Everything you'd expect from a gateway — and a few things you wouldn't.

Outbound mail control

Filtering outbound traffic is the most overlooked yet most critical part of the job. A customer's compromised WordPress install or a stolen email password can destroy deliverability for every domain on your server within hours.

• Rate limiting and quotasSeparate counters are kept per authenticated user, sending domain and source server IP. A sudden burst in volume is the first sign of a compromised account; when a threshold is crossed, sending is throttled or stopped.
• Content and link inspectionEvery outbound message goes through spam scoring, malformed-MIME checks, an attachment policy and link-reputation inspection; risky messages are reviewed before they leave your server.
• No silent droppingA blocked message is never silently discarded. The source server receives an explicit response during the SMTP session; you see the reason in the dashboard.

Inbound mail protection

When you point your MX record to us, all inbound traffic passes through us first. The cost of filtering — connections, disk, CPU — stays with us; only clean mail reaches your server.

• Pre-connection filteringBotnet and zombie-machine traffic is rejected before the SMTP session is fully open, using reputation lists and behavioral tests.
• Sender identitySPF, DKIM and DMARC are verified. Spoofed messages impersonating your domain (including CEO fraud) are separated out here.
• Content analysisStatistical classification, fuzzy signature matching, Office macro analysis and malicious-link inspection work together.
• Virus scanningScanning with known malware signatures and supplementary signature sets; malicious attachments are removed before they reach your server.
• Recipient verificationMail sent to addresses that don't exist on your server is rejected before acceptance — so you never generate backscatter.

DKIM and sender identity

The most common mistake an intermediate relay makes is altering the message and invalidating its existing DKIM signature. MailGuard solves this with three rules.

• No tamperingThe message body and signed headers are left unchanged, and no advertising or filter header is added to outbound mail. Your source server's DKIM signature passes through intact.
• Hosted DKIMFully managed: you only keep a single CNAME record, key rotation is handled by us. The signature is applied with d=yourdomain.com, keeping DMARC alignment.
• Local signingIf there is neither a signature at the source nor a CNAME, the message still doesn't leave unsigned; a missing-configuration warning is shown in the dashboard.

IP pools and reputation management

Our outbound IPs are spread across several independent network blocks. Even if one block lands on a list, the others keep working.

Each domain is assigned a fixed IP within its pool. Reputation models on the receiving side reward consistency; random IP rotation hurts.

Visibility and reporting

Every step of your email traffic is logged; you don't guess why a message was rejected — you see the remote server's response exactly as given.

• Per-message loggingFor each message we store the sender, recipient, result, remote server response, outbound IP used and filter score.
• SMTP session transcriptYou don't guess why a message was rejected; you see the receiving server's response exactly as given.
• AlertsAutomatic notifications for bounce rate, complaint rate, quota overruns and missing DNS configuration.
• API and webhooksDelivery, deferral, bounce and complaint events can be streamed into your own systems.

Infrastructure

Secure transport, redundant gateway architecture and consistent authentication.

Works with your existing server. Managed easily from WHM.

Start using MailGuard without changing your existing infrastructure. Manage the whole server from WHM; connect any platform with SMTP Relay / Smarthost support in a few settings.

• Route outbound mail in one clickThe cPanel / WHM module writes the Exim smarthost route, tests it and rolls back if needed.
• Bulk-update SPF recordsBulk-update your existing domains' SPF records from the panel and easily enable inbound routing.