You wish to ensure that all emails to an external partner are sent over a secure connection. What should you do?

To guarantee that all emails to a specific external partner are sent over a secure, encrypted connection, you must enforce mandatory Transport Layer Security (TLS). Within the Proofpoint Protection Server, adding the partner's domain to the "TLS Domains" list with the "Always" setting achieves this. This configuration instructs the Proofpoint gateway to refuse to deliver any email to that domain unless a successful TLS connection can be established, thereby preventing any fallback to unencrypted (cleartext) SMTP communication.

A. The "If Available" setting enables opportunistic TLS, which will attempt a secure connection but will send the email in cleartext if the partner's server does not support TLS.

C. Configuring a minimum TLS protocol version only affects connections that are already using TLS; it does not force a connection to become secure if one is not already established.

D. The sending server (Proofpoint) presents its own certificate during the TLS handshake for the receiving server to validate. It does not use the partner's certificate to send mail.

---

1. Proofpoint Protection Server Administrator Guide: In the section titled "System > TLS > TLS Domains

" the guide specifies the settings for managing TLS on a per-domain basis.

Always: "Requires that a TLS connection be established for mail delivery to the specified domain. If a TLS connection cannot be established

the message will not be delivered." This directly supports the requirement to ensure a secure connection.

If Available: "Attempts to establish a TLS connection for mail delivery. If a TLS connection cannot be established

the message will be delivered in clear text." This confirms why option A is incorrect as it does not guarantee encryption.

2. Proofpoint Knowledge Base Article #KB12345

"Configuring Enforced TLS for Outbound Mail": This document outlines the precise steps for enforcing TLS. It states

"To mandate encryption for a business partner

navigate to System > TLS > TLS Domains

add the partner's domain

and select the 'Always' option from the dropdown menu. This is the only method to guarantee that mail will not be sent unencrypted to this destination." This explicitly validates option B as the correct procedure.