Evaluation, three inventories (mailboxes, domains, partners) and a country-by-country MX migration.
- What came of it
- Country by country, the estate is moving behind the gateway; where it has landed, nobody outside IT noticed.
After a run of phishing and impersonation attempts that made it to inboxes, the company decided native filtering was not enough on its own and chose to put a dedicated gateway in front of Exchange Online. I ran the proof of concept and I am running the migration, country by country, across the whole group. It is not finished yet; what follows is what has held up so far.
If you are scoping something similar, the useful thing I can hand you is not the vendor comparison but the list of what has to be known before cut-over, because that is where the months went.
Changing the MX record is the last five minutes
Mailboxes: every one attributed to a country, because that is how the gateway bills.
Domains: every accepted domain onboarded, with its SPF, DKIM and DMARC.
Partners: every enforced-TLS partner probed before the switch.
Every mailbox mapped to a country. A gateway is typically licensed and charged back per region, so every mailbox has to be attributed to a country from its domain, its licence and its directory location. Doing this properly is not bookkeeping: the exercise surfaced that roughly one mailbox in six had no attributable country at all. Far better to find that before the first invoice than to argue about it afterwards.
Every accepted domain inventoried. All the accepted domains had to be onboarded on the gateway side before cut-over, each carrying its own SPF, DKIM and DMARC configuration across. A domain that is accepted in Exchange Online but unknown to the gateway does not degrade gracefully: its mail is simply rejected.
Every partner checked for TLS. The partner domains that exchange mail with the company under enforced TLS were probed one by one before the switch to confirm the new path would negotiate the same way as the old one. Enforced TLS that silently stops negotiating is the failure mode that gets discovered by a lawyer, not by a monitor.
Cut-over, and the month that follows
The MX change went country by country, with the gateway’s bypass rules tuned against real traffic for a week after each wave. Rolling in waves is not caution for its own sake: it means the blast radius of a bad policy is one country, and the lessons from the first wave are free for the rest.
Policies that look correct on paper get adjusted against what actually arrives. The first month is where you learn which “spam” is a newsletter the finance team depends on, and no amount of pre-production testing substitutes for it.