Email Security Gateways and Cold Email Reply Rates

When an account goes quiet, outbound teams usually check their own infrastructure first: the domain, the mailbox, the sequence. They rarely check the one thing they do not control at all, which is what sits in front of the prospect's inbox. Email security gateways such as Proofpoint, Mimecast, and Cisco IronPort filter incoming mail before it ever reaches Google Workspace or Microsoft 365, and across 1.6 million contacts in Danish Lead Co.'s own sending data, the gateway a company runs predicts its reply rate better than almost anything else on the list.

This is not a theory piece about spam filtering. It is a read of what actually happened when real outbound sequences reached real companies sitting behind fourteen different receiving setups, tracked at the individual prospect level over the last 90 days. The pattern is consistent enough to change how a target list gets built, not just how a message gets written.

Does a prospect's email security gateway affect cold email reply rates?

Yes, and the effect is far larger than most deliverability advice accounts for. Across 1,617,064 contacts with a recorded mail gateway, companies sitting behind Proofpoint replied at 0.01 percent and companies behind Mimecast replied at 0.01 percent, while companies on plain Google Workspace replied at 0.22 percent and companies with no MX record at all replied at 0.24 percent. That is a twenty-fold difference driven entirely by what the prospect's IT team put in front of their inbox, not by anything in the sequence, the subject line, or the sending domain's reputation.

• The gap is structural, not a messaging problem. No amount of personalisation fixes a message that a gateway never delivers to a human inbox in the first place.
• "No MX record" outperforming every named gateway is the tell. Smaller, newer, or less formally administered domains convert best because nothing is filtering before the inbox decides.
• This sits upstream of deliverability work. Warmup, DNS authentication, and sender reputation (covered in our playbook for diagnosing broken email deliverability) all assume the message can reach the inbox. Email security gateways decide that before any of it applies.

Which email gateways convert best and worst for cold email?

Google Workspace and domains with no MX record convert roughly five to twenty times better than the dedicated enterprise security gateways. The table below is every gateway in the dataset with meaningful volume, ranked by positive reply rate, across the 90 days ending 19 October 2026.

A further six named gateways in the data, Cisco IronPort, Sophos, Symantec MessageLabs, Trend Micro, Fortinet, and Forcepoint, together cover 24,795 contacts and a combined positive rate under 0.1 percent. None has enough individual volume to trust in isolation, but every one of them sits below Google Workspace, which is the point: dedicated email security gateways consistently underperform plain commercial mailboxes, regardless of which vendor runs them.

Why does Microsoft 365 convert worse than Google Workspace?

Microsoft 365 converts at roughly a fifth of Google Workspace's rate because most Microsoft 365 tenants run Microsoft Defender for Office 365 as a default filtering layer, while Google Workspace's native filtering is comparatively permissive out of the box. Both are mainstream business mailboxes, not dedicated email security gateways in the Proofpoint or Mimecast sense, yet the built-in filtering difference alone produces a 0.04 percent versus 0.22 percent gap in our data. This is a separate question from which provider you send outbound from; our analysis of 1.5 million sends by sending provider covers that side. This post is about what the prospect receives into, not what you send out of.

Should you stop targeting companies behind a secure email gateway?

Not automatically, because a 0.01 percent reply rate is not zero, and some of those companies are exactly the accounts worth the effort. The right move is to stop pretending cold email will carry the same load everywhere and rebuild the channel mix for gated accounts specifically.

• Keep cold email as a light touch, not the primary channel. A short, well-targeted sequence can still land the rare reply; a high-volume sequence just burns domain reputation against a wall that will not move.
• Shift weight to channels a gateway cannot filter. Phone, LinkedIn, and warm introductions bypass the inbox entirely, which is why multi-channel coverage matters more for gated accounts than for anyone else on the list.
• Spend research time where it compounds. If an account is worth six figures in pipeline, the hour it takes to find a mobile number or a mutual connection is cheaper than the sends it would take to force a reply through Proofpoint.
• Do not let a quiet gated account read as a failed campaign. Measuring every account against the same reply-rate bar penalises exactly the accounts that most need the outbound system to keep trying through other channels.

How do you check a prospect's email gateway before you build a list?

Screening a target list for its email security gateway takes minutes per domain and changes how the account gets worked before the first message goes out.

1. Pull the MX record for the domain. A free MX lookup shows the mail exchanger the domain publishes; Proofpoint, Mimecast, and Barracuda all route through identifiable hostnames.
2. Classify the gateway, not just the mailbox. A company can run Microsoft 365 for the mailbox and still route everything through Mimecast first; the gateway, not the mailbox brand, is what filters the message.
3. Segment the list by gateway tier before sequencing. Group accounts into light-gateway (Google Workspace, no MX record, self-hosted) and heavy-gateway (Proofpoint, Mimecast, and similar) buckets.
4. Route each tier to a different plan. Light-gateway accounts carry the full cold email sequence; heavy-gateway accounts get a shorter email touch plus a phone and LinkedIn plan built from the start, not added after three unanswered emails.

This is the kind of targeting work we build into every engagement at Danish Lead Co.: the list is not just names and titles, it is an assessment of which channel will actually reach each account.

Which industries are most likely to sit behind a secure email gateway?

Regulated and risk-sensitive industries are the heaviest adopters of dedicated email security gateways, because compliance and data-loss requirements push them toward enterprise-grade filtering rather than a mailbox provider's default settings. Financial services firms and healthcare organisations are the two sectors most likely to run Proofpoint, Mimecast, or a comparable gateway at scale, which is part of why outbound into financial services and healthtech buyers so often needs a heavier multi-channel plan from day one rather than an email-only sequence. It is not a reason to avoid those sectors; it is a reason to plan the channel mix for them differently from the start.

Cross-border programmes see the same pattern for a different reason. An aviation supplier we support opened 53 qualified conversations across more than 30 countries in 46 days, a market where the mix of gateways, mailbox providers, and self-hosted mail servers varies by jurisdiction more than almost anywhere else. Gateway-aware targeting is one of the reasons that kind of spread works without the campaign stalling in the countries with stricter default filtering. More outcomes like it sit on our case studies page.

The takeaway on email security gateways and cold email

A prospect's email security gateways are not a detail to notice after a campaign goes quiet; they are a targeting input to check before the first message is written. The accounts behind Proofpoint and Mimecast are not unreachable, but treating them the same as a Google Workspace account on the same list wastes volume on one and under-invests in the other. Build the list with the gateway already classified, and the channel plan for each account stops being a guess.

See which of your target accounts are worth a cold email push

If part of your list is sitting behind a gateway that is quietly absorbing your sends, that is a targeting fix, not a reason to write more emails. On a call with Danish Lead Co., we will walk through your current target list, classify the accounts by what is actually filtering their inbox, and show you the channel mix we would run for the gated portion versus the open portion. You leave with a segmented view of your own list, not a generic deliverability checklist.

Related reading

• Outbound Reply Rates by Email Gateway: The Data
• Reply to Meeting Conversion Rate: What the Data Shows
• Mailbox Provider Performance: 1.5M Outbound Emails Analysed