Secure Email Gateway (SEG): How It Works, Setup and Selection

Email is still the easiest way into a company. An invoice with a macro, a link to a fake login page or a message from the supposed boss is often enough. A secure email gateway works at exactly the point every message has to pass.

Depending on the vendor, it is also called a mail security gateway, an email security gateway or simply an email gateway. The idea is the same.

Where the gateway sits in the mail flow

A gateway sits between the internet and your mailboxes. There are two common ways to connect it:

• In front of the mail server: Your domain's MX record points to the gateway. It accepts all mail, checks it and passes clean messages to your mail server. Most cloud services work this way.
• At the mail server: Your mail server hands each message to the gateway and waits for the result. Only then does it deliver, tag or hold the message. The MX record stays as it is.

Outbound mail works the same way in reverse. The gateway checks it before it goes to the recipient.

What a secure email gateway checks

Inbound mail

• Malware: Virus scanners and detection rules check attachments, including macros in Office files and the content of archives.
• Sandbox: Suspicious attachments are opened in an isolated environment. This catches malware that no scanner knows yet. See how this works in our post on automated malware analysis.
• Links: Many gateways rewrite links and check the address again when someone clicks. This also protects against pages that only turn malicious after delivery.
• Spoofed senders: The gateway looks for spoofing, lookalike domains and fake display names. This is the basis for defending against CEO fraud and business email compromise.
• Sender authentication: The SPF, DKIM and DMARC checks show whether a message really comes from the domain it claims.
• Spam: Unwanted bulk mail is filtered out. An existing spam filter often handles this task.

Outbound mail

• Data loss prevention (DLP): Rules detect IBANs, credit card numbers or confidential terms and stop the message when needed.
• Encryption: The gateway encrypts mail centrally with S/MIME or PGP. Users do not have to manage keys.
• Signatures and disclaimers: Consistent signatures are added centrally.

After delivery

Some attacks only show up later. Good gateways can therefore pull a delivered message back out of all mailboxes. Employees report suspicious mail with one click, and the gateway checks it.

Secure email gateway, spam filter and Microsoft 365

A spam filter deals with unwanted bulk mail. Targeted attacks are often well made, come from real accounts or contain no link at all. A spam filter alone rarely helps here.

Cloud mailboxes such as Microsoft 365 include built-in basic protection. An extra gateway gives you more control: your own rules, your own sandbox, central encryption and a choice of where scanning happens. Whether that pays off depends on your risk and your requirements.

SEG and ICES: two approaches

Besides the classic gateway there is integrated cloud email security (ICES). These services connect to the cloud mailbox through an interface and usually check mail after delivery.

• SEG: checks before delivery and can reject, rewrite and encrypt mail. It works independently of the mail provider.
• ICES: also sees internal mail in the mailbox and is quick to set up, but it depends on the provider's interface.

The two approaches do not exclude each other. Many companies combine them.

Cloud or self-hosted?

Most gateways are offered as a cloud service. That is convenient, but it means every message passes through the provider's servers. For confidential communication, professional secrecy or strict GDPR requirements, this is a point to check.

A self-hosted gateway runs in your own data center or with a hosting provider of your choice. Your mail stays in your infrastructure. In return, someone has to run it, either in-house or as a managed service.

What to look for when choosing one

1. Integration: Does the gateway fit your mail server or cloud mailbox? Do DKIM signatures stay valid when it adds warnings?
2. Sandbox: Are attachments with active content actually run and observed, or only scanned?
3. Protection after delivery: Can the gateway pull mail back and check links at the time of click?
4. Outbound mail: Is there DLP and central encryption, including for recipients without their own key?
5. Data location: Where is mail scanned and stored? Does any content go to external services?
6. Step-by-step rollout: Can you switch features on one by one and test them in monitoring mode first?

The SecTepe Mail Security Gateway

The SecTepe Mail Security Gateway plugs into your existing mail flow. It is not a mail server of its own: mailboxes, webmail and spam filter stay where they are. Scanning happens before your mail server adds its DKIM signature, so the signature stays valid.

The gateway hands attachments with active content to the Malware Sandbox. It checks links again at the time of click. It encrypts outbound mail with PGP or S/MIME. For recipients without a key, you choose per group mailbox what happens, for example delivery through a secure portal or rejection. By default the message goes out in plain text with a warning. It pulls delivered mail back out of all mailboxes. Many features are off by default, so you can switch them on step by step.

Conclusion

A secure email gateway checks every message at the point where it enters or leaves the company. It adds sandboxing, link protection, sender checks, DLP and encryption to your spam filter. When choosing one, what matters most is how it fits into your mail flow, how it protects after delivery and where your mail is scanned.