Proofpoint Essentials SPF and DKIM setup

What you are setting up

Proofpoint Essentials is a security gateway that sits in front of your mailbox provider (usually Microsoft 365 or Google Workspace). When outbound mail routes through it, the last server to hand your message to the internet is Proofpoint's, not Microsoft's or Google's. So two things have to be true: your SPF record must authorize Proofpoint's relay, and Proofpoint must sign your mail with a DKIM key published under your domain. Essentials does not sign anything until you generate a key in the console and verify it, so a domain that only has its mailbox provider's records set up will authenticate badly the moment the outbound smarthost is switched on.

Publish SPF and DKIM

SPF. Proofpoint publishes one include per region. Use the one that matches your tenant (US1 to US5 tenants log in at us1.proofpointessentials.com; EU1 tenants at eu1.proofpointessentials.com):

Type:  TXT     (SPF, US tenants)
Host:  @
Value: v=spf1 include:_spf-us.ppe-hosted.com ~all

Type:  TXT     (SPF, EU tenants)
Host:  @
Value: v=spf1 include:_spf-eu.ppe-hosted.com ~all

You almost certainly already have an SPF record for your mailbox provider, so merge the Proofpoint include into it rather than publishing a second record. Keep the mailbox provider's include too: mail that does not route through the gateway (some calendar invites, some service notifications) still leaves from there.

DKIM. In Proofpoint Essentials, go to Administration > Account Management > Domains, click the vertical ellipsis on the domain, and choose Configure DKIM. Click Create New DKIM Signing Key. Proofpoint pre-fills a selector, which you can change, and then shows you the hostname and value to publish:

Type:  TXT     (DKIM)
Host:  <selector>._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq... (the key Proofpoint shows you)

Proofpoint also displays the private key once, on that screen only, so save it somewhere safe if you think you will ever need it. Once the TXT record is live, open the key's menu and click Verify Key. When verification succeeds, outbound signing is switched on for that domain automatically. Each domain in your account is configured separately, so repeat this for every domain that sends.

Add DMARC

Standard _dmarc TXT record, nothing Proofpoint-specific. Start in monitor-only mode:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports show Proofpoint passing cleanly.

The Proofpoint Essentials gotcha

The key is 2048-bit, and some DNS hosts choke on it. Essentials only issues 2048-bit keys, and some DNS control panels refuse a TXT value that long or silently truncate it. If yours does, split the value into multiple quoted strings inside one TXT record (Proofpoint's own guide points at a record-splitter tool for this); do not ask for a shorter key, because there is not one. Two more things catch people. Pick the right region. The US and EU includes are different records, and adding both spends an extra lookup for nothing. And outbound disclaimers are safe, inbound features are not. Proofpoint adds an outbound disclaimer before it signs, so your signature survives; but its inbound features (subject tagging, the spam-reporting footer, URL Defense rewriting) deliberately break the DKIM signatures of mail you receive. If you see other people's DKIM failing at your gateway, that is why, and it is not a fault in your outbound setup.

Confirm it worked

• Verify in Proofpoint. The key in the Configure DKIM drawer should show as verified, and the domain should show signing enabled.
• Send a test and read the headers. Send an external message from a mailbox that routes through the gateway, then confirm the DKIM signature carries d=yourdomain.com with your Proofpoint selector, and that the result reads dmarc=pass. Our header analyzer spells it out.
• Watch the reports. Proofpoint's relay IPs should appear as an aligned, passing source in your DMARC aggregate reports. In trustyourinbox they are labeled as a known sender, and an SPF-only pass with no DKIM is the sign that the key was never verified.