| Proofpoint | |
|---|---|
| Domains | mx1-us1.ppe-hosted.com, mx2-us1.ppe-hosted.com, mx1-eu1.ppe-hosted.com, Per-customer hosts under gslb.pphosted.com |
| Mail routing | Two families. Proofpoint Essentials, sold to smaller firms, uses shared hosts under ppe-hosted.com, numbered by region such as us1 and eu1. Proofpoint Enterprise gives each customer its own pair of hosts under gslb.pphosted.com, labelled mxa and mxb. Either one in a domain's MX record means Proofpoint takes the mail before the real server does. |
| How results come back | Many mailboxes; unanswered ones come back unknown, unbilled |
How Proofpoint answers a probe
What the server does when we open a connection and ask about one address.
- Before any address is checked, Proofpoint's reputation service looks at the connecting IP. A sender it distrusts gets a 554 at connection time with a link to ipcheck.proofpoint.com, and RCPT TO is never reached.
- Recipient verification is an admin setting. Where it's on, Proofpoint checks the address against a user list, a directory sync or a live call to the server behind it, and returns 550 5.1.1 for a user it can't find.
- Where it's off, every address at the domain gets 250. Proofpoint relays the mail inward, the real server rejects the dead ones, and the bounce reaches you after the probe is long gone.
- SMTP rate control defers senders that open too many sessions too quickly. You'll see a 4xx reply that is about the pace of your connections, not about the person you asked for.
The part that catches people out
What we do about it
A connection-level 554 comes back unknown with reason probe_blocked, so it's never mixed up with a mailbox that doesn't exist, and it costs nothing. A 550 5.1.1 comes back invalid with the code in smtp_code. We run the catch-all probe on every Proofpoint domain before trusting a 250; when the random address is accepted too, the row reads catch_all and is billed once. The mx_host field shows whether an Essentials or an Enterprise host answered. The result codes reference spells out each reason.
Sending to Proofpoint mailboxes
Verification is one step. These are the things that decide whether the message lands.
- Proofpoint URL Defense rewrites links in inbound mail to urldefense.com and scans them. That scan can register in your stats as a click the recipient never made.
- Proofpoint blocks by IP reputation first, so a clean list sent from a poorly rated IP still fails at those domains. Check where your sending IP stands on ipcheck.proofpoint.com.
- Essentials customers can quarantine bulk mail into a digest the user reviews once a day. Your message counts as delivered, but it may sit there unread.
Questions people ask
How can I tell if a company uses Proofpoint?
Check the domain's MX record. Hosts ending in pphosted.com mean Proofpoint Enterprise, and hosts ending in ppe-hosted.com mean Proofpoint Essentials. ZapBounce prints the answering host in the mx_host field, so you can sort a batch by gateway.
What does a 554 from Proofpoint mean during verification?
It means Proofpoint refused the connecting IP, before it looked at the address. The mailbox may be perfectly fine. ZapBounce returns that row as unknown with reason probe_blocked, and unknown rows are never billed.
Why do Proofpoint domains come back catch_all?
Because the admin has left recipient verification off, so Proofpoint accepts every address and leaves the rejecting to the server behind it. The random-address probe shows that, and the row is labelled catch_all instead of valid.