Web, email and DNS security: secure web gateways, email filtering, protective DNS and browser isolation
In short: Most attacks reach people through a link, an attachment or a domain lookup. A secure web gateway filters web traffic, email security checks senders and attachments, protective DNS blocks known bad domains, and browser isolation keeps risky pages away from the device.
The three front doors
Phishing emails, malicious downloads and fake login pages all depend on three everyday services: email, the web and DNS (Domain Name System). If you can inspect and filter these channels, you stop a large share of attacks before they reach a device. Each control below covers a different step, so they work best together.
Secure web gateways
A secure web gateway (SWG) is a proxy that sits between users and the internet, either as an on-site appliance or as a cloud service. It can:
- Block categories of sites (gambling, newly registered domains, known phishing).
- Scan downloads for malware and block risky file types.
- Apply different rules to different groups, for example students and staff.
- Inspect encrypted HTTPS traffic using TLS inspection, which requires a company certificate on managed devices. Exclude banking and health sites, and tell staff it is in place.
Traffic reaches the gateway through an explicit proxy setting, a transparent redirect on the firewall or an agent on each device. Cloud gateways also protect laptops when users work from home.
Email security
An email security gateway or cloud filter checks every message before it reaches the mailbox:
- Sender checks: SPF (Sender Policy Framework) lists the servers allowed to send for a domain, DKIM (DomainKeys Identified Mail) signs messages, and DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when both fail. Publish all three for your own domains so others can spot fakes.
- Content checks: spam scoring, malware scanning and sandboxing, which opens attachments in an isolated virtual machine to watch their behaviour.
- Link protection: links are rewritten and checked again when the user clicks, because a page can turn malicious after delivery.
- Warnings: banners on external mail and lookalike-domain alerts help people notice impersonation.
DNS security
Almost every connection starts with a DNS lookup, which makes DNS a cheap and effective control point.
| Control | What it does |
|---|---|
| Protective DNS (DNS filtering) | The resolver refuses to answer for known malicious or unwanted domains, so the connection never starts. |
| DNSSEC | Signs DNS records so resolvers can detect forged answers. |
| Encrypted DNS (DoH, DoT) | DNS over HTTPS and DNS over TLS stop eavesdropping on lookups. Point managed devices at your own resolver so filtering still applies. |
| Logging | DNS logs show which devices looked up suspicious domains, which is very useful in an investigation. |
In the UK, the National Cyber Security Centre (NCSC) offers a protective DNS service to many public sector bodies, which shows how widely this control is used.
Browser isolation and putting it together
Remote browser isolation opens risky or uncategorised websites in a disposable browser in the cloud and sends only a safe visual stream to the user. Even if the page carries malicious code, it never runs on the laptop. It is often reserved for unknown sites to keep costs and delays down.
Real-world example: a staff member at a regional housing association clicks a link in a convincing "invoice overdue" email. The email filter had already marked the message as external and rewritten the link. At click time, the link checker sees that the domain was registered two days earlier and sends the page to browser isolation, where the fake login form is shown read-only. Protective DNS logs show two other users looked up the same domain, so the IT team blocks it for everyone and reminds staff how to report suspicious mail.
These services are often delivered together as part of SSE (security service edge). See SD-WAN security and SASE and Phishing basics.
Practice
What is the difference between SPF and DKIM?
Why does TLS inspection need a certificate on managed devices?
How does protective DNS stop a malware download?
Key takeaways
- Email, web and DNS are the main routes attacks use to reach people.
- A secure web gateway filters sites and downloads and can inspect HTTPS.
- SPF, DKIM and DMARC plus sandboxing and link checks protect email.
- Protective DNS is a cheap control that blocks bad domains before a connection starts.
- Browser isolation runs risky pages away from the device.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.