Secure email gateway checker: which leads sit behind Proofpoint, Mimecast or Barracuda
In short: Reads the MX record of every domain on a list or CSV and labels each row behind a security gateway (Proofpoint, Mimecast, Barracuda, Cisco and 11 more), straight to its mailbox provider, or with no mail server. Limit: It shows the route mail takes, not whether a mailbox exists.
A secure email gateway checker shows which recipients' mail is filtered by a security service before it reaches the inbox. Paste a lead list or upload a CSV and each domain's first MX host is read: Proofpoint, Mimecast, Barracuda, Cisco, Trend Micro and other gateways are named, with the Google or Microsoft mailbox behind them from SPF where it shows. Download the gateway rows as their own file.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
2 of 6 leads have a security gateway as their first MX host: Proofpoint and Mimecast.
- Behind a gateway
- 2 of 6
- Straight to provider
- 3
- No mail server
- 1
What this means for you
Their mail is scanned before it reaches the mailbox. Put them in their own campaign.
- Paste a list or drop a CSV
- Gateway named per row
- Provider behind it from SPF
- Gateway rows as their own file
- Proofpoint
- Mimecast
- CSV
By SimpleVerifier Team · Last updated
Need to know which of those mailboxes are real?
- A gateway answers for the whole domain, so an address check through it often comes back accept-all. Verify the list first so the rows that hard-bounce are gone.
- Upload the file at /verify: a live mailbox check on every row, up to 100,000 rows a file, with catch-all rows marked.
- The first 100 email checks are free with a Google sign-in, no card.
How do I find which leads use Proofpoint or Mimecast?
- Paste addresses or domains one per line, or upload a CSV of up to 5,000 rows; the email column is found for you.
- Press Check for gateways. Only the unique domains are sent for an MX and SPF lookup, 100 at a time; the addresses stay in your browser.
- Read the split: behind a gateway (with its name and the mailbox provider behind it), straight to the provider, or no mail server.
- Download the gateway rows, the direct rows or the whole file with three columns added, then check the addresses that take mail.
Example
- You enter
- A CSV of 6 leads: 4 at company domains whose MX hosts end in
pphosted.com,mimecast.com,aspmx.l.google.comandprotection.outlook.com, one atgmail.comand one at a domain with no MX record. - You get
- 2 behind a gateway (Proofpoint, with Microsoft 365 behind it from SPF, and Mimecast), 3 straight to the mailbox provider (Google Workspace, Microsoft 365, Gmail) and 1 with no mail server. The gateway rows download as their own file.
- Limits
- Up to 5,000 rows and 1,000 unique domains a run; only the domains are sent for the MX and SPF lookup.
What is a secure email gateway?
A service that receives a company's mail first, scans it for spam, phishing and malware, and passes the rest on to the real mailbox at Google Workspace or Microsoft 365. The company points its MX record at the gateway, so the first MX host names it: pphosted.com is Proofpoint, mimecast.com is Mimecast, iphmx.com is Cisco Secure Email, barracudanetworks.com is Barracuda. RFC 5321 says mail goes to the lowest-preference MX first, which is why the first host is the one read.
The mailbox provider behind the gateway is read from the domain's SPF record: a company that sends through Google lists include:_spf.google.com. When SPF names exactly one of Google and Microsoft, that provider is shown next to the gateway.
Why do cold emailers split out gateway leads?
Gateways tend to be stricter with new sending domains, links and tracking pixels than the mailbox providers behind them, and many hold or rewrite messages before anyone sees them. Teams that send cold email often put gateway leads in their own campaign, with plain text, no tracking and lower daily volume, so a filter on one group doesn't drag down the others. See Proofpoint blocking emails and Mimecast blocking emails for what each one checks.
Gateways also change what an address check can tell you: many accept every recipient at the edge and decide later, so a verifier sees the domain as accept-all. The catch-all checker shows which domains do that.
Is this faster than reading MX records by hand?
| This tool | `dig MX` per domain | |
|---|---|---|
| Domains per run | Up to 1,000 | One at a time |
| Gateway named | 15 gateways recognised | You read the hostname |
| Provider behind the gateway | From SPF, where it shows | Another dig TXT |
| Original rows kept | Yes, as a CSV | You join the results yourself |
Who uses this tool, and for what?
- Cold emailers
- Put Proofpoint and Mimecast leads in their own plain-text campaign with lower volume and no tracking.
- Agencies
- Show a client how much of their list sits behind enterprise filters before quoting reply rates.
- Sales ops
- Add a gateway column to an account list, since gateway domains often verify as catch-all.
What can’t this tool tell you?
- It reads DNS, so it shows the route mail takes, not whether any mailbox exists.
- The provider behind a gateway comes from SPF and is left blank when SPF names both Google and Microsoft or neither.
- A gateway that MX doesn't name (some Microsoft Defender and Google filtering) looks like a direct domain.
- One run takes up to 5,000 rows and 1,000 unique domains.
Common questions
- How can I tell if a company uses Proofpoint?
- Look at its MX record. A first MX host ending in pphosted.com or gpphosted.com is Proofpoint, and ppe-hosted.com is Proofpoint Essentials. Paste the domain or an address here and the gateway is named for you.
- How do I know if an email address is behind Mimecast?
- Its domain's MX hosts end in mimecast.com (or mimecast.co.za, mimecast-offshore.com). This tool reads that for every address on a list at once.
- Does a gateway mean my email will be blocked?
- No. It means a filter decides before the mailbox provider does. Plenty of mail gets through; the tool only shows where the filter is so you can plan the send.
- Can I still verify addresses behind a gateway?
- Yes. Some gateways answer for each mailbox and some accept every address, which shows up as catch-all. A verification run tells you which, row by row.
- Are the addresses uploaded?
- No. The list is read in your browser and only the unique domains are sent for the DNS lookup. Nothing is stored.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.