Go-live checklist

Do these in order. Each step can be undone, and mail keeps flowing the whole time: the old MX keeps working until DNS caches expire.

Before the cut-over

Host name. Create an A record for the gateway (e.g. mx1.example.com) pointing at its public IP, and a matching PTR (reverse DNS) record with your ISP. Set the same name in Settings › General › Gateway hostname.
TLS certificate. Replace the temporary self-signed certificate with a free Let's Encrypt one - see below. Do this before opening the console to the internet.
Firewall. Forward TCP 25 (and 443 for the console / digest links) to the gateway. Keep 5432, 8440, 10026 and 11332 closed - they are internal.
Spamhaus DQS key entered (Settings › Spamhaus); System health shows the test entries answering.
Platform side prepared (connector, Enhanced Filtering, Junk rule, inbound gateway) - the exact steps are on each domain page.
Users synced and VIPs marked.
Lower the MX TTL to 300 seconds a day ahead, so a rollback is quick.

Let's Encrypt certificate

One certificate serves both SMTP (Postfix STARTTLS - Microsoft 365 connectors and other mail servers check it) and the web console. Obsidian requests and renews it for you.

Recommended: Cloudflare DNS validation

If the domain's DNS is on Cloudflare, validation happens through a temporary DNS record, so the gateway needs no inbound access at all - you can have a real certificate before any firewall change.

In Cloudflare: My Profile › API Tokens › Create Token › Edit zone DNS template. Permissions Zone › DNS › Edit; Zone resources Include › Specific zone › your domain. Create and copy the token (shown once).
In Cloudflare DNS, create the A records for the names (e.g. mx1 and portal) pointing at the gateway's public IP, DNS only (grey cloud) - Cloudflare's proxy cannot carry SMTP. (For DNS validation the records can be added later; they are only needed for traffic.)
In Obsidian: Settings › General › Gateway hostname = the MX name, Save.
Settings › TLS certificate: Certificate hostnames (e.g. mx1.obsidiansuite.net and portal.obsidiansuite.net), contact email, method cloudflare, paste the token. Save.
Click Request certificate. After about a minute refresh the page: "Last request: succeeded" and the installed certificate shows Let's Encrypt with ~90 days left. Postfix and nginx are reloaded automatically.

Testing a new setup? Tick staging first (no rate limits, untrusted certificate), then untick and request again.

Alternative: HTTP validation

For domains not on Cloudflare: point the names at the gateway's public IP, forward TCP 80 to the gateway (nginx serves the challenge from /var/www/html), choose method http and request. Wildcard names are not possible with this method.

Renewal

certbot checks twice a day and renews 30 days before expiry, then installs the new certificate and reloads Postfix and nginx. System health shows the days left; the contact email gets a warning from Let's Encrypt if renewal ever fails.

Using your own certificate instead

Copy your files over /etc/obsidian/tls/fullchain.pem and privkey.pem (mode 644 / 640 group ssl-cert) and run sudo systemctl reload postfix nginx. Do not also request a Let's Encrypt certificate, or it will replace yours.

Cut-over

Change the domain's MX record to 10 <gateway hostname>. Remove the old MX records (or give them a much higher preference only if you want a fallback path that bypasses filtering - not recommended).
Watch Message trace filtered to Inbound, period 1 hour. Within minutes new mail appears with verdicts and "delivered".
Check the organization's mailbox receives mail normally, and that tagged mail lands in Junk.
On the domain page the MX line shows points at Obsidian.

After the cut-over

Lock the back door. Spammers still send straight to *.mail.protection.outlook.com or Google's MX. Restrict the platform to accept mail only from the gateway (M365: a transport rule / connector restriction; Google: "Reject all mail not from gateway IPs"; Exchange: receive connector remote IPs).
Outbound (optional). Route the tenant's outbound mail through the gateway, add its sending ranges to Outbound relay clients and generate a relay key.
SPF. If outbound goes through the gateway, include its IP in the domain's SPF record.
Raise the MX TTL back (e.g. 3600).
Tell users about the quarantine digest and portal.

Rolling back

Point the MX record back at the platform's own MX (for M365 <domain>.mail.protection.outlook.com, for Google the ASPMX hosts). Anything quarantined stays available in the console and can still be released - releases are delivered directly to the platform.