Proofpoint email authentication
Enterprise email security and outbound relay.
This provider uses SPF macros rather than a fixed include. The record expands per-message based on the connecting IP, so there is no static value to copy.
Follow the provider's own documentation — a hand-written include will not work here.
DKIM
Enable DKIM inside Proofpoint and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.
DMARC
Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them
to it. Once Proofpoint is authenticating, publish a DMARC record — start at
p=none with a reporting address and
tighten from there.
Check it worked
DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.