Skip to content
Spaw
Get your API key

Security gateway

published · September 13, 2026

A security gateway is a filtering service — Proofpoint, Mimecast, Barracuda — that a company points its MX records at so that inbound mail is scanned before it reaches the real mailbox server.

A security gateway is a filtering service that sits in front of a company's real mailbox servers: the domain's MX records point at the gateway, which scans every inbound message for malware, phishing and spam and only then hands it to Microsoft 365, Google Workspace or an on-premises server behind it. Proofpoint, Mimecast and Barracuda are the ones most domains use.

What Spaw answers

mx_provider_type answers security_gateway when the MX hosts belong to one. Many gateways accept every recipient during the handshake and sort them out behind, so a catch-all answer at such a domain is the gateway's design rather than a sign of a squat: the catch_all_gateway weight of 15 takes the place of the catch-all 30, the verdict reason stays catch_all, and mailbox_confidence still estimates the mailbox from the domain's posture and the username's shape.

What it does not mean

A gateway does not make an address deliverable. A message to a mailbox that does not exist behind the gateway still bounces — later, and from the server behind, which is why reporting your bounces sharpens the confidence score for the whole domain.

Related

markdown version: /glossary/security-gateway.md

Verify addresses the same way

The Spaw API runs every check described here on each lookup, with an SMTP handshake that never sends mail. 10 free lookups a month, no card required.

Get your API key

More glossary

  • Area-code overlay

    An area-code overlay is a new area code added over the same area as an existing one, instead of splitting it, so neighbours can hold different codes and local calls need ten digits.

  • Calling window

    A calling window is the span of local hours a sender contacts people in. Spaw answers in_call_window from the number's time zones: clock arithmetic, not compliance advice.

  • Fictional number

    A fictional number sits in a range kept out of service for films, TV and other fiction: 555-0100 to 555-0199 in North America, and ranges Ofcom, ARCEP, ACMA and ComReg reserve elsewhere.

  • International (exit) prefix

    An international prefix is what is dialled to leave a country before the calling code: 00 in most of the world, 011 in North America. Spaw reads it and suggests a fix in did_you_mean.

  • International network number

    An international network number sits under a calling code the ITU gives a global service rather than a country, such as +870, +881, +882 or +883, so its country is null.

  • Live carrier check (HLR lookup)

    A live carrier check asks the mobile networks, at the moment of the lookup, whether a number is in service, which network serves it and whether it is roaming. On Spaw it is not enabled.

  • Number pooling (thousands-blocks)

    Number pooling splits a North American central office code into ten blocks of a thousand numbers, each assigned to a carrier separately, so one code can hold several carriers' numbers.

  • Number portability

    Number portability lets a subscriber keep a phone number when changing carrier. The number's block stays listed under the carrier it was issued to, so block data names the original holder.