Overview
Trustifi’s outbound email integration allows organizations to securely integrate email encryption, Data Loss Prevention (DLP) enforcement, and outbound user activity monitoring into their existing email environment.
Trustifi supports two outbound integration architectures, each designed to accommodate different deployment requirements and email infrastructures:
Trustifi MTA Architecture – Outbound email is routed to Trustifi’s secure SMTP relay and delivered using Trustifi’s Mail Transfer Agent (MTA) via Amazon SES. This architecture requires domain verification and offers a simpler setup with fewer mail flow hops.
Your MTA Architecture – Outbound email is sent to Trustifi for processing and then returned to the organization’s own mail server for final delivery. This architecture does not require domain verification and avoids Amazon SES limitations, but requires additional mail flow configuration.
Both architectures support limited-scope proof-of-concept (POC) deployments in environments that allow custom mail flow rules, such as Microsoft 365 and Google Workspace.
If you are unsure which integration architecture is best suited for your organization, or if you would like assistance with deployment, contact Trustifi support at [email protected].
“Trustifi MTA” Architecture
In the Trustifi MTA architecture, Trustifi configures an outbound (send) connector in the organization’s email environment that routes outbound email to Trustifi’s secure SMTP relay.
Trustifi processes outbound email and delivers it using Trustifi’s Mail Transfer Agent (MTA), which is powered by Amazon SES.
Email environments that support custom mail flow rules, such as Microsoft 365 and Google Workspace, can use this architecture for limited-scope POC deployments.
Note:
Every integrated domain must be verified in Trustifi by adding custom DNS records. For additional information, refer to the Domain Verification guide.
Supported Platforms and Documentation
Pros
Quick and straightforward setup requiring only a single outbound connector
Fewer SMTP hops compared to the Your MTA architecture, resulting in slightly faster delivery
Supported in both Microsoft 365 and Google Workspace environments
Cons
Requires domain verification and DNS record updates
Subject to Amazon SES technical limitations:
Attachments larger than 40 MB are automatically encrypted
Emails sent to distribution groups may be delivered more than once
Emails with a message body larger than 15 MB are compressed
“Your MTA” architecture
In the Your MTA architecture, outbound email is sent to Trustifi for processing and then routed back to the organization’s own mail server for final delivery.
Mail flow occurs as follows:
The email is sent to Trustifi’s secure SMTP relay using a send connector
Trustifi applies encryption, DLP rules, and other outbound policies
Trustifi routes the email back to the organization’s MTA
The organization’s MTA delivers the email to the final recipient
This architecture supports limited-scope POC deployments and does not require domain verification.
Supported Platforms and Documentation
Pros
Emails are sent from the organization’s own MTA and are automatically authenticated
No domain verification or DNS changes required
Not subject to the technical limitations imposed by Amazon SES
Cons
Requires configuration of an additional connector to receive mail from Trustifi
Adds an extra hop in the mail flow, though this does not significantly impact delivery time
Not supported for on-premises-only email environments
The Delivered event is not supported in outbound email tracking
Notes and Recommendations
Trustifi MTA Architecture is recommended for organizations seeking the simplest setup and fastest outbound mail flow
Your MTA Architecture is better suited for organizations that cannot perform domain verification or need to avoid Amazon SES limitations
Both architectures support limited-scope POC deployments
Platform compatibility and reporting requirements should be evaluated before selecting an integration method