# Security gateway

A security gateway is a filtering service — Proofpoint, Mimecast, Barracuda — that a company points its MX records at so that inbound mail is scanned before it reaches the real mailbox server.

Date: 2026-09-13

A security gateway is a filtering service that sits in front of a company's real mailbox servers: the domain's MX records point at the gateway, which scans every inbound message for malware, phishing and spam and only then hands it to Microsoft 365, Google Workspace or an on-premises server behind it. Proofpoint, Mimecast and Barracuda are the ones most domains use.

## What Spaw answers

`mx_provider_type` answers `security_gateway` when the MX hosts belong to one. Many gateways accept every recipient during the handshake and sort them out behind, so a catch-all answer at such a domain is the gateway's design rather than a sign of a squat: the `catch_all_gateway` weight of 15 takes the place of the catch-all 30, the verdict reason stays `catch_all`, and `mailbox_confidence` still estimates the mailbox from the domain's posture and the username's shape.

## What it does not mean

A gateway does not make an address deliverable. A message to a mailbox that does not exist behind the gateway still bounces — later, and from the server behind, which is why reporting your bounces sharpens the confidence score for the whole domain.

Reference: https://spaw.co/glossary/security-gateway