SecTepe Mail Security Gateway– email security in your own mail flow
The gateway checks every message before it reaches a mailbox or leaves your company. It catches malware, phishing and data leaks. And it can pull dangerous mail back after delivery.
Request a demoAt a glance
- Checks for inbound and outbound mail
- Several virus scanners, detection rules and text recognition
- Connects to the malware sandbox
- DLP, PGP and S/MIME
- Link protection at click time
- Quarantine and recall of delivered mail
What an email security gateway does
A secure email gateway sits between the internet and your mailboxes. It checks inbound mail for malware andphishing. It checks outbound mail for sensitive data and encrypts it when needed.
The SecTepe Mail Security Gateway is not a mail server. Mailboxes, webmail and the spam filter stay where they are, for example in theSecTepe.Comm mail server. The gateway hooks into the mail flow. It adds the protection of a gateway.
Features at a glance
Many features ship turned off. You enable them per policy or per tenant.
Inbound and outbound scanning
The gateway checks every message on its way in and out. Several virus scanners and detection rules inspect attachments, including macros in Office files. Text recognition reads text in images. QR codes are decoded so their links get checked too.
Quarantine with release
Suspicious mail goes to quarantine. Admins release or delete it. By default, users get a daily digest with secure links to release their own mail. You can turn it off per tenant.
Click-time link protection
Links in inbound mail are rewritten. When a user clicks, the gateway checks the address again. A sealed-off browser opens suspicious links. It records a screenshot and every redirect.
PGP and S/MIME encryption
The gateway encrypts and signs mail with PGP or S/MIME. If a recipient has no key, the message can be delivered through a secure web portal instead.
Outbound DLP
Rules detect credit card numbers, IBANs, keywords and your own patterns. For each rule you decide: log only, quarantine or reject.
CDR for attachments
CDR defuses attachments. It strips active content such as macros from Office files, PDFs and archives. CDR is on by default, and you can turn it off per policy. It only runs on clean attachments. Malware is blocked, not "repaired".
Warning banner and report link
Suspicious mail that is still delivered gets a visible warning. It can include a link users click to report the message as phishing.
Signatures and recipient checks
Outbound mail gets centrally managed signatures or disclaimers. The recipient check spots typos in domains and can hold a message until the sender confirms it.
Impersonation defense
The gateway spots domains that look almost like real ones, even with letters from other alphabets. It finds fake sender names and genuine signed mail that is resent by attackers. It learns how senders usually behave and flags changes.
Features in detail
The key building blocks have their own pages with examples and answers to common questions.
Phishing protection
Spots CEO fraud, lookalike domains and QR code phishing and pulls dangerous mail out of every inbox.
Learn more →Email encryption
Encrypts with PGP and S/MIME and delivers mail to recipients without a key through a secure portal.
Learn more →Email DLP
Finds IBANs, card numbers and keywords in outbound mail and stops them when needed.
Learn more →Quarantine and email archiving
Holds suspicious mail for release and keeps copies with search and legal hold.
Learn more →After delivery: reporting, recall, archive
Some attacks only show up later. A sandbox verdict arrives minutes after delivery, or a link turns malicious once the mail is already in the inbox. The gateway has several tools for these cases.
- Recall (zero-hour auto purge): the gateway finds the message in every mailbox and moves it to quarantine.
- Phishing reports: an add-on for your mail app adds a "Report phishing" button. The reported mail is analyzed, and the reporter gets a reply.
- Automatic cleanup (opt-in): if the analysis rates a reported message as malicious, the gateway removes it from all mailboxes. This is off by default.
- Mail archive (opt-in): copies of all mail with search, export and legal hold. The archive is off by default.
Targeted attacks like spear phishing can still get through. That is why staff training pays off, for example with ourphishing simulator. When someone reports a training mail from a phishing simulation, the gateway spots it. It then thanks them for the report.
How the gateway fits into your mail flow
The gateway checks every message on its way. Your mail server hands it over and waits for the result. Only then is the message delivered, tagged or quarantined.
The check runs before your mail server adds its digital signature (DKIM). So the signature stays valid, even if the gateway adds a warning. Mail that is already signed or encrypted is never changed. Do you use another mail server, such as Exchange or Microsoft 365? We are happy to check the integration on request.
Working with the sandbox, SIEM and threat intelligence
The gateway does not work alone. Suspicious attachments go to themalware sandbox. A quick pre-check first decides whether a file has any active content at all. A plain PDF invoice without scripts does not need the sandbox. The sandbox is a product of its own. You can also use it without the gateway, for example for your EDR or your SOC.
Clear hits start a set response. It recalls related messages and blocks the sender domain. It also sends an alert to our SIEM. The gateway reduces sender addresses to the domain in these alerts.
Indicators such as URLs, domains and hashes go to theour threat intelligence. For endpoints, SecTepe EDR is a separate building block.
AI support
- A language model reads the content and spots CEO fraud or gift card scams.
- The AI reverse engineer turns sandbox results into a short report.
- The AI reverse engineer is always included. The model can also run on your own GPU server.
Secure email gateway or plain spam filter?
A spam filter sorts out unwanted bulk mail and known threats. A gateway goes further. The table shows what a normal mail server does and what the gateway adds.
| Task | Normal mail server | With Mail Security Gateway |
|---|---|---|
| Spam and Bayes filtering | Yes | Yes, your spam filter stays active |
| Virus scan of attachments | Yes, one virus scanner | Plus detection rules, macro checks, text recognition |
| Check how attachments behave | No | Yes, through the malware sandbox |
| Check links at click time | No | Yes (opt-in) |
| Outbound DLP | No | Yes |
| Recall delivered mail | No | Yes |
| Alerts in the SIEM | No | Yes, in our SIEM |
FAQ: Mail Security Gateway
- What is an email security gateway?
- An email security gateway checks mail before it reaches a mailbox or leaves your company. It looks for malware, phishing and data leaks. Based on the result, it delivers, tags, encrypts or quarantines the message.
- Does the gateway replace my spam filter?
- No. Your existing spam filter stays active. The gateway adds its own checks in the same mail flow. It adds what a spam filter does not cover: sandbox analysis, DLP, encryption and pulling back mail that was already delivered.
- What happens if a message turns out to be malicious after delivery?
- The gateway can pull it from every mailbox and move it to quarantine (zero-hour auto purge). This also works for mail that an employee reports as phishing. Automatic cleanup is off by default; an admin turns it on deliberately.
- Do I have to use every feature right away?
- No. Many features ship turned off, such as the warning banner, link rewriting, signatures, the archive and the recipient check. The recipient check also starts in monitor-only mode. You can switch features on one at a time without disrupting mail flow.
- Does my mail leave my network?
- Scanning happens inside the gateway. The AI reverse engineer is always included. You can run the AI features against your own GPU server, so even the message text stays in your network. Lookups at an external hash reputation service are an explicit opt-in. Only the digital fingerprint of a file leaves your network.
- How does the gateway work with the malware sandbox?
- The gateway sends attachments with active content, such as macros or executables, to the malware sandbox. There they run inside a Windows or Linux VM, watched by our own analysis engine. The result, including screenshots, shows up right in the quarantine view.
Email security you run yourself
We show you the gateway on your mail flow and plan with you which features to turn on first.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.