Short answer: A secure email gateway (SEG) is the server your domain's MX record points to. Incoming mail arrives there first, is checked for spam, malware, phishing and authentication failures, and clean mail is relayed to your existing mail server while suspicious messages wait in quarantine. You can add one without changing your mail server, addresses or email clients.
Mail flow with and without a gateway
Without a gateway: the sending server looks up your domain's MX record and delivers straight to your mail server. Spam, infected attachments and phishing all reach your server; filtering, if any, happens on the server itself or on the employee's computer.
Internet → your mail server → employee's mailbox
With a gateway: your MX record points to the gateway. Mail is scanned there first, and only clean mail is relayed to your server.
Internet → gateway (scanning + quarantine) → your mail server → employee's mailbox
Your server stays the same; users keep the same addresses and the same Outlook or phone settings. The only thing that changes is the door mail uses to enter.
What does a gateway do?
- Spam filtering: reputation lists, greylisting, content and link analysis. Details: how a spam filter works.
- Virus and malicious attachment scanning: attachments are scanned before they reach your server or anyone's laptop.
- Phishing and spoofing detection: SPF, DKIM and DMARC results are enforced, catching messages that impersonate your own domain or well-known brands.
- Quarantine: suspicious mail is held, not deleted, so a user or admin can release it when needed.
- Allow and block lists: sender rules at company or user level.
- Outage buffer: if your server is briefly unreachable, the gateway queues mail and delivers it once the server is back.
How to set one up
- Add your domain to the gateway: enter the domain and the address of your existing mail server, where clean mail should be delivered.
- Change the MX record: in your DNS provider, point the MX record at the gateway. Lowering the TTL a day before the change makes the switch faster.
- Verify propagation: check the new record with the MX record lookup tool.
- Lock down the server (recommended): spammers sometimes cache the old MX or connect to your server directly. Allowing port 25 only from the gateway's IPs closes that back door.
Changing the MX record affects incoming mail only. Outgoing mail keeps leaving from your current server with your current SPF and DKIM setup.
Do I need one with Microsoft 365 or Google Workspace?
Microsoft 365 and Google Workspace have capable built-in filtering. Many organizations still put a separate gateway in front of them because:
- They want one quarantine and one rule set for every domain and user, especially when more than one mail platform is in use.
- An additional, independent scanning layer can catch what a single provider misses.
- They want control over where mail is first processed and how long quarantined mail is kept.
In that setup the MX record points to the gateway; Microsoft 365 gets an inbound connector (and, ideally, Enhanced Filtering for Connectors so it sees the original sender IP), and Google Workspace gets an inbound gateway entry. Platform details: Microsoft 365, Google Workspace.
Who is it for?
- Organizations running their own mail server (cPanel, Plesk, Exchange, Zimbra, Postfix) with little or no server-side filtering.
- Companies that have had a phishing or malware incident and want to reduce the risk of a repeat.
- Sectors that handle sensitive data, such as accounting, legal and healthcare, where a breach has regulatory consequences.
- Hosting providers and MSPs that offer email to their customers and want to resell filtering under their own brand.
Spambil is an email security gateway that works exactly this way: point your MX record to it and it is live in about five minutes, without touching your server or your users' settings. Features · Pricing.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
Is a mail gateway the same thing as a spam filter?
Spam filtering is a function; a gateway is an architecture that performs it on a separate system in front of your mail server, reached through the MX record. Gateways also do virus scanning, quarantine and authentication checks.
Do I lose mail if the gateway goes down?
No. If a sending server cannot reach the MX host, it keeps the message in its own queue and retries for hours, typically for several days.
Is changing the MX record risky?
Not when done properly. During the switch, the old and new records may both be visible for a while; mail arriving by either route still reaches your server. If something goes wrong, restoring the old MX value is enough.