Switching from Paubox
Both products sit in front of your Google or Microsoft mail, so switching is a change of connector and DNS, not a migration. Here is the honest version of what to expect.
What stays the same
- Your mailboxes, addresses, phones and Outlook — nothing moves on Gateway.
- The idea: TLS first, encrypted fallback for recipients who can’t.
What changes
- Detection packs and the five policy actions are included on every plan, not a higher tier.
- Published, flat pricing ($6/seat Gateway) and a mailbox option (Hosted) from the same vendor.
- Per-message audit trail and evidence packs mapped to regulator questions; annual safeguards letter.
- Recipient experience: one-time code on any phone (Paubox uses a portal for fallback; both avoid passwords).
- Inbound security: spam, malware, impersonation banner included; URL detonation is on our roadmap — if you rely on Paubox’s inbound suite today, compare that feature specifically.
Timeline
- Start a PXCMail trial; sign the BAA; add DNS records alongside your existing ones (15 minutes).
- Run both for a week on a pilot group by scoping the Google/Microsoft rule; compare audit trails.
- Switch the outbound route/connector to PXCMail for everyone; remove Paubox’s SPF include and relay after confirming delivery.
- Export your Paubox archive (ask them for EML/PST) and import it into the PXCMail archive on request so history stays searchable.
- Cancel Paubox per their terms; keep their exports.
What to check before you switch
- Any recipient domains you had allow-listed or forced to portal in Paubox — recreate as exceptions/rules.
- Your DMARC: update SPF includes so you don’t exceed 10 lookups.
- Staff who use a Paubox Outlook button — teach
[SECURE](our add-in is on the roadmap).
What this switch is
Switching from Paubox Email Suite to PXCMail Gateway is a routing change. Both products sit in front of Google Workspace or Microsoft 365, so no mailbox moves, no address changes and no device is touched. You add PXCMail’s outbound route or connector beside Paubox’s, pilot one group for a week, move everyone, then remove Paubox’s route and SPF include. Plan for two short sessions a week apart, plus an archive export from Paubox if you want history searchable in one place. Gateway is $6 a seat, billed yearly, with a $49 minimum; Paubox pricing is quoted, so put your current invoice next to that number.
How Lakeside Family Dental switched
Lakeside is a 12-person dental office on Google Workspace with Dentrix. It had used Paubox for enforced TLS with portal fallback and wanted detection it did not have to buy a higher tier for, a per-message audit trail for its insurance renewal, and published pricing.
- Day 1, 30 minutes. Trial started, BAA signed by the office manager. The DNS wizard added PXCMail’s SPF include, DKIM selector and DMARC check beside Paubox’s records. A Google routing rule scoped to a pilot group (the office manager and
insurance@) sent only their mail through PXCMail. Healthcare pack in test mode. - Days 2 to 7. Both gateways ran, each on its own group. The office manager read the PXCMail audit trail each morning: which pre-auths would have been encrypted and why, which payer servers already did TLS, nothing that would have been held.
- Day 8, 20 minutes. The routing rule widened to the whole domain, policy moved to enforce, Paubox’s route removed. After one day of clean delivery, Paubox’s SPF include came out. Dentrix kept sending through the same Google account and inherited the policy without a change.
- Day 30. Paubox cancelled per its terms; the Paubox archive export kept, and imported into the PXCMail archive on request.
Lakeside pays $72 a month for 12 Gateway seats. With the 6-year healthcare archive add-on it would be $108.
Mapping your Paubox setup to PXCMail policy
Write down every rule and exception you have in Paubox before you start. Most map to one of the five PXCMail actions: deliver (TLS required), encrypt (locked delivery), warn (bounce to sender with guidance), hold (supervisor release) and block.
| What you have in Paubox | PXCMail equivalent | Notes |
|---|---|---|
| Encrypt all outbound: TLS first, portal when the recipient cannot | Default policy: deliver with TLS required; encrypt (one-time code) on fallback | Same idea; the recipient opens with a code instead of a portal account |
| Force the portal for a recipient domain | Rule: recipient domain → encrypt | Every open is logged; 30-day expiry, revoke any time |
| Partner domain allow-listed (always direct) | Rule: recipient domain → deliver (TLS required) | If they publish an S/MIME certificate, S/MIME is automatic |
| Subject keyword that forces encryption | [SECURE] in the subject | Built in on every plan; add-ins are ROADMAP |
| DLP rules (higher tier) | Detection pack + action | Included on every plan; test mode and versioning |
| Admin review or quarantine | hold action with supervisor release | Quarantine guide |
| Inbound spam and malware filtering | Spam and malware filtering included | URL detonation is ROADMAP; see the caveat below |
Rebuild the rules in test mode first. The audit trail shows what each rule would have done, and policy versioning lets you roll back a rule that fires too often. Policies guide · Tuning false positives
SPF, DKIM and DMARC changes
- SPF. During the overlap your record carries Google’s or Microsoft’s include, Paubox’s and ours. SPF allows 10 DNS lookups; the wizard counts them and re-checks every five minutes. Remove Paubox’s include only after a day of clean delivery through PXCMail.
- DKIM. Add the PXCMail selector; Paubox’s selector can stay until you remove the route. Keep your provider’s own DKIM, since internal mail still signs with it.
- DMARC. Leave your policy where it is. If you are at
p=reject, run the pilot group first and read the aggregate reports for the week; alignment failures show up there before anyone’s mail bounces. DMARC guide · DNS errors
Bringing your Paubox history with you
Ask Paubox for an archive export in EML or PST under its terms. We import it into the PXCMail archive on request so one search spans both eras, with a sha256 manifest on import. From then on, journaling captures 100% of mail into immutable storage, one year on every plan and six years on the healthcare add-on; legal hold by person, matter or date range is on Hosted Pro. Export jobs run up to 50 GB each. Keep Paubox’s original export too; your Security Rule documentation, including the old BAA and its termination, must be retained six years (45 CFR 164.316).
The inbound caveat
Paubox has a mature inbound security suite on its higher tiers. PXCMail includes spam and malware filtering; URL detonation is ROADMAP. If your practice relies on Paubox’s inbound suite today, you have two honest options: keep your MX where it is and move only outbound to PXCMail, or compare the inbound feature you actually use against what Google or Microsoft already filters on your tenant, then decide. Do not chain the two gateways one behind the other; run them side by side on separate groups.
By the numbers
- Business email compromise: 21,442 complaints and $2.77 billion in losses reported to the FBI in 2024 (IC3 2024 report).
- Coalition’s 2026 claims report puts BEC and funds-transfer fraud at 58% of all claims (Coalition). Outbound policy does not stop inbound fraud; that is why the caveat above is written the way it is.
Questions before you switch
Will patients notice anything?
Only when a message falls back to encrypted delivery. Instead of a Paubox portal they get a notification and open with a one-time code by SMS or email, in English or Spanish, with a help page. Recipients whose servers do TLS see nothing different.
Staff use a Paubox button in Outlook. What replaces it?
[SECURE] in the subject forces encrypted delivery; detection packs catch most of what the button was for. Outlook and Gmail add-ins are ROADMAP. Sending secure
Can both run at the same time?
Yes, on separate groups, by scoping the Google routing rule or the Microsoft connector. One week of overlap is enough to compare audit trails.
What about the BAA with Paubox?
Keep it in force until you cancel, then keep the signed copy and the termination notice six years. The PacinfraX BAA is signed electronically at signup, before any mail routes through us. Our BAA
How much does it cost?
Gateway is $6 a seat per month, billed yearly, $49 minimum; 12 seats is $72. The 14-day trial charges nothing. Pricing