Sopho Email Protection Setup for Google Workspace

I want to say that your write up could use a bit more tweaks.  The configuration will inclusive has given us quite a bit of heartache.

We had use some documentation here: https://help.proofpoint.com/Proofpoint_Essentials/Email_Security/Administrator_Topics/hostedemailservices/gsuite

To help us get this right. The addition of the additional Google IP Addresses is helpful in preventing INVALID Bounces.

The highlighted section about :

There have been instances where Google has blocked it's own IP addresses from delivering. In this case, their only solution that they have provided is to uncheck the box that says "Reject all mail not from gateway IPs"

If you do uncheck this box, your mail server is not locked down to only accept external mail from Proofpoint IP's. It is possible for senders to route directly to your mail system instead of following normal MX lookups to route through Proofpoint. 

The error received is similar to this:

Google tried to deliver your message, but it was rejected by the relay <a href="http://aspmx.l.google.com" target="_blank">aspmx.l.google.com</a> [Google IP]. We recommend contacting the other email provider at <a href="mailto:postmaster@aspmx.l.google.com" target="_blank">postmaster@aspmx.l.google.com</a> for further information about the cause of this error. The error that the other server returned was: 421 4.7.0 IP not in whitelist for RCPT domain, closing connection. 39si990106uak.192 - gsmtp

Was super helpful as well.