Secure email gateway (SEG)

A secure email gateway (SEG) is a filter sitting between the internet and the mailboxes that inspects every message before delivery. The classic setup runs through the domain's MX record: mail lands at the gateway, which screens it and then relays it to the internal server or to Microsoft 365. What it does depends on the product: sender reputation, SPF, DKIM and DMARC checks, attachments opened in a sandbox, links rewritten so they get rechecked at click time, spotting a spoofed executive name. Another family hooks into cloud email through an API, leaves the MX alone and pulls messages after delivery. May 2023: Barracuda disclosed a flaw (CVE-2023-2868) in its Email Security Gateway appliances, exploited for several months by a group Mandiant ties to China. In June the vendor told customers to replace affected appliances, patched or not. The gateway filters, but it is still a box exposed to the internet, with flaws of its own. The cyber questionnaire asks whether advanced filtering is in place, with sandboxing and URL rewriting, and sometimes which product. Part of the answer can be checked from outside: the MX record shows which service receives the mail, and the DMARC record on the same domain shows whether spoofing is blocked. An MX pointing straight at Microsoft does not prove there is no advanced filtering, since API-based products do not show up in DNS. Underwriters give the gateway weight mainly for phishing and ransomware. Against wire fraud through business email compromise it counts for less: the fraudulent email often comes from a real mailbox at a legitimate supplier.