Outbound email scanning with AV/AS between Gmail and Email Security - Cloud is only available for users with the AS/AV + Advanced Threat mode license. Regardless of the deployment mode used for your inbound domains, outbound scanning always requires AS/AV + Advanced Threat Detection.
Trellix requires any domain serviced through Email Security - Cloud outbound scanning to include a valid SPF record that contains Email Security - Cloud's IP addresses. You must adjust your DNS records accordingly. Email Security - Cloud adds a DKIM signature to outgoing messages to ensure the security of the message.
This section includes the following:
Configuring your MTA