Ask HN: Proofpoint is blocking our emails. Any recourse?

In our case, the domain was registered 15 years ago and email is only sent using Google Workspace. SPF, DKIM, DMARC (strict) all set up as they should be. The customers using proofpoint who suddenly stopped getting our emails had previously had no issues for 10+ years. In some cases (not all), those customers couldn't email us either - emails both directions got silently dropped, so even the employees of some customers didn't know their emails were not going through until we got angry calls asking why we weren't responding to them anymore.

Ultimately, I discovered the trigger was a compromised WordPress plugin quietly injecting SEO spam... running on wpengine. That WordPress site was fully owned/managed by our marketing team and in no way connected to our corporate infrastructure, other than by a CNAME of the same domain email is sent from. I had the marketing team revert to a backup that wasn't compromised, update all the plugins, and used quttera's scanner (which found it initially) to confirm the issue was gone, and within a few weeks it appeared we were no longer blocked. I say appeared because long before that point we had contacted all customers who had MX records indicating proofpoint was used, requesting manual whitelisting.

As much as I'd love to ban WordPress use at the company, we had to settle for using an internal-only WP instance and a plugin that generates a static site export to eliminate any chances of this happening again.

There's also https://sender.office.com/ for o365.

The other question is how far is it getting before getting blackholed. if you're lucky "mtr -P 587 -T smtp.office365.com" from the company email server from might tell you who down the path is actually dropping the packets.

If there's budget for it, you can run a VPS in Azure and send it through that, connecting to 587 which is authenticated (25 is blocked), or use Sendgrid/similar that partners with Microsoft.

Proofpoint: * Does very aggressive "bot click" checks when they suspect your email is spam. They'll hit every link in every email, trying to check if the destination page is legit. They'll be rotating IPs and user agents for every hit and probably using the AWS IP range - of your web server blocks this behaviour, then that might be the reason why they penalize your emails. * They will block you based on the behaviour of other mailers that share the same sending IP. If you're not sending from a stable IP that's exclusively yours, then that could be the problem. Think about what other systems live/send email from that IP.

If you send me an email directly from your system (not forwarding an email) then I could take a quick look.