Breakwater — Email Security Gateway

Inbound channel · open sea · 51.89°N 5.31°W

Stand between the storm
and the harbor.

Breakwater is the email security gateway that meets every inbound message at the waterline — reads it for intent and forgery, disarms what it carries, and decides whether it makes port. Built for the teams who guard many harbors at once.

The passage

Every message runs the channel.

Nothing is delivered on trust. From the moment a message reaches the edge, it sails a fixed passage — one authority weighs the evidence, and only then does it make port.

01

Accept

The SMTP edge takes the message and spools it durably to object storage before a database row ever exists.

bw-receiver
02

Scan

Rspamd, ClamAV, and full SPF / DKIM / DMARC parsing read the message for spam, malware, and forgery.

ScanWorker
03

Disarm

Attachments are detached and rebuilt inside a sandbox, stripped of macros and active content.

Detach → Convert
04

Verdict

A single authority weighs every signal and rules once: deliver, send to dry dock, or turn away.

VerdictWorker
05

Seal

Clean mail is ARC-sealed with the tenant’s own signing key, held in per-tenant custody.

SealingWorker
06

Deliver

The message makes port — handed to your mail host, with its queue-id recorded on the trail.

DeliveryWorker

Harbor operations

One wheelhouse for the whole waterfront.

The console speaks the language of the harbor, because that is what it is — a working view of everything moving through, held back, or bearing down on your mail.

Quarantine

Dry Dock

Held mail waits here for review. Release it, or let it expire — every decision is logged and reversible.

Threat campaigns

Storms

Coordinated attacks surfaced as they form — the same phishing wave hitting many tenants, seen as one front.

Search & trace

Voyage

Follow any message’s full passage — accept, every check, the verdict, and where it finally landed.

Verdict authority

Policy Engine

One place owns the ruling. Rules render to an auditable snapshot, so you can always answer “why.”

Reputation & scoring

Soundings

Senders, domains, and URLs weighed against live intelligence — the depth reading behind every score.

Allow / deny lists

Standing Orders

The harbormaster’s standing orders — who always sails through, and who is never let past the wall.

Built for the fleet

Run many harbors from one wheelhouse.

Breakwater is multi-tenant to the core. Every client keeps its own domains, signing keys, policies, and quarantine — isolated by row-level security — while your staff works the whole fleet from a single console. Onboard a tenant with a guided wizard that saves the MX cutover for last, so nothing moves until everything’s ready.

Per-tenant ARC / DKIM key custody Row-level tenant isolation Guided Microsoft 365 onboarding MX cutover, last — not first

The watch never stands down

The storm doesn’t stop.
Neither does the gateway.

A message counts as accepted the moment it is durably spooled — the blob, not the database row, is the source of truth. If a failover drops the tail of the replication stream, the spool sweep reconstructs every message that reached the wall without a trace. Nothing that made the breakwater is ever lost behind it.

Durable spool before commit Orphan-spool recovery sweep Standby promotion runbook

Make port

Bring your first tenant in.

Onboarding is a guided passage. Breakwater verifies the domain, provisions its signing keys, and sets the routing — then saves the MX cutover for last, so nothing moves until you’re ready.

Onboarding · new tenant MX cutover, last
  • Verify domain ownershipdone
  • Provision ARC / DKIM signing keysdone
  • Set inbound & delivery routingdone
  • Cut over MXwhen you’re ready