TechKnowSurge

VideoSecurityFree

Email Gateway

Mail gateways sit at the front of an email infrastructure to screen incoming messages through a series of security checks before they reach internal mail servers. These checks include deny and allow lists, SPF, DKIM, DMARC, anti-malware, and spam filtering, with a cumulative scoring system that determines whether a message is delivered, quarantined, or dropped.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A mail gateway is a security layer deployed at the network perimeter to intercept and evaluate incoming email before it reaches the internal mail infrastructure. It functions as the first Mail Transfer Agent a message encounters, giving organizations a controlled checkpoint where threats, spam, and policy violations can be identified and acted upon before any damage reaches end users or internal systems. Implementations vary across vendors and environments, but the core purpose remains consistent: protect the front end of the mail system through structured, automated inspection. The gateway checks each message against deny lists and allow lists first, which can either block known bad senders outright or fast-track trusted sources past further inspection. From there, messages are evaluated against authentication standards such as SPF, DKIM, and DMARC, as well as anti-malware and anti-spam engines. Spam list checks may draw on third-party services or open-source databases that track known spam sources, adding an external layer of threat intelligence to the filtering process. Rather than treating each check as a binary pass or fail, mail gateways typically apply a weighted scoring system. A soft SPF failure, for example, may not block a message on its own but contributes points toward an overall spam score. As a message moves through each check and accumulates strikes, the gateway uses that total score to determine the appropriate response. A message with a moderate score might be tagged as spam and delivered to the recipient's junk folder, while a higher score could trigger quarantine, requiring the recipient to manually release it. Messages that score beyond a defined threshold may be dropped entirely without delivery.

What you'll learn

Explain the role of a mail gateway in filtering inbound email traffic using mechanisms such as allow/deny lists, SPF, DKIM, DMARC, and anti-spam ratings
Describe how cumulative spam scoring determines the disposition of inbound email messages, including delivery, quarantine, or rejection

What's covered

Mail Gateways

Gateway Purpose
- Front-end protection
- First MTA in network
- Bridges mail system gap
Check Process
- Deny and allow lists
- SPF, DKIM, DMARC
- Anti-malware and anti-spam
- Spam list check
  - Third-party providers
  - Open source lists
Spam Rating System
- Strikes accumulate per failure
- Soft fail scoring
- Outcome decisions
  - Label as spam
  - Quarantine message
  - Drop message

Key terms

Mail Gateway: A security checkpoint positioned at the front of a mail system that filters inbound email through a series of checks, including allow/deny lists, authentication protocols, and anti-spam mechanisms, before passing messages to internal mail servers.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Sender Policy Framework: Sender Policy Framework is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf, helping receiving servers identify and reject spoofed messages.
DomainKeys Identified Mail: DomainKeys Identified Mail is an email authentication mechanism that uses asymmetric cryptography to sign outgoing messages, allowing receivers to verify that the email was not altered in transit and originated from an authorized sender.
Domain-based Message Authentication, Reporting, and Conformance: Domain-based Message Authentication, Reporting, and Conformance is an email authentication protocol that builds on SPF and DKIM to enable domain owners to specify how unauthenticated emails should be handled and to receive reports on message authentication activity.
Allow List: An application control approach that permits only explicitly approved applications to run, blocking everything else by default.
Deny List: An application control approach that blocks only explicitly named applications, permitting all others to run by default.
Spam: Spam is unsolicited bulk electronic messages, most commonly email, that serve as a primary delivery vector for phishing campaigns, malware attachments, and social engineering attacks.
Quarantine: A disposition action taken by a mail gateway that isolates suspicious or high-scoring email messages for review rather than delivering them directly to the recipient or dropping them outright.

Topics

Email Security Email Gateway Spf Dkim Dmarc Spam Filtering Anti Malware Cybersecurity

Transcript

One of the things that we'll want to implement on our mail system is some sort of gateway.

What a mail gateway is

There are a lot of different names that are associated with these mail gateways. Just think of something that's coming into your network, and before it gets sent on to the rest of the mail system, we want some level of protection. So we want a mail gateway to help bridge that gap and protect the front end of our mail system.

There are many different types of implementations, but most likely we want this at the front of our network, the first thing that it comes into. Essentially this first MTA that it hits, that's what we want to be our mail gateway.

The series of checks

All mail gateways usually process things a little differently, but essentially they go through a series of checks. First of all, they check a deny list and see if it's something that needs to be denied, or an allow list, and then something that could be expedited and not go through any other checks. Then it would go through something like the SPF records, the DKIM, the DMARC, the anti-malware, anti-spam — and the list can go on. So there are a lot of these different checks that it goes through to see if it's going to accept it or not.

One of the checks that it'll go through is some sort of spam list check. When it goes through the spam list check, this could be a third party, somebody that you actually hire, or some sort of open sources out there that keep track of what these spam senders are out there. So it can help perform some checks on this mail that's going through here to make sure that it is legitimate.

Spam rating

Another thing that happens through this process is some sort of spam rating. As it goes through here, it might fail the SPF — but remember, there's that soft fail. What does that soft fail mean? How can you have a soft fail? The thing is that at that point in time it might be given some sort of rating, like two points. There's been a strike against it. Maybe it gets another strike against it, and then another strike. So as it goes along, it will gather up these strikes, and then when it hits the anti-spam here, what it'll do is decide, okay, there's enough against this that we think it might be labeled as spam.

So maybe it labels it as spam but still sends it to the end user. Or maybe it's so wrong that it puts it in quarantine and that user has to go and release it. Or maybe it drops it altogether. As part of this check, there's a rating system that happens to see if this should be sent through or not.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →