Home›Guides›Email security
Email security · Use Klytic MTA
Klytic MTA does more than filter what comes in. Mail sent through the gateway can be DKIM-signed, even if your email service does not do so, and held for a brief moment to catch a message sent too hastily. If your email service does not support S/MIME, Klytic MTA can also S/MIME-sign your messages with your key, provided you choose to enable this option and entrust it with the key.
| Feature | Essential | Advanced |
|---|---|---|
| DKIM signing of outgoing email, even if your email service does not do it | Included | Included |
| Recall before a message is sent | Included | Included |
| S/MIME signing by the gateway, with your key, if you enable it | Included | Included |
| S/MIME certificate supply | Option | Option |
These features apply to mail that goes through Klytic MTA. Your email service, whether Microsoft 365, Google Workspace, Exchange, Klytic Mail or another server, must therefore hand its outgoing messages to the gateway, which then forwards them to recipients. Klytic prepares this route with you during onboarding. Prices are on the Pricing page.
A DKIM signature lets the recipient’s server verify that the message really comes from your domain and was not altered in transit. It improves deliverability and makes spoofing your domain harder. Klytic MTA can add it even if your current email service does not sign, which is useful when you keep Microsoft 365, Google Workspace or another server.
Each protected domain gets its own signature. A message can carry several DKIM signatures: if your email service already signs, the signature that counts for DMARC is the one matching the sender’s visible domain.
If you publish a strict DMARC policy, update SPF and DKIM before routing mail through the gateway, not after. What these mechanisms mean is explained in SPF, DKIM and DMARC: what they protect, and what they do not.
A message sent too quickly, to the wrong recipient or with the wrong attachment, cannot be retrieved once delivered. Klytic MTA can hold outgoing messages for a short delay before forwarding them. During this window, the message can be recalled; after that, it goes out normally.
The delay is set in the domain’s sending policy. How to recall a message during the window is explained to your users during onboarding.
This delay is a gateway feature, not a feature of your email software. Do not confuse it with the recall function of some email clients, which asks the recipient after the fact to delete a message already received: here, the message has not yet left your domain.
Example. A payroll officer sends the salary file to “Julien,” and autocomplete picks a customer’s Julien instead of her colleague in the department. She notices immediately. The message is still held by the gateway: she recalls it before it goes out.
A message held for this delay is not in quarantine. Quarantine concerns dangerous incoming mail: see Quarantine, false positives and reporting.
S/MIME relies on a certificate tied to an email address. An S/MIME signature lets the recipient verify who sent the message and that it was not altered along the way.
Many email services can S/MIME-sign from the user’s device. If yours cannot, Klytic MTA can do it instead: the gateway signs the outgoing message with the sender’s key before forwarding it to the recipient.
If you prefer the private key never to leave your devices, sign from an email service that supports S/MIME and leave this option disabled. The guide What is a sovereign cloud? explains why key ownership matters.
| Mechanism | What it protects |
|---|---|
| Transport encryption (TLS) | The route between two servers. Toward another domain, it also depends on the receiving server. |
| DKIM signature | The authenticity of the sending domain, verified by receiving servers. |
| S/MIME signature | The sender’s identity and the message’s integrity, verified by the recipient. |
None of this requires Klytic Mail. If you keep your current email service, see Protecting the email system you already have.
No. The signature is added by the gateway, in front of any email service. See Protecting the email system you already have.
See SPF, DKIM and DMARC. The Advanced plan’s DMARC console tracks your domains’ reports: see Reading and exporting a filter decision.
The domain administrator, in the sending policy. The division of roles is described in Who sets the filter in Klytic MTA.
No. It is an option you enable, by entrusting your key to the gateway. Without that, Klytic MTA does not S/MIME-sign.
Yes, certificate supply by Klytic is only an option. Prepare activation with Klytic through the Contact page.
Klytic prepares DKIM signing and the outbound route with your email administrator.
Welcome offer
No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.
