A secure email gateway sits in the mail path and applies policy before a message reaches its next destination. It may be a cloud service, an appliance, or functionality built into a hosted mail platform.

Common jobs include spam and phishing detection, malware scanning, attachment inspection, URL analysis, DLP, encryption policy, authentication checks, routing, and message logging.

The gateway changes the architecture

Once a gateway is inserted, troubleshooting needs to distinguish:

Internet -> Gateway -> Mail platform -> Mailbox

from:

Mail platform -> Gateway -> Internet

A gateway may also modify headers or message bodies. That can affect DKIM and the authentication results observed downstream.

Trust boundaries matter

If the mailbox platform trusts a gateway, make sure attackers cannot bypass that gateway and reach the platform through another route. MX records, connectors, IP restrictions, certificates, and platform-specific controls can all be part of that design.

Reference material