Proofpoint runs two hosted email security services: Proofpoint Protection for enterprises, whose MX hosts live under pphosted.com, and Proofpoint Essentials for smaller companies through partners, under ppe-hosted.com. Both sit in front of the real mailbox host, and Spaw reports both as mx_provider: "proofpoint".
How Proofpoint shows up in DNS
Enterprise customers publish MX records shaped like mxa-00148501.gslb.pphosted.com and mxb-00148501.gslb.pphosted.com, where the number identifies the customer; Essentials customers use regional hosts under ppe-hosted.com. Spaw matches both suffixes. The MX target is a filtering gateway, so mx_provider names the guard at the door and the mailbox host behind it, typically Microsoft 365 or Google Workspace, stays out of view.
How Proofpoint answers a verification handshake
Proofpoint can validate recipients against the customer's directory when the customer sets that up, and those gateways reject unknown recipients in the session. Without recipient validation, the gateway accepts every recipient at RCPT TO, forwards the message and lets the mailbox host bounce it later, which makes the domain a catch-all to any verifier. In practice, catch-all is the common answer behind Proofpoint. Enterprise gateways also throttle unfamiliar sources and can drop a connection mid-session, which surfaces as smtp_reason: timeout or no_connect.
What that means for your verdicts
Most Proofpoint-protected domains answer risky with reason: catch_all. Spaw remembers the catch-all per domain for seven days and returns mailbox_confidence per address: Proofpoint is on the established-provider list, so the estimate starts ten points up, then moves with DMARC and SPF, the domain's age, the shape of the username, and your own delivery feedback. Domains with recipient validation answer cleanly, deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found. A timed-out probe leaves the address unverified with the free signals deciding the verdict; callback_url schedules re-checks after 5 and 20 minutes at no cost.
Feed delivery outcomes back. Behind a catch-all gateway, a delivered report is the only way to turn an address into a confirmed mailbox (smtp_reason: delivered_recently), and a bounce rate above half for the domain removes twenty points from every confidence estimate on it.
SPF and DMARC at Proofpoint
Companies that also send through Proofpoint add the include their console shows. Proofpoint Essentials documents regional values such as include:_spf-us.ppe-hosted.com and include:_spf-eu.ppe-hosted.com; enterprise (pphosted.com) customers receive per-customer authorized hosts from Proofpoint rather than one universal include, so the exact value should be copied from the admin console. Inbound filtering leaves the domain's own SPF and DMARC untouched, and Spaw reports them live in has_spf and dmarc_policy.
Practical notes for sending to domains behind Proofpoint
Proofpoint customers are mostly large organisations, and the gateway applies reputation, URL rewriting and attachment sandboxing before anything reaches a mailbox. Authentication alignment matters more than at any consumer provider. Expect a high share of risky catch-all answers on B2B lists, rank them by mailbox_confidence, and keep role addresses out of personalised sequences even when the gateway accepts them.
For a live look at any Proofpoint-protected domain, run it through the free MX lookup and the SPF and DMARC checker.