What is an email security gateway?

An email security gateway checks mail before it reaches a mailbox or leaves your company. It looks for malware, phishing and data leaks. Based on the result, it delivers, tags, encrypts or quarantines the message.

Does the gateway replace my spam filter?

No. In the SecTepe.Comm mail server, Rspamd keeps filtering spam. The gateway runs as an additional milter in the same mail flow. It adds what a spam filter does not cover: sandbox analysis, DLP, encryption and pulling back mail that was already delivered.

What happens if a message turns out to be malicious after delivery?

The gateway can pull it from every mailbox and move it to quarantine (zero-hour auto purge). This also works for mail that an employee reports as phishing. Automatic cleanup is off by default; an admin turns it on deliberately.

Do I have to use every feature right away?

No. Many features ship turned off, such as the warning banner, link rewriting, signatures, the archive and the recipient check. The recipient check also starts in monitor-only mode. You can switch features on one at a time without disrupting mail flow.

Does my mail leave my network?

Scanning happens inside the gateway. The AI features are optional. You can run them against your own GPU server, so even the message text stays in your network. Hash lookups at VirusTotal are an explicit opt-in.

How does the gateway work with the malware sandbox?

The gateway sends attachments with active content, such as macros or executables, to the malware sandbox. There they run inside a Windows VM. The result, including screenshots, shows up right in the quarantine view.

SecTepe.Comm

Email security

SecTepe Mail Security Gateway– email security in your own mail flow

The gateway checks every message before it reaches a mailbox or leaves your company. It catches malware, phishing and data leaks. And it can pull dangerous mail back after delivery.

Request a demo

At a glance

Milter scanning for inbound and outbound mail
ClamAV, YARA, oletools and OCR
Connects to the malware sandbox
DLP, PGP and S/MIME
Link protection at click time
Quarantine and recall of delivered mail

What an email security gateway does

A secure email gateway sits between the internet and your mailboxes. It checks inbound mail for malware andphishing. It checks outbound mail for sensitive data and encrypts it when needed.

The SecTepe Mail Security Gateway is this building block in SecTepe.Comm. It is not a mail server. Mailboxes, webmail and the spam filter come from theSecTepe.Comm mail server. The gateway hooks into its mail flow and adds the security features of a gateway.

Features at a glance

Many features ship turned off. You enable them per policy or per tenant.

Inbound and outbound scanning

The gateway checks every message in the mail flow. ClamAV, YARA and oletools inspect attachments. OCR reads text in images, and QR codes are decoded so their links get checked too.

Quarantine with release

Suspicious mail goes to quarantine. Admins release or delete it. If you want, users get a daily digest with signed links to release their own messages.

Click-time link protection

Links in inbound mail are rewritten. When a user clicks, the gateway checks the address again. A sealed-off headless browser opens suspicious URLs and records a screenshot and the redirect chain.

PGP and S/MIME encryption

The gateway encrypts and signs mail with PGP or S/MIME. If a recipient has no key, the message can be delivered through a secure web portal instead.

Outbound DLP

Rules detect credit card numbers, IBANs, keywords and your own patterns. For each rule you decide: log only, quarantine or reject.

CDR for attachments

Content Disarm and Reconstruction strips active content from Office files, PDFs and archives. CDR only runs on clean attachments. Malware is blocked, not "repaired".

Warning banner and report link

Suspicious mail that is still delivered gets a visible warning. It can include a link users click to report the message as phishing.

Signatures and recipient checks

Outbound mail gets centrally managed signatures or disclaimers. The recipient check spots typos in domains and can hold a message until the sender confirms it.

Impersonation defense

The gateway detects lookalike domains, punycode, spoofed display names and DKIM replay. It learns how senders usually behave and flags changes.

After delivery: reporting, recall, archive

Some attacks only show up later. A sandbox verdict arrives minutes after delivery, or a link turns malicious once the mail is already in the inbox. The gateway has several tools for these cases.

Recall (zero-hour auto purge): the gateway finds the message in every mailbox and moves it to quarantine.
Phishing reports: a Thunderbird add-on adds a "Report phishing" button. The reported mail is analyzed, and the reporter gets a reply.
Automatic cleanup (opt-in): if the analysis rates a reported message as malicious, the gateway removes it from all mailboxes. This is off by default.
Mail archive (opt-in): copies of all mail with search, export and legal hold. The archive is off by default.

Targeted attacks like spear phishing can still get through. That is why staff training pays off, for example with ourphishing simulator. When someone reports a training mail from a GoPhish campaign, the gateway recognizes it as a simulation and thanks them for the report.

How the gateway fits into your mail flow

The gateway works as a milter. A milter is an interface a mail server uses to hand each message to a checking service while it accepts the mail. The mail server waits for the answer before it delivers.

Postfix accepts the message and passes it to the gateway.
The gateway checks attachments, links, sender and content.
For outbound mail it adds the signature, checks recipients and encrypts.
Rspamd comes next. It signs outbound mail with DKIM.
The message is delivered, tagged or quarantined.

The order matters. The gateway sits before Rspamd so its changes to the body do not break the DKIM signature. It never modifies signed or encrypted mail. For the Stalwart mail server there is a separate integration through an MTA hook. Do you use another mail server, such as Exchange or Microsoft 365? We are happy to check the integration on request.

Working with the sandbox, SIEM and SecTepe.Core

The gateway does not work alone. Suspicious attachments go to themalware sandbox. A quick pre-check first decides whether a file has any active content at all. A plain PDF invoice without scripts does not need the sandbox. The sandbox is a product of its own. You can also use it without the gateway, for example for your EDR or your SOC.

Clear hits start a playbook. It recalls related messages, blocks the sender domain and sends an alert to Wazuh. You see it in the SecTepe.Comm SIEM. The gateway reduces sender addresses to the domain in these alerts.

Indicators such as URLs, domains and hashes go to theSecTepe.Core threat intelligence. For endpoints, SecTepe EDR is a separate building block.

Optional: AI support

A language model reads the content and spots CEO fraud or gift card scams.
The AI analyst turns sandbox results into a short report.
Both only run once you set up a model. You can use your own GPU server for that.

Secure email gateway or plain spam filter?

A spam filter sorts out unwanted bulk mail and known threats. A gateway goes further. The table shows what the SecTepe.Comm mail server does with Rspamd and what the gateway adds.

Task	Mail server with spam filter	With Mail Security Gateway
Spam and Bayes filtering	Yes (Rspamd)	Yes, Rspamd stays active
Virus scan of attachments	Yes (ClamAV)	Plus YARA, oletools, OCR
Check how attachments behave	No	Yes, through the malware sandbox
Check links at click time	No	Yes (opt-in)
Outbound DLP	No	Yes
Recall delivered mail	No	Yes
Alerts in the SIEM	No	Yes, through Wazuh

FAQ: Mail Security Gateway

What is an email security gateway?: An email security gateway checks mail before it reaches a mailbox or leaves your company. It looks for malware, phishing and data leaks. Based on the result, it delivers, tags, encrypts or quarantines the message.
Does the gateway replace my spam filter?: No. In the SecTepe.Comm mail server, Rspamd keeps filtering spam. The gateway runs as an additional milter in the same mail flow. It adds what a spam filter does not cover: sandbox analysis, DLP, encryption and pulling back mail that was already delivered.
What happens if a message turns out to be malicious after delivery?: The gateway can pull it from every mailbox and move it to quarantine (zero-hour auto purge). This also works for mail that an employee reports as phishing. Automatic cleanup is off by default; an admin turns it on deliberately.
Do I have to use every feature right away?: No. Many features ship turned off, such as the warning banner, link rewriting, signatures, the archive and the recipient check. The recipient check also starts in monitor-only mode. You can switch features on one at a time without disrupting mail flow.
Does my mail leave my network?: Scanning happens inside the gateway. The AI features are optional. You can run them against your own GPU server, so even the message text stays in your network. Hash lookups at VirusTotal are an explicit opt-in.
How does the gateway work with the malware sandbox?: The gateway sends attachments with active content, such as macros or executables, to the malware sandbox. There they run inside a Windows VM. The result, including screenshots, shows up right in the quarantine view.

Email security you run yourself

We show you the gateway on your mail flow and plan with you which features to turn on first.

Request a demo Back to SecTepe.Comm

How we work with you

We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.

1. Free initial conversation

We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.

2. Structured assessment

We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.

3. Delivery with a dedicated lead

An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.

4. Continuous operations & review

After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.