Email Security
Secure email gateway tools that filter the inbox you already run (2026)
A 2026 shortlist of inbound gates. Public docs, not a phishing-kit cookbook.
Expertise: Email Security · Level: Intermediate · 12 min read
A DMARC reject is not a malware sandbox.
The DMARC list stops the lookalike domain. The gateway stops the payload and the BEC that used a real domain. Overlap declared. I will not publish a lure recipe.
Six gates. Two open filters. Two known SEGs. One Microsoft SKU. One API BEC desk. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Rspamd | Modern open filter on an MX you operate | Apache-2.0 |
| Apache SpamAssassin | Classic rule filter you can still grep | Apache-2.0 |
| Proofpoint | Known commercial SEG | Commercial |
| Mimecast | The other known SEG plus archive stories | Commercial |
| Microsoft Defender for Office 365 | The button if mail already lives in M365 | Microsoft terms |
| Abnormal | API-first BEC desk on a mailbox you own | Commercial |
Rspamd
Best for modern open filter on an MX you operate
Rspamd is a fast spam and malware-adjacent filter. Lua rules. Redis. You sit it on mail you already accept.
Key features
- Apache-2.0
- Lua rules
- You operate MX
- Web UI they ship
Why we like it
This is the hidden gem if you still run your own MX and will not rent Proofpoint on day one.
Limits
You staff it. Phish kits evolve. Not a Microsoft API product.
Apache SpamAssassin
Best for classic rule filter you can still grep
SpamAssassin is the rule engine a generation of MX boxes still run. Scores. Custom rules you can read.
Key features
- Rule scores
- Apache-2.0
- Huge memory in ops
- You host it
Why we like it
Honesty. A lot of mail still dies here. Do not pretend it is a BEC neural net.
Limits
Rule lag. CPU on big queues. Not a vendor SOC.
Proofpoint
Best for known commercial SEG
Proofpoint is the SEG procurement already wrote. MX cutover. Targeted-attack add-ons they sell.
Key features
- MX gateway they sell
- URL and attachment stories
- Enterprise desk
- Commercial
Why we like it
Known shelf. If it is already in the path, tune it before you add Abnormal on a whim.
Limits
Commercial. MX politics. We did not run a tenant.
Mimecast
Best for the other known SEG plus archive stories
Mimecast sells email security and continuity. Common Proofpoint alternative in RFP decks.
Key features
- Gateway they sell
- Continuity stories
- Archive neighbor
- Commercial
Why we like it
Second commercial so the list is not a one-logo SEG page.
Limits
Commercial. Public pages are not a lab.
Microsoft Defender for Office 365
Best for the button if mail already lives in M365
Safe Attachments, Safe Links, and policies on the tenant you already pay for. SKU maze is the tax.
Key features
- Same M365 tenant
- Safe Attachments / Links
- Policies they document
- Microsoft docs
Why we like it
Honesty. A second MX hop is sometimes vanity if Plan 2 is sitting unused.
Limits
Microsoft-shaped. SKUs. BEC that looks like a real vendor still leaks through.
Abnormal
Best for aPI-first BEC desk on a mailbox you own
Abnormal sits on Microsoft or Google APIs rather than MX. The pitch is vendor-email fraud that survived the SEG.
Key features
- API integration
- BEC-shaped detections they sell
- No MX cutover story
- Commercial
Why we like it
When the hole is a real domain and a real vendor, an MX filter is the wrong door.
Limits
Commercial. API consent is a review. We did not run it.
What the internet thinks about secure email gateways
Mail threads treat BEC as a process failure. We keep that line. A gateway is not a wire-fraud playbook.
Prove Rspamd still publishes
Confirm Rspamd still publishes. Point a new filter only at mail domains you operate.
curl -fsSIL https://www.rspamd.com/ | head -n 8FAQs
Does a gateway replace DMARC?
No. DMARC is domain policy. The gateway is content and BEC. Link both.
MX or API?
MX if you still own the hop. API if mail is already M365 or Google and you will not move MX.
Will you publish a phish kit?
No.
Is this a scored bake-off?
No.
