Email security gateway definition

Large companies rarely accept mail directly. A message to an employee passes through the gateway first: it scans the content, rewrites every link to point at itself, opens those links and loads the images in a sandbox, and only then decides whether the message is delivered, quarantined or blocked. Most sending tools never mention this step. For a cold sender it decides more than the copy does.

What is an email security gateway?

An email security gateway is a filtering service that a company places in front of its own mail server. Instead of pointing its MX record at Google or Microsoft, the company points it at the gateway. The gateway receives every inbound message, inspects it, and passes on only what it accepts. Proofpoint, Barracuda and Microsoft Defender for Office 365 are examples of the category.

Mid-size and large companies run one because the alternative, trusting each employee to spot phishing, does not scale. That is also the problem for cold email: a first message from an unknown domain, with a link and a request, is exactly the kind of message a gateway exists to doubt.

What does a gateway do with a cold email before anyone reads it?

Four things happen before a person sees the message. The gateway scans the content and weighs the signals that separate cold email from phishing: unknown sender, images, links, heavy formatting. It rewrites every link so that it points at the gateway rather than at your site: Microsoft Safe Links rewrites to safelinks.protection.outlook.com, Proofpoint URL Defense to its own redirector, Barracuda Link Protection to linkprotect.cudasvc.com. It opens those links and loads the images in a sandbox to see what they do. Then it delivers, quarantines or blocks.

The sandbox step explains a number many teams misread. The opens and clicks your tool records from a gateway-protected company are often the gateway's own checks, not a person. Spamhaus notes the same effect from the receiving side: recipients have to examine links because of phishing, which makes clicks less useful as a campaign metric. This is one reason open tracking is off by default in Leadspicker and reply rate is the metric that counts.

The four steps are documented by the gateways themselves. Microsoft's Safe Links scans URLs before delivery and again at click time, and rewrites them to safelinks.protection.outlook.com. Proofpoint URL Defense rewrites links to its own redirector, and Barracuda Link Protection verifies each link at every click. Spamhaus notes from the receiving side that link checks make clicks a weak campaign metric. Shared blocklists such as the Spamhaus Domain Blocklist are queried by gateways and mail servers alike, so a listing there reaches every one of them at once.

Why is a gateway blacklist worse than a spam folder?

A spam complaint in Gmail affects one mailbox's view of you. A gateway keeps its lists for all of its customers. When a recipient at one company reports your message, the gateway can put your sending domain on a list that applies to every organisation it protects. One complaint at one company can shut a sender out of a large share of the enterprise market at once, and getting whitelisted again is hard.

Shared blocklists work the same way at internet scale. A domain listed on the Spamhaus Domain Blocklist is checked by gateways and mail servers everywhere, in the sending address and in the links inside the message. The lesson for a cold sender is the same in both cases: the cost of a complaint is not one lost recipient, it is a segment.

When should you exclude gateway-protected recipients?

The decision depends on the history of the domain you send from, not on how good the message is.

• New domain, or lookalike domains with no history: exclude gateway-protected recipients. Send to everyone else first and let the campaign prove itself.
• Campaign clearly working, replies coming in, meetings landing: reintroduce gateway recipients gradually, a share at a time, watching bounces and complaints per domain.
• Established company domain with real reputation: sending through gateways is usually fine. Avoid the obvious patterns, such as twenty emails into one company on the same day.

What are the alternatives for reaching enterprise early?

If you are early, on a new domain, and your targets sit behind gateways, two routes skip the gateway entirely. A message on a social network reaches the person with no domain to warm up, no DNS records and no gateway in between. A phone call to a direct number found by contact enrichment does the same. Bring email in once the domain has replies and history behind it, and reintroduce gateway-protected recipients a share at a time.

Frequently asked questions

Why does a gateway open or click my emails before anyone reads them?

The gateway rewrites every link to point at itself, then opens the links and loads the images in a sandbox to check them. Your tool records those checks as opens and clicks. They say nothing about whether a person read the message.

Why is a gateway blacklist worse than a spam folder?

A spam folder is one mailbox's decision. A gateway list applies to every organisation the gateway protects, so one complaint at one company can block you across all of them, and whitelisting again is hard.

When should I exclude gateway-protected recipients from a campaign?

On a new or lookalike domain with no history: from the first send. Reintroduce them a share at a time once replies and meetings show the campaign works. An established domain with real reputation can usually send through gateways.