Two possible places for the filter
Every business email system already filters mail. Microsoft 365, Google Workspace, an Exchange server or a hosted server all have built-in anti-spam and antivirus. That filter is designed for the platform that carries it: its rules, reports and logs live in that platform, and leave with it the day you change providers.
SMTP gateway. A mail server placed upstream of the mailbox. RFC 5321, which describes how mail is transported over the Internet, calls a server that receives a message and passes it on a “mail transfer agent” (MTA). The domain’s MX record points to the gateway: it is therefore the gateway that sending servers contact first.
After analysis, the gateway hands the message to the mailbox server. Users do not see it. They keep their email client, webmail and phone.
The practical consequence: the gateway does not depend on the mailbox. You can change mail servers without changing filters, or strengthen the filter without changing servers. They are two separate purchases, decided separately.
Before or after delivery
A filter can act at two points in time, and the choice is not neutral.
- Before delivery. The message is analyzed while in transit. If it is deemed dangerous, it does not enter the mailbox. A malicious attachment can be removed and replaced with an informational notice. A suspicious message goes to quarantine instead of being delivered.
- After delivery. The message is already in the mailbox when the analysis concludes, or when new information arrives, for example a link reported a few hours later. The tool must then go and remove it. In the meantime, the user may have opened it, clicked or forwarded the attachment.
The two approaches are often combined: upstream analysis, then protection that continues at the time of click, because a site that was clean on receipt can be compromised later. Neither claims to stop everything.
Klytic places the analysis before the mailbox for a simple reason: what is not delivered does not need to be clawed back. That does not remove the need for a human reflex when a credible message passes every check, as in CEO fraud.
Why place a security MTA in front of the server
- A tool built for the job. The gateway manages neither calendars nor storage. Its rules cover the sender, the content and the attachments, and are configured domain by domain.
- Protection that stays in place. It survives a change of mailbox server, and can cover several servers at once: a subsidiary, a legacy email system, a new platform.
- A decision you can read in one place. Each message carries the reason for the decision, whichever server receives it next.
- A second opinion. The email system’s built-in filter keeps working behind the gateway.
What it costs: one more intermediary on the path. It must be declared to the mailbox server, otherwise that server sees all mail arriving from a single address and misjudges the real sender. SPF, DKIM and DMARC also need to be reviewed. The page Protect the email system you already have describes these settings.
Everyone is concerned
For ANSSI, the French national cybersecurity agency, email is “the main vector for infecting workstations”, and email systems are “one of the main attack vectors since they are very widely used and exposed on the Internet” (translation). Phishing, malicious attachments, fake transfer orders: an email address is all it takes to be targeted, and a very small business is as exposed as a large group.
ANSSI makes email protection one of its ten golden rules of digital security, and its catalog of measures recommends implementing an anti-spam and anti-phishing solution. Its guide on connecting an information system to the Internet points out that business use of email is very widespread “whatever the size and sector of activity of the entity”, and that anti-spam and malicious-content detection mechanisms “must be implemented” (translation).
Security filtering of mail is therefore no longer optional. The real question is where it sits, and what it can stop before the message reaches the mailbox.
The gateway adds to your email system’s filter an analysis that does not depend on your mailbox vendor, a single policy for several servers or several companies, and decisions that can be explained.
No filter, whether built in or placed in front, replaces the reflexes ANSSI recommends: do not click on a suspicious link or attachment, do not reply to a suspicious email, verify through another channel, enable two-factor authentication.
What the gateway sees, and what it keeps
To decide, a gateway reads the entire message: the stated sender and the sending server, the authentication results (SPF, DKIM, DMARC), the text, the links, the attachments. From these it reaches a decision: deliver, quarantine, reject, or defer an unknown sender.
Reading is not keeping. The right question to ask a provider is: what remains, and for how long? For Klytic MTA, the answer distinguishes three cases, plus the record of the decision.
| Situation | What is kept | Duration |
|---|
| Normal delivery | Personal analysis data (sender, recipients, subject, body, attachment names) is purged. What remains is the timestamp, the sending domain, the scores and the decision. | Purged after 2 days by default, configurable |
| Dangerous message in quarantine | The full message, encrypted | The validity period of the release link, 7 days |
| Mailbox server unreachable | The message, encrypted (AES-256-GCM), in the queue | Until delivery or until the timeout expires |
| All decisions | Score and reason, without the content | Technical data kept for statistics |
“No message storage in normal operation” therefore means: no lasting copy of delivered mail. It does not mean “zero data”. The gateway keeps a record of its decisions, and the analysis details for a few days. The timelines are detailed in Keeping and reviewing email security logs.
The mail flow, step by step
- A sending server looks up your domain’s MX. It finds the gateway and hands it the message.
- The gateway checks the sender (authentication, reputation), the message (links, text, known scenarios), then the attachments.
- Clean message: it delivers it to your email system, whatever it is: Microsoft 365, Google Workspace, Exchange, Klytic Mail or another server.
- Dangerous message: it goes to encrypted quarantine. The recipient is notified and can release it via a link if it is a mistake.
- Rejected message: the sending server receives a rejection and notifies its user.
- Your mailbox server does not respond: the message waits, encrypted, and is delivered as soon as the server is back.
This flow relies on normal SMTP behavior: a server that receives a temporary error keeps the message and retries. The guide migrating email without interruption explains why this mechanism prevents mail loss during an MX change.
Frequently asked questions
Does a small business need security filtering?
Yes. Email attacks do not choose their targets by size. A gateway is one way to put this filtering in place without changing email systems: see Protect the email system you already have.
Does a gateway replace the Microsoft 365 or Google Workspace filter?
No. The built-in filter keeps working behind it. The vendors describe how to declare a gateway so that their own analysis stays accurate: see Protect the email system you already have.
Does the gateway delay mail?
Analysis adds a step. The visible case is intentional: an unknown sender may be briefly deferred, which weeds out automated sending that never retries.
Can we change email systems and keep the gateway?
Yes. The MX still points to the gateway; only the delivery server changes. How a switchover unfolds is described in migrating email without interruption.
What happens to a message set aside by mistake?
It is in quarantine, not deleted. See Quarantine, false positives and reports.
How is this different from a dedicated or on-premises email system?
That is a question about the mailbox, not the filter. It is covered in cloud, dedicated or on-premises email.
Where Klytic fits
Klytic MTA is a gateway of this type. It can be subscribed to on its own, without Klytic Mail, and delivers to Klytic Mail, Microsoft 365, Google Workspace, Exchange or any other mail server.
- Essential: authentication and reputation (SPF, DKIM, DMARC including for forwarded messages, domain age, blocklists), anti-spam, antivirus, anti-phishing, lookalike domains and display names, malicious macros and PDFs, encrypted quarantine and release, DKIM signing of outgoing mail, recall before sending, S/MIME signing of outgoing mail for an email system that does not support it, if the customer enables it and entrusts its key (certificate provision is optional), AI arbitration of ambiguous messages, score and reason in the headers.
- Advanced: everything in Essential, plus executive and financial fraud, links rescanned at the time of click, malicious HTML files, the DMARC console and logs exportable to a SIEM.
The service can be deployed in the Klytic cloud, on a dedicated instance or on your servers. The Klytic cloud is hosted in any geographic zone matching the applicable jurisdiction, subject to service availability, notably in Europe or Mauritius. Activation generally takes 24 to 48 hours: Klytic prepares the configuration, then you change your domain’s MX, or Klytic does it for you.
What Klytic MTA does not do: it does not replace your email system, its accounts or its permissions, and it only sees the mail that passes through it. For Microsoft 365 and other email systems, see Protect the email system you already have.
This page describes a general architecture. The exact configuration depends on your email system and your domains.
Sources
Consulted in October 2026.
- RFC 5321, Simple Mail Transfer Protocol: SMTP servers act as mail transfer agents (MTAs); intermediate hosts are generally designated by the DNS MX record. rfc-editor.org
- Klytic, Klytic MTA page: modules of the Essential and Advanced plans, options, deployment modes, activation via the MX record, message retention limited to the queue and quarantine. klytic.com
- ANSSI, “10 règles d’or en matière de sécurité numérique” (10 golden rules of digital security): rule 6, “Protégez votre messagerie électronique” (Protect your email), describes phishing and recommends being wary of suspicious links and attachments, verifying through another channel and enabling two-factor authentication. cyber.gouv.fr
- ANSSI, “Guide d’hygiène informatique” (IT hygiene guide), version 2.0, September 2017, measure 24 “Protéger sa messagerie professionnelle” (Protect your business email): “Email is the main vector for infecting workstations” (translation). messervices.cyber.gouv.fr
- ANSSI, MonServiceSécurisé, catalog of measures, measure “Mettre en œuvre une solution d’anti-spam et d’anti-hameçonnage” (Implement an anti-spam and anti-phishing solution): “Email systems are one of the main attack vectors since they are very widely used and exposed on the Internet” (translation). monservicesecurise.cyber.gouv.fr
- ANSSI, “Recommandations relatives à l’interconnexion d’un système d’information à Internet” (Recommendations on connecting an information system to the Internet), ANSSI-PA-066, version 3.0, June 19, 2020, chapter 5 “Sécurisation du service de messagerie électronique” (Securing the email service): email “has become one of the main vectors of cyberattacks” (phishing, malicious attachments); § 5.2.3, anti-spam and malicious-content detection mechanisms “must be implemented” (translation). messervices.cyber.gouv.fr
