What is our primary use case?
I last used Proofpoint Email Protection in February of 2025. I have been working in my current field with Proofpoint Email Protection for approximately two to three years. I use Proofpoint Email Protection as an email protection service. In my previous company, we used several other email protection services including Viper email security, Mimecast email security, and Zix protection. However, based on my opinion and feedback, I really love Proofpoint Email Protection. Proofpoint Email Protection is intuitive for administrative people and is easier to handle than other services. It is stronger than other services and is easier to configure and apply settings for anti-spam, anti-spoofing, and other tools that the service offers. In my opinion, it was an awesome tool and my favorite to use with the multiple customers that I had in the past.
What is most valuable?
I have a few favorite features about Proofpoint Email Protection. One of my favorites was the ability to create filters. Under Proofpoint Email Protection, unlike other types of services, an administrator can create global filters or global policies. However, I think that one opportunity area for Proofpoint Email Protection is at the end-user level, where users can create their own policies and settings that will overwrite the global policy and settings. From a security perspective, this can be both an advantage and a gap because if an end-user creates a policy and setting on their end, it will overwrite any policy that the administrator has already set.
My favorite aspects included creating filters and policies to allow or block emails and using country-type lists. For example, if you do not want to allow emails from IPs that are not located in the US or want to block emails from different countries, you have that capability. Another favorite of mine was the anti-spoofing feature. The anti-spoofing settings are powerful because, according to current email rules, every domain needs to have SPF, DKIM, and DMARC configurations or authentications already listed. If a domain is not already verified by these methods, Proofpoint Email Protection will block it or provide a warning to an end-user or administrator stating that the domain is not using the correct SPF or that it is sending from a third-party application but its IPs are not listed in the SPF. As an administrator, this provides better visibility to accomplish requirements with customers. These two features were my favorites.
What needs improvement?
I already shared one area for improvement regarding the policies that administrators can set as global policies, but end-users can overwrite these. From a security perspective, it would be better if the admin rules and settings could not be overwritten by end-users. End-users can do whatever they want without any permissions if they have the ability to create their own rules. I do not remember if you can set and block end-users from creating their own rules, but if that is the case, it is acceptable.
I think that the market has more intuitive tools with Sandbox and URL Defense capabilities. I remember having multiple tickets and cases from customers where when a link was broken or incorrect, URL Defense would start to apply and completely block the URL. As an end-user, there is no chance to see which the URL was. Everything was encrypted by URL Defense. As an end-user or administrator, you are not able to read the actual link. If Proofpoint Email Protection could provide a tool only for administrators inside the console to try to decrypt the link, I think that would be better.
Regarding their integrations with Office 365, at this point I am not sure because I am not completely using that feature. However, I know that they have some integration with Office 365 with automatic buttons. I think that if they could do this with the Workspace console, that would be awesome as well.
For how long have I used the solution?
I started using this product in 2022 when I was working in a company called Excel Micro. Excel Micro is a partner for Proofpoint and we provide support in the system for multiple customers. I used Proofpoint Email Protection for almost two years.
What do I think about the stability of the solution?
The most complicated aspect during my years of using Proofpoint Email Protection was the US4 server. I think that the server for US4 was running low. However, I remembered that the US4 server was planned to migrate some things, so it was difficult to search through the logs or make any changes. Additionally, if some changes were applied, they took more time to propagate.
When something comes up, I think that one of the best improvements would be if Proofpoint Email Protection creates a webpage with live updates for that type of bug or problem. This would be better for us as administrators and also for end-users to understand that we have some problems with Proofpoint Email Protection. I know that Proofpoint Email Protection did provide this at one point, but it takes some time until we start to raise tickets and then they say that they have some problems or issues under this server. Just leaving a message on a page stating that they have a problem and are already working on it without any ETA would be better. Do not try to avoid that you have an issue because, in the end, as resellers or partners, we are already limited with our own people or customers and stating that we do not have any update. As partners, we do not have any information. At that point, what happened? I think that this was my last comment on this topic.
What do I think about the scalability of the solution?
Regarding scalability and adding more clients and things to handle, I really love Proofpoint Email Protection more than other mail servers or mail services. If you find the correct people to provide this, I think that you will sell a lot of products from Proofpoint Email Protection because it is intuitive for the administrator perspective and also for end-users. However, it is not completely the job of Proofpoint Email Protection to provide the knowledge. This knowledge needs to be handled and shared by the IT teams for every company. If the administrator for that company understands how the tool and platform works, they can definitely start to share with their own customers and prevent any tickets or cases if something comes up. If you find the correct market for that, you will definitely become successful.
How are customer service and support?
I have had to contact Proofpoint Email Protection's technical support. I think that the quality is pretty awesome and the speed is good. In most of my cases, the people have already answered me about any type of issue that happens with the tool. If I do not have the chance to review something on my end with the actual tools that I have with Proofpoint Email Protection, they are able to help because they have more visibility on their end. Because of my role, I have partner privileges, but Proofpoint Email Protection has everything in the backend. When I raise a ticket to review if some email was sent and it is not visible in the actual logs, they were pretty cool. They provided me with information stating that the email was already blocked on their end because of certain reasons, or they explained what they do not have for that account or those things. I think that if you provide the correct information and describe your case exactly, the service and attention is faster than other options.
If I were to put Proofpoint Email Protection's support on a scale from one to ten, with ten being the highest, I would give them a nine. I really love the support from Proofpoint Email Protection.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
In my previous company, we used several other email protection services including Viper email security, Mimecast email security, and Zix protection.
How was the initial setup?
The initial deployment of Proofpoint Email Protection is easy. The first step that you need to follow is to create your user account and set up the billing details. As soon as you have everything already in place, you need to follow the actual knowledge base. Proofpoint Email Protection has videos to make the correct and proper deployment with your own mail gateways. Proofpoint Email Protection is already working with the most popular and most used mail gateways including Workspace, Gmail, and Office 365, and they have options if you have others. The process is simple and easy to connect or interconnect both.
What other advice do I have?
I sometimes thought about why users buy other security solutions or mail protection if they have their actual security methods from native mail gateways. Office 365 has their own Microsoft 365 Defender, Workspace has their own rules, and all mail gateways have their own security bench or security purposes. However, if you have a second layer to prevent and avoid this, it is definitely a growth opportunity for a company to avoid any spam, malware, or any type of malicious content that is not part of their actual daily basis from the end-user perspective.
If you have the chance and the money to buy a second layer of security method, go ahead. If you are a small company and do not want that, you can stick exactly with the native features and things that you have for your mail gateways. However, if you are one of the big companies like Salesforce, CrowdStrike, or Google, you definitely need to have second, third, and fourth layers before this type of emails arrive because your company will have more risk of being attacked. If you have the money and you are a medium or big company with more than 5,000 users, go ahead. Following only native security methods that the mail gateway has is not enough. You definitely need to start reviewing and seeing more options. Every mail solution has different types of features and I think Proofpoint Email Protection is one of the most complete tools because it has everything including Sandbox, URL Protection, different types of filters, and Attachment Defense. From a mail gateway perspective, I think Proofpoint Email Protection is one of the most complete options compared to others.
I do not think that Proofpoint Email Protection is hard to use because their knowledge base is very complete. However, it has more issues trying to align with the actual way that customers work because every customer has different ways of working. It becomes difficult when some customers have third-party solutions to send mail, such as newsletters or campaigns. If you have something Mailchimp or others, it is difficult to configure with Proofpoint Email Protection because it is completely opposite to them. Proofpoint Email Protection wants to avoid sending emails in a massive way, whereas Mailchimp is ready to send a massive amount of emails to a large number of people. To prevent blacklists and protect your own IPs and domain, both applications are dealing and fighting at the same time. I do not think it is hard to configure Proofpoint Email Protection with any mail gateways or customers only if the companies are using the native ones and just the mail server. If you are using multiple servers, that is when you start to see some problems. The most complicated aspect is with SMTP devices such as printers or faxes or whatever you are using as SMTP. I think that the devices are not fully capable of communicating with SMTP devices and Proofpoint Email Protection while avoiding messages that this is not part of your company or that the IP is not already allowed.
Regarding maintenance of Proofpoint Email Protection, it completely depends on your company and which tasks are needed to make some maintenance, such as reviewing policies, settings, allow lists, and block lists. If you are constantly reviewing this to prevent forgetting some accounts or domains, then it is more of a task for the IT teams than for Proofpoint Email Protection. Proofpoint Email Protection is continuously growing and making new releases. You just need to follow the actual notes for every update from Proofpoint Email Protection. If Proofpoint Email Protection makes any changes on their end, you need to follow the actual patch notes and then configure with your actual end accordingly.
I would rate this product a ten out of ten overall.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.