What are gateway spam filters?

A gateway spam filter sits in front of your mail server and inspects every inbound message before it reaches a single mailbox. Think Proofpoint, Mimecast, Barracuda Email Security Gateway, Cisco Secure Email, or the Microsoft Defender for Office 365 connector. The company changes its MX records to point at the gateway, the gateway scans and scores the mail, then forwards what survives to the real mail server (often Microsoft 365 or Google Workspace sitting behind it).

That position matters. A gateway filter runs at the network edge, so it can reject mail at the SMTP conversation itself, before the message body is even fully accepted. If you want a refresher on where that happens in the delivery chain, read at what point is an email filtered and what happens during SMTP connection filtering.

What a gateway actually does

Four jobs, usually bundled in one box:

1. Anti-spam and anti-phishing. Reputation checks on the connecting IP, SPF/DKIM/DMARC alignment, URL scanning, attachment sandboxing.
2. Anti-malware. Signature scans plus detonation chambers for suspicious attachments.
3. Data loss prevention (DLP). Outbound rules that block messages containing credit card numbers, patient records, source code, etc.
4. Policy enforcement. Block by country, encrypt anything tagged confidential, quarantine executables, route HR mail differently from engineering mail.

Google and Microsoft already do most of this inside Workspace and Microsoft 365. Companies still buy a separate gateway when they want one console across multiple mail tenants, stricter DLP than the native tools, or compliance archiving their auditor will accept. Microsoft documents the exact pattern in their mail flow with a third-party cloud filter guide.

Why this matters if you send mail

If your audience is B2B, a meaningful slice of your list sits behind a gateway. Your message has to clear two filters, not one: the gateway, then the mailbox provider's own rules. The gateway's verdict can be harsher because it is tuned by an IT team that would rather lose a newsletter than let a phishing email through.

A few practical consequences:

• 5xx rejections at the SMTP layer are often the gateway, not the mailbox. If your bounce log shows proofpoint.com, mimecast.com, pphosted.com, or barracudanetworks.com in the rejection message, you are talking to the gateway. See 5xx permanent vs 4xx temporary rejection for how to read those.
• Reputation lookups happen here. Gateways query the big IP and domain blocklists (Spamhaus, SURBL, URIBL) on every connection. A listing can get you blocked at the door before content even matters.
• Aggressive URL rewriting. Proofpoint's URL Defense and Mimecast's URL Protect rewrite every link to route clicks through their scanner. That breaks naive open and click tracking for those recipients, so your CTR numbers from corporate domains will look softer than reality.
• Quarantine, not junk. A gateway usually quarantines on a central appliance instead of dropping in the user's Junk folder. The recipient may never see your message or know to release it. The user's inbox provider behaves differently again, which is what block, quarantine, and junk classification covers.

How to check if a recipient uses one

Look up their MX record. If it points to pphosted.com, mimecast.com, barracudanetworks.com, cisco.com, or a vendor's hosted domain, there is a gateway in front. If it points straight to aspmx.l.google.com or *.mail.protection.outlook.com, the mailbox provider is the filter. M3AAWG's sender best practices is worth a read if you want the vendor-neutral background on how senders should adapt when filters of any kind get involved.

Gateway, mailbox provider, user rules. Three doors. Build your sending program so it can pass all three, not just the easiest one.