Corporate Email — Architecture Overview
Summary
Corporate email is delivered via Microsoft 365 (Exchange Online), with Proofpoint deployed in front of it as a secure email gateway for both inbound (external → internal) and outbound (internal → external) mail flow. This layered design ensures all mail is filtered for threats before it ever reaches a mailbox, and outbound mail is inspected for data loss before it leaves the organization.
Architecture Diagram
flowchart LR
ext[External Sender] --> pp_in[Proofpoint<br/>Inbound Gateway]
pp_in -->|Spam / Phishing / Malware<br/>filtering| m365[Microsoft 365<br/>Exchange Online]
m365 --> mbx[User Mailbox]
mbx --> pp_out[Proofpoint<br/>Outbound Gateway]
pp_out -->|DLP / Encryption<br/>enforcement| extrecv[External Recipient]
m365 <--> aad[Entra ID<br/>Authentication]
mbx <--> okta[Okta SSO]Components
| Component | Role |
|---|---|
| Proofpoint | Secure email gateway — spam, phishing, malware filtering (inbound) and DLP/encryption policy enforcement (outbound) |
| Microsoft 365 / Exchange Online | Core mailbox hosting, calendaring, and mail routing |
| Entra ID | Identity backbone for M365 authentication |
| Okta | Federated SSO layer for end-user login |
Mail Flow
Inbound (External → Internal): 1. External sender sends mail, MX records route it to Proofpoint first. 2. Proofpoint scans for spam, phishing, and malware. 3. Clean mail is forwarded to Exchange Online. 4. Mail lands in the recipient's mailbox.
Outbound (Internal → External): 1. User sends mail from their M365 mailbox. 2. Exchange Online routes outbound mail through Proofpoint. 3. Proofpoint applies DLP rules (e.g. blocking sensitive data patterns) and encryption policy where required. 4. Mail is released to the external recipient.