Sophos Email Security Setup Guide India — MX Records, SPF, DKIM & DMARC

Sophos Email Security deploys as a cloud MX gateway — it sits between the internet and your mail server, scanning all inbound and outbound email before delivery. This guide covers the complete technical configuration for deploying Sophos Email Security in India, including MX record changes, SPF updates, DKIM alignment, DMARC policy setup, and integration with Google Workspace or Microsoft 365.

Prerequisites Before You Start

Before making any DNS or mail platform changes:

Sophos Central account activated — your Sophos Email licence must be active and your domain added to Sophos Central
DNS access — admin access to your domain's DNS zone (through your registrar: GoDaddy, BigRock, Namecheap, or your hosting provider's DNS panel)
Mail platform admin — Google Workspace Super Admin or Microsoft 365 Global Admin access
Current MX records noted — document your existing MX records before changing them; you'll need these for rollback if required
SPF record backed up — copy your current SPF TXT record before modifying it

Step 1 — Add Your Domain to Sophos Central

Log in to Sophos Central (central.sophos.com)
Navigate to Email Security → Domains
Click Add Domain and enter your domain name (e.g., yourdomain.com)
Sophos will show you a TXT verification record — add this to your DNS to verify domain ownership

DNS verification record format:

Type: TXT
Name: _sophos-domain-verification.yourdomain.com
Value: sophos-verify-xxxxxxxxxxxxxxxxxx
TTL: 3600

Sophos verification typically completes within 15–30 minutes once the TXT record propagates.

Step 2 — Change Your MX Records

This is the core change that routes all inbound mail through Sophos Email instead of directly to your mail server.

Remove your existing MX records and replace with:

Type: MX  Priority: 10  Value: mx1.sophos.com
Type: MX  Priority: 20  Value: mx2.sophos.com

Before changing: Keep your existing MX record(s) at a higher priority number (e.g., priority 100) temporarily as a fallback during DNS propagation:

Type: MX  Priority: 10   Value: mx1.sophos.com         (new — primary)
Type: MX  Priority: 20   Value: mx2.sophos.com         (new — secondary)
Type: MX  Priority: 100  Value: aspmx.l.google.com     (old GWS — temp fallback)

Remove the old fallback entry after 24–48 hours once Sophos is receiving mail successfully.

DNS propagation: MX record changes propagate globally in 24–48 hours. During propagation, some senders will reach Sophos first, others may still reach Google or Microsoft directly. Sophos Email's quarantine digest should show incoming mail within 2–4 hours of the MX change.

Step 3 — Configure the Mail Destination in Sophos Central

After changing MX records, tell Sophos where to deliver clean mail.

In Sophos Central → Email Security → Domains → your domain → Inbound Settings
Set the Mail Destination (also called Smart Host or Delivery Route):
- For Google Workspace: aspmx.l.google.com (port 25) or your custom mail hostname
- For Microsoft 365: yourdomain-com.mail.protection.outlook.com (port 25)
- For on-premise Exchange: your Exchange server's public IP or hostname
Enable TLS for the delivery connection (Google and Microsoft both support TLS; enforce it)

Step 4 — Lock Down Your Mail Platform (Prevent Gateway Bypass)

After Sophos is routing your mail, you must prevent email from bypassing the gateway and arriving directly at Google Workspace or Microsoft 365. Without this, a sender who knows your mail server's address can skip Sophos entirely.

Google Workspace — Restrict to Sophos IPs Only

In Google Admin Console → Apps → Google Workspace → Gmail → Advanced Settings → Inbound Gateway
Enable Inbound Gateway
Add Sophos Email's egress IP ranges (available in Sophos Central → Email → IP Addresses)
Enable "Reject all mail not from gateway IPs"

This ensures Gmail only accepts mail from Sophos's IP addresses, blocking direct delivery attempts.

Microsoft 365 — Create a Restricted Connector

In Exchange Admin Center → Mail Flow → Connectors → New Connector
Connection type: Partner organisation → Office 365
Restrictions: Only from Sophos IP ranges
Apply: Inbound mail

This tells Microsoft 365 to only accept inbound mail that originates from Sophos's infrastructure.

Step 5 — Update Your SPF Record

SPF (Sender Policy Framework) tells receiving mail servers which IPs are authorised to send mail on behalf of your domain. After adding Sophos Email, you need to include Sophos's sending IPs in your SPF record — particularly if you're routing outbound mail through Sophos for DLP scanning.

Before (Google Workspace example):

v=spf1 include:_spf.google.com ~all

After (Google Workspace + Sophos Email outbound):

v=spf1 include:_spf.google.com include:_spf.sophos.com ~all

After (Microsoft 365 + Sophos Email outbound):

v=spf1 include:spf.protection.outlook.com include:_spf.sophos.com ~all

Important: SPF records have a 10-DNS-lookup limit. If your current SPF record is already complex (multiple include: statements), verify the total lookup count does not exceed 10 after adding Sophos. Tools like MXToolbox SPF Checker can verify this.

Step 6 — DKIM Signing and Alignment

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outbound messages, allowing receiving servers to verify that email claiming to be from your domain was actually sent by an authorised server.

For Google Workspace

Google Workspace signs outbound mail using your domain's DKIM key. This signature survives if Sophos routes the mail without modifying headers. Verify DKIM alignment after deployment using:

# Send a test email to a Gmail or Yahoo address and check headers
# Look for: Authentication-Results: dkim=pass

For Microsoft 365

Microsoft 365 also signs outbound DKIM. Enable DKIM signing in Exchange Admin Center → Email Authentication → DKIM before deployment.

Sophos Email DKIM

Sophos Email can add DKIM signing to outbound messages if your outbound mail routes through Sophos. Configure this in Sophos Central → Email → Policies → DKIM Signing. Sophos signs with your domain using keys hosted in Sophos's infrastructure — you add CNAME records to your DNS pointing to Sophos's signing key servers.

Step 7 — DMARC Policy Setup

DMARC (Domain-based Message Authentication, Reporting and Conformance) instructs receiving mail servers what to do with messages that fail SPF and DKIM checks. It also generates aggregate reports that show you who is sending mail on behalf of your domain.

DMARC DNS Record:

Type: TXT
Name: _dmarc.yourdomain.com
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100; adkim=r; aspf=r

Policy options:

p=none — monitoring mode; no action taken; use during initial setup
p=quarantine — messages failing DMARC go to spam folder
p=reject — messages failing DMARC are rejected entirely (strictest)

Recommended progression:

Start with p=none during Sophos Email deployment
Monitor DMARC reports for 2–4 weeks to identify all legitimate mail sources
Move to p=quarantine once all legitimate senders are aligned
Move to p=reject once you're confident all legitimate mail passes DMARC

Cloudfy Systems handles DMARC monitoring and progression as part of managed support. We review aggregate reports monthly and flag any unauthorised senders using your domain.

Step 8 — Configure Inbound Policies in Sophos Central

After the gateway is receiving mail, configure your inbound policies in Sophos Central:

Anti-spam:

Action for spam: Quarantine (recommended) or Tag Subject
Quarantine release: User self-release (users get a daily digest)
Quarantine retention: 30 days

Antivirus:

Action for infected attachments: Strip attachment and quarantine
Unscannable attachments: Quarantine (don't deliver files Sophos can't inspect)

Phishing:

Action: Quarantine
Lookalike domain detection: Enable (catches typosquatted domains)

BEC / Impersonation (Advanced edition):

Enable display name impersonation detection
Add your VIP list — CEO, CFO, Directors, Finance team (the accounts that attackers most often impersonate)
Action: Quarantine + notify admin

Sandboxing (Advanced edition):

Enable Sophos Sandstorm for all attachment types
Action on malicious verdict: Quarantine with admin notification

Post-Deployment Verification

After completing all steps, verify the configuration:

Send a test email from an external account to your domain. Confirm it arrives and check headers for X-Sophos-* processing headers.
Check SPF using MXToolbox or Google Admin Toolbox: https://toolbox.googleapps.com/apps/checkmx/
Check DKIM by sending a test email to check-auth@verifier.port25.com — you'll receive an authentication report
Check DMARC using a DMARC monitoring tool (Cloudmark, MXToolbox, or Sophos Central's built-in reporting)
Confirm no mail is bypassing — check Google Workspace / M365 mail logs to ensure all inbound mail is arriving from Sophos IPs only

Common Issues and Fixes

Sophos not receiving mail after MX change: Wait for DNS propagation (up to 48 hours). Use nslookup -type=MX yourdomain.com from multiple locations to check propagation status.

SPF failure after adding Sophos: Verify your SPF record includes include:_spf.sophos.com and has not exceeded 10 DNS lookups. Flatten SPF includes if needed.

Quarantine releasing mail but it's not arriving: Check the Mail Destination in Sophos Central — confirm the delivery hostname is correct for your mail platform.

Legitimate mail going to quarantine: Add the sender's domain to your allowlist in Sophos Central → Email → Allow / Block Lists. Review quarantine settings threshold if false positive rate is high.

Should You Configure This Yourself or Use a Partner?

Sophos Email Security deployment involves coordinated changes across DNS, your mail platform (GWS or M365), and Sophos Central. A misconfigured MX record or incomplete SPF update can result in mail delivery failures or Sophos being bypassed entirely.

Cloudfy Systems — authorised Sophos Email partner in India — handles the complete deployment: MX changes, SPF/DKIM/DMARC setup, platform connector configuration, policy setup and post-deployment verification. Contact us for a deployment quote and a same-day INR pricing for Sophos Email Security.