In short
A secure email gateway (SEG) is a cloud service that sits in front of your mail platform. Your MX records point at the gateway, which filters spam, phishing and malware before mail reaches Microsoft 365, Google Workspace or your own server, and checks outbound mail too. Gateways often add continuity, encryption and archiving.
Get a quote for a secure email gateway
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a secure email gateway is
A secure email gateway is a mail filter placed in the delivery path. Senders look up your domain's MX records, which point at the gateway rather than at Microsoft or Google; the gateway accepts the message, inspects it and passes clean mail on to your mail platform. Outbound mail can be routed back through the same service, so it is checked on the way out and the gateway can apply encryption, disclaimers and data rules.
Most gateways sold today are hosted cloud services rather than appliances, which is what people usually mean by a hosted secure email gateway; every gateway on this page is delivered that way. Because the gateway only needs to hand mail over by SMTP, it works the same way in front of Microsoft 365, Google Workspace, on-premises Exchange or another mail server.
Putting a gateway in front of Microsoft 365
Moving to a gateway is a mail-flow change, so it is worth doing methodically and at a quiet time:
- Add and verify your domains in the gateway, and sync users from Microsoft Entra ID or Active Directory so licences match real mailboxes
- Build inbound and outbound policies, quarantine settings and any encryption or content rules
- Create Exchange Online connectors for mail arriving from the gateway and, if outbound filtering is wanted, for mail sent through it
- Add the gateway to your SPF record if it will send on your behalf, and check DKIM signing still aligns
- Change your MX records to point at the gateway
- Lock Exchange Online down so it accepts inbound mail only from the gateway, using a connector restricted to the gateway's IP addresses or certificate, which closes the route attackers use to send straight to your tenant
- Turn on Enhanced Filtering for Connectors (Microsoft also calls it skip listing), so Microsoft's own filtering sees the original sender's IP address rather than the gateway's
- Review quarantine and user feedback over the first weeks and tune policies
Exchange Online Protection keeps running behind the gateway, so its settings need care to avoid double-quarantining or rejecting each other's mail.
Putting a gateway in front of Google Workspace
Gmail supports gateways through the Inbound gateway setting in the Google Admin console, under the spam, phishing and malware settings for Gmail. You enter the gateway's public IP addresses (Gmail does not accept private ranges), and Google then knows that mail from those addresses has come through your filter.
Three options in that setting matter:
- Reject all mail not from gateway IPs: the Google equivalent of locking the tenant, so attackers cannot bypass the gateway by sending directly to Gmail
- Spam header matching: Gmail can treat messages as spam when the gateway adds a header you specify, so the gateway's verdict carries through to the inbox
- Automatically detect external IP: Gmail looks past the gateway to the first external IP address in the message headers and uses it for SPF and spam evaluation
Our Google Workspace email security hub covers how gateways and API products compare for Gmail, and the Gmail security settings guide covers the rest of the admin console.
Is a secure email gateway the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What gateways do well
- Pre-delivery blocking: malicious mail is stopped before it reaches Microsoft or Google, so it does not land in a mailbox
- Outbound filtering: outgoing mail is scanned for spam, malware and signs of a compromised account, which protects your domain's reputation
- Continuity: many gateways can queue mail and give users an emergency inbox if the mail platform is unavailable
- Encryption and content rules: policy-based encryption, disclaimers and rules for sensitive keywords in mail entering and leaving the organisation
- Archiving: some gateways include a compliance archive, such as the cloud archive with up to ten years' retention in Proofpoint Essentials' Professional packages
- Platform independence: the same filter works in front of Microsoft 365, Google Workspace and your own servers, including during a migration between them
These are the reasons gateways remain common in regulated firms, organisations with their own mail servers and businesses that want encryption, continuity and archiving from one supplier.
Where gateways fall short
The same position in the mail flow creates blind spots:
- Internal mail: messages between colleagues usually do not pass through the gateway, so a compromised account can phish internally unseen
- After delivery: if a message is later found to be malicious, many gateways rely on the mail platform to remove it from inboxes
- Collaboration apps: links and files shared in Teams, SharePoint, Google Drive or Slack do not pass through an email gateway
- Bypass: if the tenant is not locked to the gateway, attackers can send straight to Microsoft 365 or Gmail
- Authentication side effects: gateways that rewrite messages or links can affect DKIM and DMARC results unless the platform is told about them
That is why many organisations now pair a gateway with an integrated cloud email security product, or choose a vendor that offers both. Our ICES vs SEG comparison goes through the trade-offs.
Secure email gateways we supply
These are the gateway options we supply, described from each vendor's own material:
| Gateway | What it is | Notable for | More detail |
|---|---|---|---|
| Proofpoint Essentials | Proofpoint's cloud gateway for small and mid-sized organisations, in Business, Advanced and Professional packages, each with a plus version | Filtering, DLP and continuity in every package; attachment sandboxing and encryption from Advanced; an archive with up to ten years' retention in Professional | Proofpoint Essentials guide |
| Symantec Email Security.cloud (Email Safeguard.cloud) | Broadcom's cloud email gateway; Email Safeguard.cloud is a package of its services | Anti-spam with BEC detection, multi-scanner anti-malware with link checking, content and image control | Symantec Email Security.cloud |
| Trend Micro Cloud Email Gateway Protection | The MX-based deployment of TrendAI Vision One Email and Collaboration Security | Encryption, continuity and DMARC report analysis in the Essentials and Pro packages; can be combined with Trend's API protection | Trend Micro |
| Bitdefender GravityZone Extended Email Security | Perimeter (MX) mode, alone or with Microsoft 365 API protection | Add-on to GravityZone, managed in the same console as Bitdefender endpoints | Bitdefender |
| Sophos Email | Gateway mode, or API integration with Microsoft 365 | Managed in Sophos Central with Sophos endpoints; Email Plus includes DMARC Manager | Sophos Email |
If you are standardising on Cisco security, Cisco's own gateway is covered on our sister site under Cisco Secure Email. For every architecture side by side, see email security platforms compared, and for a gateway against an API product, IRONSCALES vs Proofpoint.
Not sure which package fits? Ask us
Tell us what you need and we will recommend the right package for your organisation, with a quote.
Who still needs a gateway
A gateway is usually the better fit when one or more of these applies:
- You run your own mail server, or a mix of cloud and on-premises mailboxes
- You want continuity during an outage of your mail platform
- You need policy-based encryption, outbound content rules or an archive from the same supplier
- You are moving between Microsoft 365 and Google Workspace and want one filter throughout
- Your compliance or insurance requirements ask for outbound filtering
If none of these applies and you are on Microsoft 365 or Google Workspace, an API-based product is often quicker to deploy, sees internal mail and can remove threats after delivery.
How we help
We can size the gateway against your needs, set up domains and user sync, build policies and make the connector, MX and lock-down changes at a quiet time, then tune quarantine with you. We can check SPF, DKIM and DMARC as part of the switch to help legitimate mail keep flowing, and we can add an API layer behind the gateway if you want internal mail covered too.
Pricing depends on the product, package and number of users, so ask us for a quote. Contact us to discuss a secure email gateway.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is a secure email gateway?
A secure email gateway is a service that sits in front of your mail platform. Your MX records point at it, it filters inbound mail for spam, phishing and malware before Microsoft 365, Google Workspace or your own server receives it, and it can check outbound mail too. Many add continuity, encryption and archiving.
Do I need a secure email gateway with Microsoft 365?
Not necessarily. Microsoft 365 includes its own filtering, and API-based products add protection without an MX change. A gateway makes sense if you want continuity, encryption or an archive from one supplier, outbound filtering, or one filter in front of several mail platforms.
Who are the main secure email gateway providers?
Well-known gateway providers include Proofpoint, Broadcom (Symantec), Trend Micro, Sophos and Cisco, among others, and Bitdefender offers a perimeter mode. Of these, we supply Proofpoint Essentials, Symantec Email Security.cloud, Trend Micro Cloud Email Gateway Protection, Bitdefender's perimeter mode and Sophos Email.
What is a hosted secure email gateway?
A hosted secure email gateway is a gateway run as a cloud service by the vendor, rather than an appliance in your own building. You point your MX records at it and manage policies in a web console. Most gateways are now delivered this way, including all of those we supply.
Can you use a secure email gateway with Google Workspace?
Yes. Gmail has an Inbound gateway setting in the Google Admin console where you enter the gateway's public IP addresses, and you can reject mail that does not come from them, so attackers cannot bypass the gateway.
Still have a question about a secure email gateway?
Ask us and a member of our team will reply by email.