{"id":4525,"date":"2026-10-12T12:58:37","date_gmt":"2026-10-12T10:58:37","guid":{"rendered":"https:\/\/www.klytic.com\/protect-existing-email\/"},"modified":"2026-10-12T13:31:52","modified_gmt":"2026-10-12T11:31:52","slug":"protect-existing-email","status":"publish","type":"page","link":"https:\/\/www.klytic.com\/en\/protect-existing-email\/","title":{"rendered":"Protecting the email system you already have"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"4525\" class=\"elementor elementor-4525 elementor-4320\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7ba5e39 e-con-full kly-g e-flex e-con e-parent\" data-id=\"7ba5e39\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-8bf4398 e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"8bf4398\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-e9e25b6 e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"e9e25b6\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3399d9f elementor-widget elementor-widget-text-editor\" data-id=\"3399d9f\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/email-security\/\">Email security<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#f87171\">Email security \u00b7 Understand<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6eb090f elementor-widget elementor-widget-heading\" data-id=\"6eb090f\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Protecting the email system you already have<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c541d88 elementor-widget elementor-widget-text-editor\" data-id=\"c541d88\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">Yes, you can strengthen the protection of Microsoft 365, Google Workspace, Exchange or another server without changing email services. The domain\u2019s MX record points to the gateway, which analyzes the mail and then delivers it to the current server. Users keep their mailboxes; the DNS manager and the email administrator each have one setting to change.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d96c968 elementor-widget elementor-widget-text-editor\" data-id=\"d96c968\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>7 min<\/b><\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5361680 e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"5361680\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-8773bf2 e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"8773bf2\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4330e34 elementor-widget elementor-widget-text-editor\" data-id=\"4330e34\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>The decision: keep the mailbox, change the MX<\/h2>\n<p>Changing email services and changing protection are two different projects. The first moves mailboxes, history, calendars and accounts on phones. The second only touches the path of incoming mail.<\/p>\n<p>That path comes down to one DNS record: the MX, which tells sending servers where to deliver mail for your domain. When it points to the gateway, the gateway receives, analyzes, then hands the message to the mailbox server. This applies to:<\/p>\n<ul>\n<li>Microsoft 365 (Exchange Online);<\/li>\n<li>Google Workspace;<\/li>\n<li>Exchange, on-premises or hosted;<\/li>\n<li>any other email server that receives over SMTP;<\/li>\n<li>Klytic Mail, which is just one case among others, not a prerequisite.<\/li>\n<\/ul>\n<p>This guide covers the case where you keep the mailbox. If you are also changing servers, the guides <a href='\/en\/migrate-from-microsoft-365\/'>migrating from Microsoft 365<\/a> and <a href='\/en\/migrate-from-google-workspace\/'>migrating from Google Workspace<\/a> describe that project.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0c3f069 elementor-widget elementor-widget-text-editor\" data-id=\"0c3f069\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Who changes what<\/h2>\n<div class=\"kly-table\"><table><thead><tr><th>Setting<\/th><th>Where<\/th><th>Who<\/th><\/tr><\/thead><tbody>\n<tr><td>The domain\u2019s MX record<\/td><td>DNS zone, at the registrar or DNS host<\/td><td>The person who manages DNS, or the provider to whom it has been delegated<\/td><\/tr>\n<tr><td>Declaring the gateway to the email service<\/td><td>Administration console of Microsoft 365, Google Workspace or the server<\/td><td>The email administrator<\/td><\/tr>\n<tr><td>SPF, DKIM and DMARC<\/td><td>DNS zone<\/td><td>The DNS manager, after an inventory of the servers that send for the domain<\/td><\/tr>\n<tr><td>Domains and delivery server<\/td><td>Gateway<\/td><td>The gateway provider, who prepares the configuration<\/td><\/tr>\n<\/tbody><\/table><\/div>\n<h3>The principle on the Microsoft 365 side<\/h3>\n<p>Microsoft\u2019s documentation on filtering through a third-party service is clear: the domain\u2019s MX must point to that service, which then delivers to Exchange Online. Microsoft recommends a \u201cpartner\u201d inbound connector, which can reject mail that arrives without going through the service. It also recommends enabling Enhanced Filtering for Connectors, so that its own analysis evaluates the real sender rather than the gateway\u2019s address. It advises against simply bypassing its filtering for the third-party service\u2019s addresses.<\/p>\n<h3>The principle on the Google Workspace side<\/h3>\n<p>Google describes an \u201cinbound mail gateway\u201d: the MX points to the gateway, then the administrator declares its IP addresses in the console. Gmail uses this to find the sender\u2019s real address in the headers, on which SPF and its spam evaluation depend. You can also reject mail that does not come from the gateway. Google specifies that it does not apply the sender\u2019s DMARC policy to mail received through a declared gateway: that check then falls to the gateway.<\/p>\n<p>This guide does not reproduce the screens of these consoles, which change. Follow the official page cited at the bottom of this page when you configure it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aafd991 elementor-widget elementor-widget-text-editor\" data-id=\"aafd991\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Several servers behind a single gateway<\/h2>\n<p>A common case in a group: the parent company on Microsoft 365, a subsidiary on Google Workspace, a third on a legacy server. A single gateway can sit in front of all three.<\/p>\n<p>The principle is per-domain routing. Each domain has its MX pointing to the gateway. For each domain, the gateway knows which server to hand the mail to after analysis. The analysis is shared; the destination changes.<\/p>\n<p>The benefit: the same filtering policy, or different settings per domain, and all decisions readable in one place. A point to prepare: a domain whose mailboxes are split between two servers requires knowing, address by address, where to deliver. This case is studied before the switchover.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-db1d6d6 elementor-widget elementor-widget-text-editor\" data-id=\"db1d6d6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What changes, and what does not<\/h2>\n<p><strong>Does not change<\/strong>: addresses, mailboxes, history, email software, webmail, phones. The email service\u2019s built-in filter keeps working. Internal rights and sharing remain those of the platform.<\/p>\n<p><strong>Changes<\/strong>:<\/p>\n<ul>\n<li>The first server to receive the mail. It is the one that sees the original connection and checks sender authentication.<\/li>\n<li>The mailbox server no longer sees the sender directly, but the gateway. Hence the declaration described above.<\/li>\n<li>Messages carry the gateway\u2019s decision headers: an administrator can read there why a message was delivered or set aside.<\/li>\n<li>If the gateway also relays outgoing mail, the domain\u2019s SPF record must authorize it, and the DKIM signature must be published for it. What these mechanisms mean is explained in <a href='\/en\/spf-dkim-dmarc-en\/'>SPF, DKIM and DMARC<\/a>.<\/li>\n<\/ul>\n<p>The day you also change mailbox servers, the gateway can stay in place: only its delivery server changes. The guide <a href='\/en\/migrate-email-without-downtime\/'>migrating email without interruption<\/a> remains the reference for that day, including for SPF, DKIM and DMARC.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-30ebefb elementor-widget elementor-widget-text-editor\" data-id=\"30ebefb\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Setup, step by step<\/h2>\n<ol>\n<li>Inventory: domains, the mailbox server for each, applications that send mail on behalf of the domain.<\/li>\n<li>Gateway preparation by its provider: accepted domains, delivery server, initial rules.<\/li>\n<li>Declaring the gateway in the email service (inbound connector or inbound gateway), if the platform provides for it.<\/li>\n<li>Lowering the MX TTL beforehand, then changing the MX. During the DNS cache period, some senders still deliver directly to the mailbox server: this is normal.<\/li>\n<li>Check: a message sent from an external address should arrive with the gateway\u2019s decision headers.<\/li>\n<li>Monitoring the quarantine for the first few days, to release false positives and adjust rules.<\/li>\n<\/ol>\n<p>Rolling back is simple: restore the old MX. It is prepared as for a migration, with a person who has the authority to decide it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ab6e100 elementor-widget elementor-widget-text-editor\" data-id=\"ab6e100\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What the gateway does not do<\/h2>\n<p>It sees the mail that passes through it, and only that. It does not see messages exchanged between two mailboxes on the same platform that never leave it, nor files shared in online storage, nor user sign-ins.<\/p>\n<p>It therefore does not replace the internal settings of Microsoft 365 or Google Workspace: permissions, two-factor authentication, sign-in alerts, automatic forwarding rules. A stolen account remains first and foremost an issue for the email service. The guide <a href='\/en\/spam-phishing-malware-compromised-account\/'>spam, phishing, malware and compromised accounts<\/a> sorts this out.<\/p>\n<p>Finally, a sender who knows the technical address of the mailbox server can try to deliver to it directly, bypassing the MX. That is the reason for the lockdown offered by Microsoft (partner connector) and by Google (rejecting mail that does not come through the gateway).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ef2ff84 elementor-widget elementor-widget-text-editor\" data-id=\"ef2ff84\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2>\n<h3>Should users be informed?<\/h3>\n<p>Their addresses do not change. Do, however, let them know they may receive quarantine notices: see <a href='\/en\/quarantine-false-positives\/'>Quarantine, false positives and reporting<\/a>.<\/p>\n<h3>Should the Microsoft 365 or Google filter be turned off?<\/h3>\n<p>No. Microsoft recommends leaving its analysis active and configuring it to see the real sender, rather than bypassing it.<\/p>\n<h3>How long does the switchover take?<\/h3>\n<p>The MX change itself takes effect at the pace of the DNS cache. Preparation depends on the number of domains and servers. For Klytic MTA, see the next section.<\/p>\n<h3>Does a gateway in front change the deliverability of our outgoing mail?<\/h3>\n<p>Only if it also relays outgoing mail. In that case, SPF and DKIM must take it into account: see <a href='\/en\/spf-dkim-dmarc-en\/'>SPF, DKIM and DMARC<\/a>.<\/p>\n<h3>Why not simply change email services?<\/h3>\n<p>That is a different decision, with different criteria. It is covered in <a href='\/en\/european-business-email\/'>choosing a European business email service<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b0c67cf kly-g-klytic elementor-widget elementor-widget-text-editor\" data-id=\"b0c67cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Where Klytic stands<\/h2>\n<p><a href='\/en\/klytic-mta\/'>Klytic MTA<\/a> sits in front of the email service you have: Microsoft 365, Google Workspace, Exchange, Klytic Mail or any other server. It does not require a Klytic mailbox.<\/p>\n<ul>\n<li><strong>Onboarding<\/strong>: usually 24 to 48 hours. Klytic prepares the configuration; you change your domain\u2019s MX record, or Klytic does it for you. Declaring the gateway in the Microsoft 365 or Google Workspace console is done by that service\u2019s administrator, and is prepared with Klytic during onboarding.<\/li>\n<li><strong>Deployment<\/strong>: Klytic cloud, dedicated instance or customer servers. For specific needs, other architectures can be designed with Klytic, for example filtering in the cloud with a relay installed on your premises, or multiple regions.<\/li>\n<li><strong>Plans<\/strong>: Essential and Advanced. Essential covers authentication, anti-spam, antivirus, phishing, lookalike domains, quarantine, DKIM signing of outgoing mail and recall before sending. Advanced adds financial fraud, time-of-click protection, the DMARC console and log export to a SIEM.<\/li>\n<li><strong>Trial<\/strong>: 30 days free, without changing email services.<\/li>\n<\/ul>\n<p>Klytic MTA does not manage the permissions or accounts of your current email service, and does not claim equivalence with the security tools built into Microsoft 365 or Google Workspace: it adds a layer in front of them.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a9ae61c kly-g-disclaimer elementor-widget elementor-widget-text-editor\" data-id=\"a9ae61c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This page describes a principle. The Microsoft and Google consoles evolve: their official documentation is authoritative for the exact steps.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9bf5406 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"9bf5406\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Consulted in October 2026.<\/p><ul><li>Microsoft Learn, \u201cManage mail flow using a third-party cloud service with Exchange Online\u201d: the MX must point to the third-party service; partner-type inbound connector; Enhanced Filtering for Connectors rather than bypassing filtering. <a href='https:\/\/learn.microsoft.com\/en-us\/exchange\/mail-flow-best-practices\/manage-mail-flow-using-third-party-cloud' rel='noopener' target='_blank'>learn.microsoft.com<\/a><\/li><li>Google Workspace Help, \u201cSet up an inbound mail gateway\u201d: MX to the gateway, declaring its IP addresses, optional rejection of mail not coming through the gateway; the sender\u2019s DMARC policy is not applied by Gmail to mail received through the gateway. <a href='https:\/\/knowledge.workspace.google.com\/admin\/gmail\/advanced\/set-up-an-inbound-mail-gateway' rel='noopener' target='_blank'>knowledge.workspace.google.com<\/a><\/li><li>RFC 5321, SMTP: intermediate hosts are generally designated by the DNS MX record. <a href='https:\/\/www.rfc-editor.org\/rfc\/rfc5321' rel='noopener' target='_blank'>rfc-editor.org<\/a><\/li><li>Klytic, Klytic MTA page: modules in the Essential and Advanced plans, options, deployment modes, activation via the MX record. <a href='https:\/\/www.klytic.com\/klytic-mta\/' rel='noopener' target='_blank'>klytic.com<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ec5d194 e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"ec5d194\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5a56202 elementor-widget elementor-widget-html\" data-id=\"5a56202\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"On this page\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b38a0fe elementor-widget elementor-widget-text-editor\" data-id=\"b38a0fe\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>Protect your current email service<\/h3><p>30-day free trial, without changing email services: only the MX changes.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/klytic-mta\/\">Discover Klytic MTA<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8dc6666 e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"8dc6666\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-470cb91 elementor-widget elementor-widget-text-editor\" data-id=\"470cb91\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/email-security-gateway\/\" style=\"--cat:#dc2626\"><span class=\"c\">Understand \u00b7 Email security<\/span><span class=\"t\">Built-in filter or security gateway in front of your email<\/span><span class=\"q\">An email system\u2019s filter protects that email system. A gateway receives the domain\u2019s mail, analyzes it, then delivers it: where to place it, what it keeps.<\/span><span class=\"m\"><span>7 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/spf-dkim-dmarc-en\/\" style=\"--cat:#dc2626\"><span class=\"c\">Understand \u00b7 Email security<\/span><span class=\"t\">SPF, DKIM and DMARC: what they protect, and what they do not<\/span><span class=\"q\">SPF, DKIM and DMARC prevent others from using your exact domain. They do not read the message: what they stop, what gets through, how to deploy them.<\/span><span class=\"m\"><span>6 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/migrate-email-without-downtime\/\" style=\"--cat:#0077cc\"><span class=\"c\">Guides<\/span><span class=\"t\">How do you migrate a business email service without downtime?<\/span><span class=\"q\">Coexistence, second pass, MX TTL, SPF, DKIM, DMARC and test sends: switching email services without losing mail, and what remains visible.<\/span><span class=\"m\"><span>Guides<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47ba7642 e-con e-atomic-element e-div-block-base e-default-div e-47ba7642-0a8d8cb \" data-id=\"47ba7642\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"47ba7642\" data-e-type=\"e-div-block\" data-id=\"47ba7642\">\n    <div class=\"elementor-element elementor-element-1957dcf0 e-con e-atomic-element e-div-block-base e-default-div e-1957dcf0-65bb45b \" data-id=\"1957dcf0\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"1957dcf0\" data-e-type=\"e-div-block\" data-id=\"1957dcf0\">\n    \t\t\t<p class=\"e-34902a51-b78d132 e-paragraph-base e-default-p\" data-interaction-id=\"34902a51\" data-e-type=\"widget\" data-id=\"34902a51\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"54c96233\" class=\"e-54c96233-632171d e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"54c96233\">30 days free trial, migration support included<\/h2>\n\t\t\t\t\t<p class=\"e-6661c7ce-fdde46c e-paragraph-base e-default-p\" data-interaction-id=\"6661c7ce\" data-e-type=\"widget\" data-id=\"6661c7ce\">No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.<\/p>\n\t\t<div class=\"elementor-element elementor-element-761c01f e-con e-atomic-element e-div-block-base e-default-div e-761c01f-cf11a99 \" data-id=\"761c01f\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"761c01f\" data-e-type=\"e-div-block\" data-id=\"761c01f\">\n    \t\t\t<a href=\"https:\/\/www.klytic.com\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-2f43419f-52885cf e-button-base e-default-a\" data-interaction-id=\"2f43419f\" data-e-type=\"widget\" data-id=\"2f43419f\">\n\t\ud83d\ude80 Start the free trial\n<\/a>\n\t\t\t\t\t<a href=\"https:\/\/www.klytic.com\/en\/pricing\/\" target=\"_self\" class=\"e-31327e4d-45bbc1a e-button-base e-default-a\" data-interaction-id=\"31327e4d\" data-e-type=\"widget\" data-id=\"31327e4d\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"Protect Microsoft 365 or Google without migrating | Klytic","_seopress_titles_desc":"Adding a security gateway in front of Microsoft 365, Google Workspace or Exchange: MX, email-side setup, SPF\/DKIM\/DMARC and limits.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"Protect Microsoft 365 or Google without migrating | Klytic","_seopress_social_fb_desc":"Adding a security gateway in front of Microsoft 365, Google Workspace or Exchange: MX, email-side setup, SPF\/DKIM\/DMARC and limits.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"Protect Microsoft 365 or Google without migrating | Klytic","_seopress_social_twitter_desc":"Adding a security gateway in front of Microsoft 365, Google Workspace or Exchange: MX, email-side setup, SPF\/DKIM\/DMARC and limits.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-4525","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/4525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=4525"}],"version-history":[{"count":0,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/4525\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=4525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}