Create a Microsoft Exchange Proofpoint Server Connector

1. Prepare your Proofpoint server to encrypt emails inspected by Enterprise DLP.

   1. Enable DKIM signing for your Proofpoint server.

      When enabling DKIM signing, you must also select Enabled for the domain.

      Additionally, keep a record of your DKIM public key. This is required when updating your domain host records.
   2. Contact your email domain provider to update your SPF record.

      • Add your Proofpoint IP address to your SPF record.
        Enterprise DLP requires this to forward emails to Proofpoint for encryption. Skip this step if you have already updated your SPF record with your Proofpoint IP address.
      • Add the DKIM public key to your domain host records.
2. Log in to the Microsoft Exchange Admin Center.
3. Select Mail flowConnectors and Add a connector to launch the Microsoft Exchange connector wizard.

4. Specify the connector source and destination.

   1. For Connection from, select Office 365.
   2. For Connection to, select Partner organization.

      A partner can be any third-party cloud service that provides services such as services, such as data protection. In this case, the third-party partner organization is Palo Alto Networks.
   3. Click Next.

5. Name the Microsoft Exchange connector.

   1. Enter a descriptive Name for the connector.
   2. (Optional) Enter a Description for the connector.
   3. (Best Practices) For What do you want to do after connector is saved?, check (enable) Turn it on.

      Enable this to automatically turn on the connector after you have finished creating and saved the new Microsoft Exchange connector.
   4. Click Next.

6. To specify when the connector should be used, select Only when I have a transport rule set up that redirects messages to this connector and click Next.

7. To configure the route settings for your Proofpoint server, check (enable) Route email through these smart hosts to add the Proofpoint server smart host Fully Qualified Domain Name (FQDN) and click Next.

8. Specify the security restrictions for the connector.

   1. Check (enable) Always use Transport Layer Security (TLS) to secure the connection.

      Enterprise DLP requires this setting to successfully forward emails for inspection. Enterprise DLP rejects the connect connection if you disable this setting.
   2. Select Issued by a trusted certificate authority (CA).
   3. Click Next.

9. Add a validation email.

   Enterprise DLP requires a valid email address associated with the email domain to validate connectivity between the Microsoft Exchange Admin Center and the Email DLP smart host, and to verify Enterprise DLP can successfully deliver any required notification emails.

   1. Add a valid email address for validation.
   2. Validate.

      The Microsoft Exchange validation tests take a few minutes to complete.
   3. Under the Task, verify that the Check connectivity validation test status to the Enterprise DLP FQDN displays Succeed.

   4. Click Done.
   5. When prompted to confirm whether to proceed without successful validation, click Yes, proceed.
10. Review the connector details and Create Connector.

    Click Done when prompted that you successfully created the outbound connector.
11. Back in the Connectors page, verify that you successfully created the outbound connector and that the Status displays On.

12. Create the Microsoft Exchange outbound and inbound connectors if not already created.

    Enterprise DLP requires the outbound connector to control the flow of emails forwarded from Microsoft Exchange Online to Enterprise DLP for inline inspection and requires the inbound connector to return emails forwarded to Enterprise DLP for inspection back to Microsoft Exchange.

    Skip this step if you have already created the outbound and inbound connectors.
13. Create Microsoft Exchange Transport Rules.

    After you successfully created the Microsoft Exchange connectors, you must create Microsoft Exchange transports rule to forward emails to and from Enterprise DLP, and to specify what actions Microsoft Exchange takes based on the Enterprise DLP verdicts.