Internal mail
A message from one colleague's mailbox to another never crosses the gateway. If an attacker takes over one account, the phishing that follows inside the organisation goes unseen.
What is an email security gateway, and do you still need one?
Last reviewed: September 2026
An email security gateway is a service that inspects email before it reaches your mailboxes, and often as it leaves, to stop spam, phishing, malware and data leaks. This guide covers how it works, what it costs and when you need one. Arke Technologies, in Johannesburg, designs and manages email protection for South African organisations.
Insights
What is an email security gateway, and do you still need one?
Last reviewed: September 2026, 15 min read
An email security gateway is a service that inspects email before it reaches your mailboxes, and often as it leaves, to stop spam, phishing, malware and data leaks. This guide covers how it works, what it costs and when you need one. Arke Technologies, in Johannesburg, designs and manages email protection for South African organisations.
Last reviewed: September 2026, 15 min read
On this page
What is an email security gateway?
An email security gateway is a checkpoint for mail. Your domain's MX records, the DNS entries that tell the world where to deliver your email, point to the gateway instead of straight to your mailboxes. Every inbound message stops there first, is inspected against your policies, and is then delivered, tagged, held in quarantine or rejected. Outbound mail can be routed through it too, so the same service checks what leaves the organisation.
The idea goes by several names. Secure email gateway, shortened to SEG, is the term most vendors and analysts use, so "SEG email" usually means this. Email gateway and mail security gateway mean the same thing. An email security appliance, or ESA, is the older on-premises form: a physical or virtual machine in your server room running the same filtering. Most gateways today are cloud services, licensed per mailbox.
A gateway is one layer of email security, which is in turn one part of cyber security. It does not replace the protection built into Microsoft 365 or Google Workspace, sender authentication on your own domain, or staff who know how to spot a fraudulent invoice.
What a gateway stops, and what it cannot see
A well-tuned email security gateway is good at the threats that arrive from outside in volume: spam and bulk mail; phishing that imitates banks, SARS, couriers or Microsoft; malware and ransomware in attachments and download links; spoofing of your own domain once DMARC is enforced; and data leaks in outbound mail, where outbound filtering is on.
It has three blind spots, and they explain why the market has moved on:
After delivery
A link that was harmless on arrival can be pointed at a malicious page later. Link rewriting helps, but pulling a message back out of mailboxes needs a connection to the mail platform itself.
The bypass route
Microsoft 365 and Google Workspace still accept mail delivered straight to their own servers. Unless the platform accepts mail for your domain only from the gateway, an attacker can deliver straight to it and skip the filtering. It is a common gap, and one of the first things we check where a gateway is already in place.
Business email compromise cuts across all three. A request for changed banking details from a genuine but compromised supplier mailbox carries no malware and passes authentication, so a process control, such as confirming every banking change by phone on a number you already hold, matters as much as the filter.
Comparing email gateway vendors: what to test
Email gateway vendors all claim high catch rates, so judge them on your own mail, ideally in a trial running in monitor mode beside your current protection:
- Catch rate in your mail flow: what it stops that your current setup misses, measured over weeks, not in a demo.
- False positives: how much legitimate mail it holds, and how easily staff can release it.
- Business email compromise: how it handles lookalike domains, borrowed display names and payment requests without malware.
- Post-delivery removal: whether it can pull a message out of every mailbox once it proves malicious.
- Integration: support for Enhanced Filtering in Microsoft 365, the inbound gateway setting in Google Workspace, and your security monitoring.
- Data location: which countries it processes and stores mail in, since it reads every message.
- Exit: how quarantined mail, logs and archives are exported, and how simply the MX records move back.
Governance, POPIA and procurement
- POPIA. Mailboxes hold the personal information of staff, clients, patients and learners. Section 19 requires reasonable security safeguards and section 22 requires notification after a compromise. A gateway provider reads every message, so it is your operator: section 21 requires a written contract that binds it to those safeguards, and transfers outside South Africa must meet section 72. See our POPIA compliance checklist.
- Board oversight. King V places the governance of data, information and technology with the governing body (Principle 10, successor to King IV's Principle 12); departments, municipalities and public entities also answer under the PFMA or MFMA. Our monthly reports on what was stopped, released and escalated are written for that audience; see technology governance under the King Code and PFMA, MFMA and ICT procurement.
- Service levels. Incidents such as a compromised mailbox are prioritised on a P1 to P4 scale, with response and resolution targets agreed in your SLA and reviewed monthly.
- Procurement. Arke Technologies (Pty) Ltd is a Level 1 B-BBEE contributor (sworn affidavit available on request). Company documents, our CSD supplier number and SARS tax compliance status are available on request, and we complete SBD forms when a bid requires them. Work is bought through a proposal, SLA, purchase order or tender response; see procuring from Arke.
- Continuity. Configuration lives in accounts you own and is documented. You own your data, credentials and documentation, so changing provider means updating DNS records and connectors, not moving mailboxes.
For the wider picture, see our cybersecurity services, the guide to firewalls, which filter network traffic much as a gateway filters mail, and more insights and guides.
Related services
Related guides
- What is cyber security? A guide for South African organisations
- Microsoft 365 plans for organisations, and what they really cost to run
- Google Workspace pricing in South Africa
- Microsoft 365 vs Google Workspace
- How much do managed IT services cost in South Africa?
- POPIA compliance checklist for organisations