- Secure email gateway, defined
- A secure email gateway (SEG) is a mail server named in a domain's MX record that screens inbound mail for spam, phishing and malware before delivery.
Proofpoint's reference page, read on 2026-09-25, describes an email gateway as a type of email server that protects an organization's internal mail servers. MX-based gateways act as a checkpoint: all mail routes through them first, where content, attachments and links are examined before anything reaches an inbox.
For verification, one detail matters most. Every SMTP check connects to whatever host the MX record names. On a domain fronted by Proofpoint or Mimecast, that's the gateway, so the 250, 550 or silence you get back is the gateway speaking.
What it says depends on what it can see. A gateway that looks up the directory behind it can refuse an unknown recipient at `RCPT TO` with a clean 550. One that can't see the directory accepts everything at the door and lets the internal server bounce the message later. From outside, that second kind looks exactly like a catch-all domain.
A gateway can also slow down or refuse connections it doesn't recognize. Then a verifier gets a timeout or a temporary 4xx in place of an answer, and has to try again later.
That's one reason a B2B list can come back with a heavy share of catch-all and unknown rows. The companies behind those gateways are often the accounts you most want to reach. What unknown means covers what to do with those rows.
You can see a gateway for yourself. Run the domain through the MX lookup tool and read the host names: a security vendor's domain in the MX record means your probes will meet that vendor first.
How ZapBounce reports it
Every ZapBounce result carries mx_host, the host that actually answered, so a row checked through a Mimecast or Proofpoint gateway shows that gateway by name. If the gateway also accepts our random-address probe, the row comes back catch_all with reason accept_all_domain, never a confident valid. If it stalls or blocks the probe, the row is unknown with reason timeout or probe_blocked, and it isn't billed. See how it works for the full check.
Secure email gateway: common questions
How do I know if a domain uses a secure email gateway?
Look up its MX record. If the mail host belongs to a security vendor rather than to Microsoft, Google or the company itself, a gateway is screening its mail, and every verification probe meets that gateway first.
Why do addresses behind a gateway come back catch-all?
The gateway accepts the recipient at the door, including a random address that can't exist. Once a made-up address gets a 250 too, no SMTP check can single out the real mailbox, so the honest result is catch-all.
Should I remove addresses behind a secure email gateway?
No, not on that basis alone. These are often your largest target accounts. Send to them in smaller batches, watch the bounces, and suppress any address that hard bounces once.
Is a secure email gateway the same as a spam filter?
A spam filter is one job a gateway does. The gateway is the whole server in the mail path, and it also scans attachments and links and can check outbound mail for data leaving the company.