MailGuard · Comparison

Proofpoint alternative: nine modules on one platform, Exchange Online locked to the certificate.

As a group, Proofpoint covers the same areas, split between its enterprise products and 365 Total Protection. Conbool runs all nine modules in one interface, sets up Exchange Online itself after admin consent and locks direct delivery to the gateway's TLS certificate.

Exchange Online by admin consentLock on the TLS certificateAs of 16 September 2026
Request a quoteExplore MailGuard

Module cards

Nine modules, each with its Proofpoint counterpart.

Proofpoint has a product for every area. Each card names it and shows what sets the Conbool module apart, with a link to the documentation.

MailGuard

Filtering, quarantine and DLP at the gateway. The retroactive scan checks Microsoft 365 mailboxes after the fact, including what the previous gateway let through.

At Proofpoint

Core Email Protection, as a gateway or via API through Microsoft Graph. For MSPs, 365 Total Protection.

In the documentation
SecureMail

S/MIME, OpenPGP and a message portal for recipients without keys. The Outlook add-in also works with your own Exchange Server.

At Proofpoint

Email DLP & Encryption. In 365 Total Protection, encryption with S/MIME and PGP.

In the documentation
SecureFiles

Send files of any size encrypted, with password protection, expiry and an optional reply, from the portal or from Outlook.

At Proofpoint

Secure Share for exchanging large files, described in a data sheet on proofpoint.com.

In the documentation
Disclaimer

Signatures in a visual editor with placeholders from the directory, applied at the gateway or while composing via the Outlook add-in.

At Proofpoint

Email Signature and Disclaimer in 365 Total Protection.

In the documentation
DMARC Reports

Analyse reports and move step by step from p=none via p=quarantine to p=reject without breaking legitimate mail.

At Proofpoint

Email Fraud Defense. In 365 Total Protection, the DMARC Manager.

In the documentation
Archive

Retention under German commercial and tax law, WORM principle and an audit trail with an externally anchored hash chain.

At Proofpoint

Archive for storing and searching enterprise communications. In 365 Total Protection, Email Archiving.

In the documentation
365 Backup

Mailboxes, OneDrive, SharePoint, Teams, Planner and Entra ID, as often as every four hours.

At Proofpoint

365 Total Backup in 365 Total Protection.

In the documentation
Awareness

Real attacks from quarantine are defused and reused as exercises: links, remote images and contact details are removed, the lure stays.

At Proofpoint

ZenGuide. In 365 Total Protection, the Security Awareness Service.

In the documentation
Continuity

When the mailbox is down, users read, reply and write in the continuity view, with a separate tab for what has already been sent.

At Proofpoint

Email Continuity Service in 365 Total Protection.

In the documentation

Product names as listed on proofpoint.com and proofpoint-total-protection.com, retrieved on 16 September 2026. Which products an offer includes is set by the respective contract.

Microsoft 365 integration

Connecting Exchange Online: integration guide versus setup wizard.

For Proofpoint Email Protection, Proofpoint Professional Services describes the integration in the Microsoft 365 Integration Guide, version 4.10 of 22 August 2025, on 33 pages. The steps take place in the Exchange admin center, the Defender portal and via Microsoft support. Conbool creates connectors and rules itself after admin consent and verifies the result by reading it back.

Proofpoint Email Protection

Per Integration Guide V4.10, for on-premises installations and Proofpoint on Demand

  1. 1Create an inbound connector that identifies Proofpoint by its IP addresses and requires TLS.
  2. 2Exempt Proofpoint's addresses from Exchange Online spam filtering, via the connection filter allow list and a rule setting SCL -1.
  3. 3Turn on Enhanced Filtering and skip Proofpoint's addresses there.
  4. 4Disable Safe Links rewriting for mail from Proofpoint with a transport rule.
  5. 5Create an audit rule for direct delivery, review hits, add exceptions and choose one of four blocking methods.
  6. 6Open a ticket with Microsoft support two to seven days before the MX cutover so Exchange Online does not throttle the new addresses.
  7. 7Outbound: allow relay for Microsoft 365, set SPF and DKIM, create a connector and transport rule for a test group, expand step by step, finally switch to all recipients.
  8. 8Check the addresses against Microsoft blocklists, plan IP warm-up and protect the relay against other Microsoft 365 tenants.

Conbool

Setup wizard in the portal, can be run again at any time

  • Outbound and inbound connector. The inbound connector identifies the gateway by its TLS certificate.
  • Transport rule per domain for the route through the gateway, with an exception against mail loops.
  • Rule that classifies mail flagged as spam by MailGuard as spam in Exchange Online.
  • Enhanced Filtering, so Exchange Online checks SPF, DKIM and DMARC against the real sender.
  • Conbool as a trusted ARC sealer, so the authentication result from the inbound hop is preserved.
  • Direct delivery lock as soon as MX and certificate have been checked. “Renew setup” reapplies the configuration after changes.
Set up the same configuration manually

For context: for Proofpoint Essentials, the Microsoft 365 integration also creates connectors and rules after admin consent. According to the documentation, the lock-down connector there is disabled by default and checks the IP address. Proofpoint now lists Essentials as 365 Total Protection.

Blocking direct delivery

Anyone bypassing the MX is rejected at the certificate.

Exchange Online also accepts mail directly at the mail.protection.outlook.com address, bypassing the gateway. Proofpoint's guide describes attackers using this route and recommends a block. Conbool sets it as a partner connector that only accepts mail carrying the gateway's TLS certificate.

Conbool gatewaywith the gateway's TLS certificate
Exchange Online
Mailbox
Direct deliveryno certificate, bypassing the MX
Exchange Online
550 5.7.51 rejected
Identifying the gatewayProofpointRecommended method 6A in the guide: a partner connector that rejects mail not coming from a listed IP range.ConboolA partner connector that only accepts mail with the Conbool gateway's TLS certificate. There is no IP list.
Turning it onProofpointThe admin first reviews an audit rule, chooses one of four methods and creates it. In Essentials, the lock-down connector is disabled by default.ConboolOn by default. The setup wizard turns the lock on itself once the check has passed.
Checks beforehandProofpointThe guide requires checking the MX records of every domain beforehand, otherwise an email outage may follow.ConboolSetup checks the MX of every accepted domain and the gateway's certificate. If the check fails, the lock stays off and the portal states the reason.
onmicrosoft.com addressesProofpointAccording to the guide, mail to these addresses always reaches Microsoft 365 directly under method 6A.ConboolThe onmicrosoft.com domains are always part of the lock, because every mailbox has an address there.
Domains with another MXProofpointIf domains need to deliver directly to Microsoft 365, the guide recommends only the rule methods 6B or 6C.ConboolThe lock applies to the domains whose MX points to Conbool. Domains with another MX remain reachable, and the portal flags them.
MaintenanceProofpointThe admin maintains the IP list. The guide advises reviewing it regularly for new exceptions.Conbool“Renew setup” reapplies the lock after changes. When the gateway pool changes, Conbool moves the lock along.

The rejection happens within the SMTP session. Measured on 14 September 2026 on a Conbool test tenant: delivery from a foreign address rejected with 550 5.7.51, mail through the gateway delivered.

Gateway bypass routes in the documentation

Exchange on premises

Without Microsoft 365, too.

Proofpoint's guide covers Microsoft 365. An on-premises Exchange appears there as an exception in the blocking rules. Conbool connects Exchange Server directly.

No MX change

A send connector routes outbound mail through Conbool. Signature, encryption and DKIM apply, the MX stays as it is.

Documentation

Outlook add-ins

SecureMail, Disclaimer, SecureFiles, Archive and Awareness in Outlook with your own Exchange Server, without Microsoft 365 or Entra ID.

Documentation

Internal mail

The Exchange agent routes mail between mailboxes on the same server through a Conbool gateway in your own network, for example for encryption.

Documentation

Active Directory

The directory agent reads users via LDAPS with Kerberos. No password is stored anywhere.

Documentation

More on running with Exchange Server: Email security for Exchange Server

Vendor and operation

Who is behind it and where it runs.

Information on Proofpoint from press releases, the company page and the subprocessor list.

CompanyProofpointProofpoint, Inc., headquartered in Sunnyvale, California. Owned by Thoma Bravo since 31 August 2021.ConboolConbool GmbH, based in Hamburg, Germany.
Product linesProofpointEnterprise products on proofpoint.com. Hornetsecurity has been part of the group since 8 December 2025, as a dedicated business unit for MSPs and SMBs. The legal notice of proofpoint-total-protection.com lists companies of the Hornetsecurity group.ConboolOne platform with nine modules in one interface, for direct customers and partners.
Data centresProofpointFor Email Protection, the subprocessor list names AWS in seven countries, including Germany, and Equinix with Germany, the Netherlands and the UK, assigned there by customer location.ConboolServers in Frankfurt am Main, data stored in the EU.
In your own data centreProofpointAccording to the guide, Proofpoint Protection Server is available as an on-premises installation and as Proofpoint on Demand.ConboolConbool runs either in the cloud or as an installation in your own data centre.

Switching from Proofpoint

Move in five steps.

The process for Microsoft 365. Proofpoint stays in the mail flow until the MX cutover.

  1. 1

    Consent

    Connect Microsoft 365 in the portal and grant admin consent. Add domains and verify them with a TXT record.

  2. 2

    Prepare DNS

    Set DKIM and SPF as specified in the portal. The Proofpoint entries stay in place until the end.

  3. 3

    Run setup

    The wizard creates connectors, rules, Enhanced Filtering and the ARC entry. The lock stays off while the MX still points to Proofpoint.

  4. 4

    Switch the MX

    Turn off the blocking method for Proofpoint, point the MX to Conbool and run “Renew setup”. The certificate lock now applies.

  5. 5

    Clean up

    Remove the Proofpoint connectors and rules, including the spam filter and Safe Links bypass. Clean up SPF and end the contract on time.

Conbool fits if

You want breadth without a second product line.

  • all nine areas should run in one interface.
  • Exchange Online should be set up by admin consent rather than step by step from a guide.
  • direct delivery should be locked to a certificate, without maintaining IP lists.
  • mailboxes also live on your own Exchange Server, with add-ins and agents without Microsoft 365.
  • a contracting party based in Germany with servers in Frankfurt is a requirement.

Proofpoint fits if

The global platform comes first.

  • Insider Threat Management, Enterprise DLP or DSPM should come from the same vendor.
  • data centres outside Europe are needed, for example in Australia, Canada or Singapore.
  • Proofpoint is already in place and your own integrations depend on it.
  • an MSP already carries 365 Total Protection in its portfolio.

Frequently asked questions

Mimecast or Proofpoint?Three vendors compared.Hornetsecurity vs. ConboolPart of Proofpoint since December 2025.Microsoft Defender vs. ConboolWhen Microsoft 365's built-in tools should be enough.Email security for Microsoft 365Protect gateway and mailbox together.Email security for Exchange ServerAdd-ins, agents and integration without an MX change.Gateway bypassDetect and close routes around the gateway.

Sources

Proofpoint Professional Services, Microsoft 365 Integration Guide and Best Practices, version 4.10 of 22 August 2025. Proofpoint Essentials, Microsoft 365 Integration (MX Deployment) on help.proofpoint.com. Product overview, MSP page, Secure Share data sheet and subprocessor list on proofpoint.com. Service overview on proofpoint-total-protection.com. Press releases on Thoma Bravo completing its acquisition on 31 August 2021 and on Proofpoint completing its acquisition of Hornetsecurity on 8 December 2025. Retrieved on 16 September 2026. Statements about Conbool match the linked documentation.

Proofpoint is a trademark of Proofpoint, Inc. Hornetsecurity is a trademark of Hornetsecurity GmbH. Microsoft 365, Exchange, Outlook, Entra and Defender are trademarks of the Microsoft group of companies. This page is an editorial comparison by Conbool GmbH and not material from the vendors named.

See Conbool on your own tenant.

Grant consent, run the setup and check the result in the Exchange admin center.

Request a quoteRead the guide