A secure email gateway is a filter that checks every email sent to a company before the email reaches any employee's inbox. It is also called an email security gateway, or SEG. It blocks harmful attachments, harmful links and emails from forged senders, and it holds suspicious emails aside for checking.
How does every email reach the gateway first? Each company's internet domain, such as company.in, has a DNS setting called the MX record. DNS is the internet's address book. The MX record tells every other mail server where to deliver mail for that domain. The company points its MX record at the gateway. So all incoming mail arrives at the gateway, and only the mail that the gateway accepts goes on to the mailboxes.
Consider a cement company in Raipur with 1,200 mailboxes. On a normal day, about 40,000 emails arrive for it, and the gateway checks each one in a few seconds. First, it checks the sender. It looks up the sending server's address in lists of known spam sources. It also checks the DMARC and email authentication records, to see whether the sending server is allowed to send mail for the domain that it claims. Second, it checks attachments. It scans each file for known malware, which is harmful software. It opens unknown files in a sandbox, a sealed test computer, and watches what they do. Third, it checks links. It rewrites each link, so that when an employee clicks it later, the gateway checks the website again at that moment. By the evening, the gateway has delivered about 31,000 emails, rejected 8,500 as spam and held 500 in quarantine. Quarantine is a separate folder that an administrator reviews before anything in it is released.
The gateway also checks outgoing mail. It can stop an email that carries customer records or card numbers, using the rules of data loss prevention (DLP). It can also send a copy of every email to an archive, through communications compliance and archiving, because some regulators require companies to keep their mail for years.
The gateway has one weakness. It judges each email on its own. An email with no attachment and no link, written politely from a real supplier's account, looks clean to it. That is why many companies add integrated cloud email security (ICES), which reads mail inside the mailbox and compares it with each person's normal pattern.
The gateway records every email that it blocks or holds, and sends these records to the company's SIEM. So when one phishing email is reported, the security team can search for every copy of it across all the mailboxes.