Email Security Gateway (MTA) with Spectra Detect
Spectra Detect can act as an in-line email security gateway. Its SMTP Connector works as a mail transfer agent (MTA) that sits in your existing mail flow. It receives email over SMTP, analyzes each message and its attachments, and then either relays it to your mail server or holds it in quarantine.
What is an MTA?
A mail transfer agent (MTA) is a server that receives email over SMTP and passes it on, hop by hop, until it reaches the recipient's mail server. Postfix, Exim, and Microsoft Exchange are common MTAs. At each hop, the MTA reads the message's envelope, finds the next hop from DNS MX records or a configured smart host, and then delivers, relays, defers, or rejects the message.
Email security products are usually deployed in one of two ways:
- Inline (gateway mode): the security MTA sits in the live mail path, through an MX record change or a smart host on your existing mail server. Every message passes through it before delivery, so threats can be blocked or quarantined before they reach users. The Spectra Detect SMTP Connector works this way in In-Line Relay mode, deployed behind your front-end email gateway or MTA.
- Out-of-band (monitor mode): the mail flow doesn't change. Your mail platform sends the security product a copy of each message, for example through a journaling, BCC, or forwarding rule. The copy is analyzed for detection and visibility, and delivery to users is never delayed or blocked. The Spectra Detect SMTP Connector works this way in Blackhole mode.
| Inline (In-Line Relay) | Out-of-band (Blackhole) | |
|---|---|---|
| Position in the mail flow | In the delivery path | Outside the delivery path, receives copies |
| How mail arrives | Relayed by your front-end email gateway or MTA | Journaling, BCC, or forwarding rule on the mail platform |
| After analysis | Clean mail is delivered, the rest is quarantined | The copy is discarded |
| Effect on users | Malicious mail is stopped before delivery | None, delivery isn't delayed or blocked |
| Typical use | Prevention | Proof of value, visibility, and detection |
In inline mode, the SMTP Connector sits between your front-end email gateway and your mail server. Blocked email goes to the Spectra Analyze quarantine instead of your mail server.
In out-of-band mode, your mail server delivers email as usual and sends a copy to the SMTP Connector for analysis.
How it works
- Your upstream email gateway or MTA sends inbound email to the Spectra Detect SMTP Connector.
- Spectra Detect analyzes the email, its attachments, and the network references it contains.
- Emails that pass are relayed to your downstream mail server, with headers that record the analysis result.
- Blocked emails are uploaded to Spectra Analyze, which acts as the quarantine.
- Analysts review quarantined emails in Spectra Analyze and release the ones that are safe to their original recipients.
The connector is a relay, not a mail server: it doesn't store mailboxes, and it always needs a downstream mail server to deliver to.
What you can control
- Which classifications are delivered and which are quarantined
- Allowlists and blocklists for senders, recipients, URLs, and file hashes
- Blocking based on the reputation of URLs, domains, and IP addresses in the email
- TLS enforcement and which networks can send email to the connector
- Notifications to recipients when their email is quarantined
Products involved
| Product | Role |
|---|---|
| Spectra Detect | Runs the SMTP Connector, analyzes email, and relays or blocks it. Available in Spectra Detect 6.1 and later. |
| Spectra Analyze | Stores quarantined email for review, and releases it to the original recipients. |
| Spectra Intelligence | Provides the threat intelligence used to classify files and network references. |
Other ways to analyze email
If you don't want to route mail through a ReversingLabs product at all, the mailbox connectors in Spectra Detect and Spectra Analyze collect email from a mailbox, such as an abuse mailbox where users report suspicious messages, and analyze it without blocking anything.
Get started
- SMTP Connector in Spectra Detect: operating modes, filtering, and configuration
- Email Quarantine in Spectra Analyze: reviewing and releasing quarantined email
- Firewall and network connections: ports used by ReversingLabs appliances