Proofpoint

Fromenance is a communication provenance platform that answers forwards sent to verify@yourdomain.com. When Proofpoint fronts your mail, the redirect can live in Proofpoint or behind it in Google Workspace or Microsoft 365; this page covers both placements and what Proofpoint must not do to the message.

By the end you will have chosen where the redirect lives, configured it, kept the outbound copy signed for your domain, and seen the forwarding test marked Working.

Choose where the redirect lives

Placement	When to use	Authentication Fromenance sees
Behind Proofpoint, in Google Workspace or Microsoft 365	Default. Proofpoint only filters inbound; the platform redirects outbound and signs	Platform DKIM or ARC for your domain
In Proofpoint, as a routing rule to an external recipient	The mailbox platform cannot redirect, or you want the redirect before any mailbox	Requires Proofpoint outbound DKIM signing for your domain

In both cases the outbound copy that reaches <slug>@verify.fromenance.com must carry a DKIM signature or ARC seal for a domain you own, and its body must not be modified after signing. Proofpoint URL Defense rewrites links inside the customer’s forward; that happens on the inbound leg before the redirect and is expected. Fromenance unwraps Proofpoint v2 and v3 rewritten links when fingerprinting, so rewriting does not hurt matching.

Option A: redirect behind Proofpoint

1. Allow external mail to verify@yourdomain.com through Proofpoint: Email Protection, Policy Routes or Spam Policies, make sure verify@ is not on a quarantine only route. Customers write from personal addresses, often with .eml attachments, which attachment defense may sandbox; allow message/rfc822 attachments for this recipient.
2. Configure the redirect on the mailbox platform: Google Workspace or Microsoft 365.
3. On the outbound leg, if Proofpoint relays outbound mail for your domain, open Email Protection, Email Firewall (or Outbound policy), and make sure no rule appends a disclaimer or footer to mail whose sender is external (the customer) and whose recipient is @verify.fromenance.com. Add a rule with Recipient equals *@verify.fromenance.com and action Deliver now placed above disclaimer rules.

Option B: redirect in Proofpoint

Proofpoint Email Protection (on premises or hosted)

1. Email Protection, Email Firewall, Rules, Add.
2. Conditions: Recipient equals verify@yourdomain.com.
3. Action: Redirect to (in some versions Change recipient), value northfield@verify.fromenance.com. Do not use Copy to or Forward to, which add recipients or rewrite the sender.
4. Set the rule to stop processing further rules and place it above any disclaimer or DLP rule.
5. Outbound signing: DKIM Signing under System, Domain Keys. Add a signing key for yourdomain.com, publish the selector TXT record, and enable signing for outbound mail on the route that carries the redirect. Without this the copy leaves unsigned and Fromenance rejects it with auth_failed.

Proofpoint Essentials

1. Administration, Company Settings, Filters, New filter, direction Inbound.
2. Scope: Specific user verify@yourdomain.com.
3. Action: Redirect to and enter northfield@verify.fromenance.com.
4. Essentials cannot sign outbound mail for your domain by itself; the redirect is delivered by the Essentials relay. If the forwarding test fails with auth_failed, use Option A instead.

Confirm with the forwarding test

1. Setup wizard, step 4, Send test, or POST /v1/domains/{id}/forwarding-test.
2. Status should read Working via dkim yourdomain.com (Option B or Google behind Proofpoint) or Working via arc yourdomain.com (Microsoft 365 behind Proofpoint).
3. failed: auth_failed naming a body hash mismatch means a disclaimer or footer was stamped after signing. Move the deliver now rule above it.
4. failed: domain_not_owned naming pphosted.com or a Proofpoint relay domain means the copy was signed by Proofpoint’s domain rather than yours. Enable DKIM signing for your domain in Proofpoint, or add that relay domain to Fromenance with the trust role only if it is dedicated to your tenant.

Then forward any message from a personal mailbox to verify@yourdomain.com and confirm a Not verified reply arrives.