# What is a secure email gateway, and how does it work? URL: https://iblockspam.com/blog/what-is-a-secure-email-gateway Last updated: 2026-10-16 Published: 2026-10-16 Topic: Choosing a filter Author: iBlockSpam Team > A secure email gateway filters inbound mail at the MX level before it reaches your mailboxes. How it works, what it checks, what it can't do and who needs one. ## Short answer A secure email gateway (SEG) is a mail server that sits in front of your mailboxes. Your domain's MX record points to it, so it receives all inbound internet mail first, checks it for spam, malware, phishing and spoofing, quarantines or rejects threats, and relays clean mail to Microsoft 365, Google Workspace or your own server. "Secure email gateway" is the industry name for an inbound mail filter that sits in front of your mail server. The term sounds like enterprise hardware, but many gateways are cloud services that a small business sets up with an MX change. This guide explains what a gateway is, what it does to each message, what it can't do, and how to tell whether you need one. ## What is a secure email gateway? A secure email gateway (SEG) is a mail server that receives your domain's inbound internet mail before your mailboxes do. It filters each message for spam, malware, phishing and spoofing, then relays clean mail to your real mail platform: Microsoft 365, Google Workspace, Exchange, cPanel or any server that speaks SMTP (Simple Mail Transfer Protocol, the standard servers use to pass mail to each other). In the language of internet mail standards, a gateway is a **boundary MTA**. A mail transfer agent (MTA) is a server that relays mail, and [RFC 5598](https://www.rfc-editor.org/rfc/rfc5598.html) defines a boundary MTA as "an MTA that is part of an ADMD and interacts with MTAs in other ADMDs", where an ADMD is an administrative domain such as your company. RFC 5598 uses the word "gateway" for something else (a bridge between different mail systems), so don't let that confuse you. Our guide to [mail transfer agents](https://iblockspam.com/blog/what-is-a-mail-transfer-agent-mta) covers the roles in more detail. Many gateways are hosted services; others are appliances or software you run yourself; see [hosted vs on-premise spam filters](https://iblockspam.com/blog/hosted-vs-on-premise-spam-filter). ## How does a secure email gateway work? A secure email gateway works by owning your MX record. When someone sends you mail, their server looks up your domain's MX (mail exchanger) records and delivers to the host listed there. [RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html) says the records are "ordered by preference, with the lowest-numbered records being most preferred". Point MX at the gateway and all internet mail goes there first. Here's what changes in DNS (example records only; your gateway gives you its own hostnames): ```text ; Before: mail goes straight to Microsoft 365 example.com. 3600 IN MX 0 example-com.mail.protection.outlook.com. ; After: mail goes to the gateway, which relays to Microsoft 365 example.com. 3600 IN MX 10 mx1.gateway.example.net. example.com. 3600 IN MX 20 mx2.gateway.example.net. ``` The message then follows this path: 1. **The sender connects to the gateway.** The gateway checks the connecting IP's reputation and can refuse the connection outright. 2. **It checks authentication.** SPF, DKIM and DMARC show whether the sender is who it claims to be. 3. **It inspects the message.** Content rules, links, attachment types and malware scanning. 4. **It decides.** Reject, quarantine, tag or deliver. 5. **It relays clean mail** to your mail platform, which usually filters it again. Use the [MX Lookup](https://iblockspam.com/tools/mx-lookup) to see where your domain's mail goes today. For the detection techniques themselves, read [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work). ### Why the mail platform must know about the gateway Once a gateway sits in front, your platform sees every message arriving from the gateway's IP address. Microsoft puts it plainly: the message "adopts the source IP of the last hop" and that's "simply how SMTP works" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)). Without a fix, the platform's own SPF and reputation checks judge the gateway, not the sender. Both big platforms have a setting for this. Microsoft 365 uses **Enhanced Filtering for Connectors** on an inbound Partner connector. Google Workspace uses the **Inbound gateway** setting with "Automatically detect external IP" ([Google Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)). Setup guides: [Microsoft 365 with an external filter](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) and [Google Workspace inbound gateway setup](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup). ## What does a secure email gateway check? A gateway checks the connection, the sender's identity, the content and the attachments of every inbound message. The table shows the common layers and what each one catches. | Layer | What it checks | Example of what it stops | |---|---|---| | Connection | Sending IP reputation, blocklists, reverse DNS | Botnet spam from known bad IPs | | Authentication | SPF, DKIM, DMARC results for the From domain | Mail forging your own domain | | Sender lists | Your allow and block lists, ideally with sender verification | A blocked spammer; a spoofed "allowed" sender | | Content | Spam signatures, suspicious phrases, link reputation | Bulk scam campaigns | | Attachments | Malware scanning, risky file types, Office macros | Invoice.docm with a macro | | Geography | Country of the sending server | Mail from countries you never deal with | | Recipient | Whether the address exists | Dictionary attacks on guessed addresses | ### What does a quarantined message look like? Most gateways hold suspect mail in a quarantine and email users a digest. A digest entry typically reads like this (example only): ```text Held for you: 3 messages (last 24 hours) From: accounts@paypa1-billing.example Subject: Invoice #88231 overdue Reason: Phishing From: news@deals.example Subject: 70% off today only Reason: Bulk [Release] [Always allow] [Delete] ``` Users release false positives themselves, which keeps admin work down. Read [what email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine) for how release and allow rules should work. ## What else does a secure email gateway do? Beyond filtering, a gateway handles mail flow jobs your mailbox platform may not: - **Outage spooling.** If your mail server is down, the gateway holds mail and delivers it later. RFC 5321 expects senders to retry, with a give-up time that "generally needs to be at least 4-5 days", but a gateway queue doesn't depend on each sender's settings. See [what happens to email when your server is down](https://iblockspam.com/blog/what-happens-to-email-when-server-is-down). - **One policy across platforms.** Domains on Microsoft 365, Google Workspace and cPanel share one rule set and one quarantine. - **Outbound filtering and relay.** Many gateways also act as a [smart host](https://iblockspam.com/blog/what-is-a-smart-host-smtp-relay) for outgoing mail, scanning it and adding DKIM signatures. - **Message history.** A searchable log of what arrived and why it was held. ## What can't a secure email gateway do? A secure email gateway only sees mail that crosses your MX, and only at the moment it arrives. That leaves real gaps: - **Internal mail.** Messages between colleagues on the same tenant never reach the MX. A compromised internal account sending phishing to coworkers is invisible to the gateway. - **Pulling back delivered mail.** Once a message passes, a pure gateway can't remove it from mailboxes if it later turns out to be malicious. Microsoft 365's zero-hour auto purge and API-based tools can. - **Direct-to-platform delivery.** Attackers can skip the MX and send straight to your Microsoft 365 or Google host. Lock this down; see [blocking direct-to-tenant bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass). - **Perfect detection.** Microsoft notes that "no matter how many layers of email protection exist, total protection never reaches 100 percent" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). Microsoft also warns against two things when you layer a gateway with Microsoft 365: double link rewriting (it recommends "disabling the link wrapping feature in the non-Microsoft service" if you use Safe Links) and in-and-out routing, which it "strongly recommend[s] avoiding". For the full comparison with mailbox-API tools, read [secure email gateway vs API email security](https://iblockspam.com/blog/secure-email-gateway-vs-api-email-security). ## How do you deploy a secure email gateway? You deploy a hosted secure email gateway by preparing your mail platform, switching the MX record, and then closing the back door. The order matters, because doing step 6 before step 4 can block real mail. 1. **Inventory your domains** and note each one's current MX, SPF and DMARC records. 2. **Lower the MX TTL** (time to live, how long resolvers cache the record) to a few minutes, a day ahead, so you can roll back quickly. See [DNS TTL and MX propagation](https://iblockspam.com/blog/dns-ttl-mx-change-propagation). 3. **Tell your platform about the gateway**: a Partner inbound connector with Enhanced Filtering in Microsoft 365, or the Inbound gateway setting in Google Workspace. Microsoft recommends a connector restricted by the gateway's certificate or IP addresses ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud)). 4. **Switch the MX records** to the gateway's hosts and send test messages from outside accounts. 5. **Read the headers** of a test message to confirm it passed through the gateway and that SPF, DKIM and DMARC still pass. 6. **Lock down direct delivery** so only the gateway can deliver to your platform. 7. **Tell users** where held mail goes and how to release it. Keep the old MX values written down. Rolling back is just restoring them, as long as you haven't removed the platform's ability to receive mail directly. ## Do you need a secure email gateway? You need a secure email gateway when your mailbox platform's built-in filter leaves a gap you can name. Tick the ones that apply: 1. Some of your domains are on cPanel, on-premises Exchange or another server with weak built-in filtering. 2. You run domains on more than one mail platform and want one policy. 3. Users never check quarantine or Junk, and you want them to get digests. 4. You can't afford to lose inbound mail during a server or connector outage. 5. You want geographic, attachment-type or Office macro filtering before mail reaches the mailbox. 6. Per-user security add-ons are expensive because of shared mailboxes and aliases. Per-domain [pricing](https://iblockspam.com/pricing) avoids that. If none apply and you run a single, well-configured Microsoft 365 or Google Workspace tenant, start with the built-in settings instead. Our guides to [whether you need a spam filter with Microsoft 365](https://iblockspam.com/blog/do-i-need-a-spam-filter-with-microsoft-365) and [whether Google Workspace's filter is enough](https://iblockspam.com/blog/is-google-workspace-spam-filter-enough) walk through that decision. ## Next steps - Look up where your mail goes today with the [MX Lookup](https://iblockspam.com/tools/mx-lookup). - Check SPF, DKIM and DMARC with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) before adding any layer. - If you add a gateway, plan the MX change carefully; [changing MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email) covers the order. - iBlockSpam is a hosted gateway priced per domain with unlimited mailboxes (a mailbox count, not unlimited message volume). See [how it works](https://iblockspam.com/how-it-works) and [pricing](https://iblockspam.com/pricing). Browse our other guides on [choosing email protection](https://iblockspam.com/blog/topic/buying). ## Frequently asked questions ### What does SEG stand for in email security? SEG stands for secure email gateway: a mail server placed in front of your mailboxes that filters inbound internet mail before delivery. Your MX record points to it. Many gateways also filter outbound mail and can sign it with DKIM. In internet mail standards, it plays the role of an inbound boundary MTA for your domain. ### Is a secure email gateway the same as a firewall? No. A network firewall allows or blocks connections by address and port. A secure email gateway is a mail server: it accepts SMTP messages, reads their headers, content and attachments, checks sender authentication, and decides whether to deliver, quarantine or reject each one. You still need a firewall; it just does a different job. ### Do secure email gateways still matter with Microsoft 365? They can. Microsoft fully supports a gateway in front of Exchange Online with Enhanced Filtering for Connectors. A gateway adds a filtering layer before Microsoft, plus features such as user quarantine digests, mail spooling and one policy across platforms. Microsoft's own protection keeps running behind it. ### How do attackers get around a secure email gateway? One well-known route is direct delivery, which works if your mail platform accepts mail from anyone. Attackers can look up your Microsoft 365 or Google host and deliver to it directly, skipping your MX. Close this by accepting mail only from the gateway: a restricted Partner inbound connector in Microsoft 365, or Reject all mail not from gateway IPs in Google Workspace. ### Does a secure email gateway scan internal email? Usually not. Mail between two colleagues on the same Microsoft 365 or Google Workspace tenant stays inside that platform and never reaches your MX record, so an inbound gateway doesn't see it. Your platform's own protection covers internal mail, and API-based tools can add a layer there. ## Sources - [RFC 5321: Simple Mail Transfer Protocol (sections 4.5.4.1 and 5.1)](https://www.rfc-editor.org/rfc/rfc5321.html) - [RFC 5598: Internet Mail Architecture (section 4.3.2, MTA roles)](https://www.rfc-editor.org/rfc/rfc5598.html) - [Microsoft Learn: Manage mail flow using a third-party cloud service with Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud) - [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) - [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service) - [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway) ## Free tools for this guide - [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts. - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. - [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser. - [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings. --- Source: iBlockSpam, https://iblockspam.com/blog/what-is-a-secure-email-gateway (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt