Enterprise DLP
Set Up the Email DLP Host
Table of Contents
Set Up the Email DLP Host
Create a route from Gmail to the Enterprise Data Loss Prevention (E-DLP) Email DLP host.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
Enterprise Data Loss Prevention (E-DLP) requires you set up routing from Gmail to the Enterprise DLP Email DLP Host to allow Gmail to forward emails to Enterprise DLP for inspection and verdict rendering to prevent exfiltration of
sensitive data.
- Log in to the Google Admin portal.In the Dashboard, select and Add Route.Configure the Email DLP host.
- Enter a descriptive Name.In Specify email server, select Single host if not already selected.Enter the host name and port.Enterprise DLP requires adding the Email DLP host name for positive identification of the Enterprise DLP cloud service. The CA issuer FQDN you add must match the email routing FQDN you added in the previous step.
- APACmail.asia-southeast1.email.dlp.paloaltonetworks.comEuropemail.europe-west3.email.dlp.paloaltonetworks.comIndiamail.asia-south1.email.dlp.paloaltonetworks.comUnited Statesmail.us-west1.email.dlp.paloaltonetworks.comFor the Options, enable the following settings if not already enabled.
- Require mail to be transmitted via a secure (TLS) connection
- Require CA signed certificate
- Validate certificate hostname
Test TLS connection to verify Gmail can successfully connect to Enterprise DLP.Save.![]()
Back in the Hosts page, verify that you successfully created the Email DLP host.![]()
Set Up a Proofpoint Server for Email Encryption.Enterprise DLP requires this setting to encrypt inspected emails inspected that match your encryption Email DLP policy rule.Skip this step if you already configured routing to your Proofpoint server.Create Gmail Transport Rules.After you successfully set up the Email DLP host on Gmail, you must create the Gmail transports rule to instruct Gmail to forward emails to Enterprise DLP and establish the actions Gmail takes based on verdicts rendered by Enterprise DLP.Email DLP does not require a transport rule for emails that match your Email DLP policy when you configure the action to Monitor. In this case, Enterprise DLP adds x-panw-action - monitor to the email header, creates a DLP incident, and sends the email continues to the intended recipient.
