Secure Email Gateway (SEG)

Secure Email Gateways act as intermediaries between the internet and an organization's email infrastructure, scanning all email traffic before delivery.

How SEGs work

• MX records redirect email to the gateway before reaching the mail server.
• Messages are scanned for threats, spam, and policy violations.
• Clean emails are forwarded to the destination; threats are quarantined or rejected.
• Outbound emails are checked for sensitive data and policy compliance.

Core capabilities

• Anti-spam: Filters bulk mail and unsolicited messages.
• Anti-phishing: Detects impersonation and credential theft attempts.
• Anti-malware: Scans attachments and blocks malicious files.
• URL rewriting: Rewrites links for time-of-click scanning.
• DLP: Prevents sensitive data from leaving via email.
• Encryption: Policy-based email encryption for compliance.

SEG vs API-based security

• SEG (MX-based): Sits in front of email infrastructure, requires DNS changes.
• API-based (ICES): Integrates directly with cloud email via APIs, no MX changes needed.
• SEGs work well for on-premises Exchange; API solutions better suit cloud-native platforms like Google Workspace and Microsoft 365.

Deployment considerations

• MX record changes require careful planning for TTL propagation.
• Gateway IP whitelisting needed in cloud email platforms.
• May conflict with native security features in cloud email.
• Internal email visibility requires additional configuration (hair-pinning).

Leading vendors

• Proofpoint, Mimecast, Barracuda, Cisco ESA for traditional SEGs.
• Check Point Harmony, Abnormal Security for API-based approaches.