Proofpoint in front of Exchange Online: cutting the risk of attack by email

After a run of phishing and impersonation attempts that made it to inboxes, the company decided the native filtering wasn’t enough on its own and chose to put a dedicated gateway in front of Exchange Online. I ran the proof of concept and then the migration.

What a mail migration actually is

Changing MX records is the last five minutes. The months before are about knowing exactly what passes through the mail system, because anything you don’t know about breaks at cut-over.

Every mailbox mapped to a country. The gateway is licensed and charged back per region, so each of the roughly 43,000 mailboxes had to be attributed to a country from its domain, its licence, its directory location. The mapping surfaced close to 7,000 users with no attributable country, found before the invoice rather than after it.

Every accepted domain inventoried. Over 120 domains had to be onboarded on the gateway side before the cut-over, each with its own SPF, DKIM and DMARC to carry across.

Every partner checked for TLS. More than 200 partner domains exchange mail with the company under enforced TLS. Each one was probed before the switch so that the new path would negotiate the same way as the old one.

Cut-over and after

The MX change itself went country by country, with the gateway’s bypass rules tuned against real traffic for a week after each wave. Policies that looked right on paper were adjusted against what actually arrived: the first month is where you learn which “spam” is a newsletter the finance team depends on.

Result

Mail for about 43,000 mailboxes in over 25 countries now passes through the gateway, and what reached inboxes before is stopped at the edge. Nobody outside IT noticed the change, which is the only acceptable outcome for a mail migration.