When TLS is enabled, what is the default behavior regarding TLS on the Protection Server?

The default behavior for TLS on the Proofpoint Protection Server is opportunistic. This means that for any given SMTP session, the server will advertise and attempt to negotiate a secure connection using the STARTTLS command. If the remote mail server supports TLS and the negotiation is successful, the session is encrypted. However, if the remote server does not support TLS or the negotiation fails, the Proofpoint server will proceed with the connection in plaintext to ensure mail can still be delivered. This default setting prioritizes mail flow and interoperability while enabling encryption whenever possible.

A. SMTP, not HTTP, is the protocol used for email transport. If TLS fails, the fallback is to plaintext SMTP.

B. TLS is critical for securing communications with external mail servers, not just for internal traffic.

C. Rejecting a message upon TLS failure is characteristic of "enforced" or "mandatory" TLS, which is a non-default, stricter policy setting.

1. Proofpoint Protection Server 8.18 Administrator Guide: In the chapter on "Email Firewall

" the section discussing TLS connection profiles describes the default behavior. It states that by default

TLS is attempted but not required

which is the definition of opportunistic TLS. This is typically configured under System > TLS / Encryption > TLS Profiles. The default profile is set to allow fallback to clear text.

2. RFC 3207

"SMTP Service Extension for Secure SMTP over Transport Layer Security": This foundational document defines the STARTTLS command. Section 4 describes the process where a server advertises TLS capability. A client can then request to start a TLS negotiation. If it fails

or if the client chooses not to

the connection continues in plaintext. Proofpoint's default implementation aligns with this standard for opportunistic encryption.