What is a spam filter gateway and does a small office need one?

A spam filter gateway is a mail server that sits in front of your mailboxes. Your domain's MX record points to the gateway, so every incoming email lands there first. It checks for spam, phishing and harmful attachments, then passes the clean mail on. A small office needs one when the same spam reaches several staff every day, or fake invoices keep getting through.

How does a spam filter gateway work?

When someone emails your company, their mail server looks up your domain's MX record to find out where to deliver it. Normally that record points straight to your mailbox server. With a gateway, the MX record points to the filter instead.

Google describes an inbound gateway as a server that processes email before it is delivered, for example by checking for spam, archiving messages and scanning for harmful attachments. Google's setup steps start with pointing your MX records at the gateway, and Microsoft gives the same instruction for Microsoft 365 when a separate service does the filtering.

The mailbox server should also accept mail only from the gateway, a step that is easy to forget. Microsoft's guide sets up a connector for this, and Google has an option to reject mail that does not come from the gateway's addresses. Without it, a spammer who knows where your mailbox server is can send to it directly and skip the filter.

What does a gateway stop?

A good gateway catches most bulk spam before staff see it. It can also hold:

• phishing emails with links to fake login pages,
• fake invoices and payment requests sent in bulk,
• attachments carrying malware, such as booby-trapped ZIP or Office files,
• mail that pretends to come from your own domain or a bank's domain.

That last one is spoofing. Microsoft explains that ordinary email does nothing to prove the sender is who they say they are, which is why SPF, DKIM and DMARC exist. SPF lists the servers allowed to send for a domain, DKIM signs the message so changes can be spotted, and DMARC tells the receiver what to do when those checks fail. Microsoft says these work together, and using only some of them gives weaker protection. A gateway reads these results when it decides what to block.

What does a gateway not stop?

A filter looks for signs of bad mail. A polite email with no link and no attachment, sent from a real account, shows very few of those signs.

MyCERT warned in May 2026 about "boss impersonation" emails. The scammers used real accounts at a genuine overseas internet provider, which helped the mail get past spam filters, and set the display name to look like a company director. MyCERT found no harmful links or attachments in the samples it studied, just a short urgent question such as "Are you available?". Many of these went to directors' personal Gmail accounts, where the company's filter never sees them.

A gateway also cannot help when a real supplier's mailbox is hacked and the scammer replies inside a genuine email thread. The mail comes from the right server and passes SPF and DKIM. It gets caught when a staff member stops and checks.

How do I know my office needs one?

• Several staff get the same spam every day.
• Fake invoices or "change of bank account" emails have reached your accounts team.
• Staff spend time clearing the Junk folder, or real mail gets lost in it.
• Mailboxes fill up with junk and customers' emails start bouncing.
• You have staff on phones and laptops, and you want one filter for everyone rather than settings on each device.

What to do

1. Find out where your MX record points. Your email provider can tell you, or look it up with any free MX lookup tool. If it points straight to your mailbox server, there may be no separate filter.
2. Ask your provider what filtering you already have, and whether there is a quarantine you can check for real mail that was held.
3. If you add a gateway, make sure your mailbox server is locked to accept mail only from it.
4. Check your own domain has SPF, DKIM and DMARC records. Our guide on Outlook.com rejecting your email explains them.
5. Set a rule for money: any change of bank details or urgent payment request is confirmed by phone, using a number you already have. Our guide on how to spot a fake invoice email shows what to look for.
6. Ask directors and staff not to use personal Gmail for company matters, as MyCERT advises.

For quick steps inside Outlook and Gmail, see how to stop spam reaching your company email inbox.

How SyncTech can help

Our anti spam email hosting with a spam filter in front of every mailbox checks incoming mail on the server before it reaches your staff. If you are not sure where your MX record points, our support team can check it with you.

Source and credit

We are sharing information from Google, Microsoft and MyCERT (CyberSecurity Malaysia). This guide is written by Synctech in our own words.

• Set up an inbound mail gateway, Google Workspace Admin Help: https://support.google.com/a/answer/60730?hl=en
• Manage mail flow using a third-party cloud service with Exchange Online, Microsoft Learn, updated 28 July 2025: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud
• Email authentication in cloud organizations, Microsoft Learn: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about
• MyCERT Alert MA-1439.052026, "Boss Impersonation" Scam Email, MyCERT, 12 May 2026: https://www.mycert.org.my/portal/advisory?id=MA-1439.052026

Retrieved 13 Nov 2026. Google, Gmail, Google Workspace, Microsoft, Microsoft 365 and Outlook are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.