A secure email gateway (SEG) is a security service or appliance that inspects email entering and leaving your organization. It blocks spam, malware and phishing before messages reach users, and on outbound mail it can stop sensitive data from leaving and encrypt messages that need protection. Most secure email gateways today are cloud services that sit between the internet and your mail platform, such as Microsoft 365 or Google Workspace.
At a glance
- A SEG filters inbound email for spam, malware, phishing and impersonation before it reaches inboxes.
- On outbound email it can apply data loss prevention (DLP), encryption and disclaimers.
- It is usually deployed by pointing your domain’s MX records at the gateway, which then forwards clean mail to your mail platform.
- Microsoft 365 and Google Workspace include their own filtering; a SEG is an additional or replacement layer.
- API-based email security tools are a newer alternative that work inside the mailbox instead of in front of it.
What problem it solves
Email is one of the most common ways attackers get into a business. A single convincing phishing message can capture a password, install malware or trick someone in finance into paying a fake invoice. Built-in filtering catches a lot, but targeted attacks are designed to look like ordinary business email, and the cost of one that gets through can be large.
Email is also a common way for data to leave the company by mistake: a spreadsheet of customer records sent to the wrong address, or patient information sent unencrypted. Regulated businesses need a way to detect and control that.
A secure email gateway gives you a policy point for both directions, with logs and quarantines that show what was blocked and why.
How it works
Mail flow. For inbound mail, you change your domain’s MX records so the internet delivers email to the gateway. The gateway inspects each message and passes clean mail to your mail platform. For outbound mail, your platform routes messages through the gateway on the way out. Because attackers can try to bypass the gateway by connecting to your mail platform directly, most setups also restrict the platform to accept inbound mail only from the gateway.
Inspection. Gateways check sender reputation, SPF, DKIM and DMARC results, and message headers. They scan attachments with antivirus engines and often open suspicious files in a sandbox to see what they do. Links may be rewritten so they are checked again when clicked, since a page that was harmless at delivery can be changed later. Impersonation checks look for lookalike domains and display names that copy executives or suppliers.
Outbound controls. DLP rules look for content such as card numbers, account numbers or health information and can block, quarantine or encrypt the message. Policy-based encryption can deliver messages through a secure portal when the recipient’s system can’t receive them securely.
Quarantine and reporting. Held messages go to a quarantine that admins, and often users through a digest, can review and release. Reports show volumes, threats blocked and trends.
When it matters for buyers
- After a phishing incident or a payment fraud attempt. This is the most common trigger, including when a peer company is hit.
- When cyber insurance renews. Insurers often ask about email filtering, link protection and MFA.
- When handling regulated data. Healthcare, finance and legal firms often need outbound DLP and encryption.
- When moving mail platforms. A migration is a good moment to decide whether native filtering is enough.
- When the existing gateway renews. Compare it with API-based tools and with the security features already in your Microsoft or Google license.
Questions to ask vendors
- Do you deploy in front of our mail platform via MX records, through an API connection, or both?
- How do you detect business email compromise that has no link or attachment?
- Do you rewrite links and check them again at the time of click?
- Can you remove a malicious message from inboxes after it has been delivered?
- What outbound DLP and encryption is included, and what costs extra?
- How do users report suspicious mail, and how is that fed back into filtering?
- How does your filtering overlap with the security features in our Microsoft 365 or Google Workspace license?
- How is it priced (per mailbox, per user), and how are shared mailboxes counted?
How it differs from DMARC
DMARC, along with SPF and DKIM, is a set of DNS records that let receiving mail systems check whether a message claiming to come from your domain really did. Publishing them protects your domain from being spoofed when others receive email. A secure email gateway protects your own users from what arrives. They complement each other: the gateway checks other senders’ DMARC results, and your DMARC record protects your customers and partners. For deployment patterns and how to layer a gateway with cloud email security, see our Secure Email Gateway guide.
Problems this helps with
- Phishing emails reaching employees' inboxes
- Fake invoices and CEO-impersonation emails asking for payments
- Sensitive data leaving the company by email
- Spam and malware getting past built-in Microsoft 365 or Google filtering
