About

The Virtru Hosted Gateway is a hosted secure email gateway that provides Virtru’s data protection and Security Rule functionality as an MTA endpoint.

The email gateway service encrypts data before leaving or entering your domain, even if the sender does not have Virtru plugins installed or enabled in their email client.

The Hosted Gateway requires no install/config/maintenance and is a component of any compliance initiative requiring data protection. 

Jump to:

DNS

Mail Flow

Header

Delivery

DNS

Some DNS entries are required prior to implementation. Please create these DNS records prior to Gateway setup. These records will need to be created for each domain that will be sending mail through the Hosted Gateway.

Your Virtru representative will send you a 40 character alpha-numeric string. Please substitute this string where it says <virtru_supplied_token> below.

Please substitute your domain where it says <yourdomain.com> below.

• CNAME Records
  Created so Virtru can sign DKIM and the virtrugateway.com domain can send on behalf of your domain(s), please create the two (2) CNAME entries below:
  • Name: virtrugw._domainkey.<yourdomain.com>
  • Type: CNAME
  • Value: virtrugw._domainkey.virtrugateway.com  

• Name: virtrugw2._domainkey.<yourdomain.com>
• Type: CNAME
• Value: virtrugw2._domainkey.virtrugateway.com

• SPF Record
  Created to help bring additional reliability of email delivery as it authorizes the virtrugateway.com domain to send on behalf of your domain(s):

• In your DNS management console, check for an existing TXT record that begins with v=spf1
• If one exists:

  • Edit the record to add include:spf.virtrugateway.com to the existing record. It could look something like this afterward:
    v=spf1 include:spf.virtrugateway.com include:<additional-spf-record-here> ~all

  • Note: The above is meant to be an example only. Actual SPF values may differ from your existing records. 

• If one does not exist, create a new record to include the following:

  • Type: TXT

  • Name/Host: @

  • TTL: 3600 or 1 hour

  • Value: v=spf1 include:spf.virtrugateway.com ~all

• Save the record

• TXT Record
  Created so Virtru can verify domain ownership prior to implementation:

• Name: @
• Type: TXT
• Value: virtru-site-verify=<virtru_supplied_token>

Note: It can take up to 48 hours for DNS propagation to take effect.

• DMARC Policy
  • Set a DMARC policy for your sending domains to align with best practices for email delivery.
  • Define your DMARC record reference

Mail Flow

The Virtru Hosted Gateway is preconfigured for maximum security and interoperability between systems.

• Host
  • smtp.virtrugateway.com
• Port
  • 587
  • 25
• TLS
  • Mandatory

Email List Hygiene

Before sending bulk emails through the Virtru Gateway, ensure your recipient lists are clean and validated. Sending to invalid, outdated, or mistyped email addresses can trigger spam traps and damage your sending reputation — which can affect deliverability for outbound emails from your organization, including your Virtru encrypted communications.

Best Practices

Validate email addresses before adding them to mailing lists

• Check for common typos (e.g., gnail.com instead of gmail.com, etc.)
• Remove addresses that consistently bounce 
• Verify new addresses are legitimate before bulk sends

Regularly clean your lists

• Remove inactive recipients based on your organization's engagement criteria
• Promptly honor unsubscribe requests
• Audit your lists quarterly for accuracy
• Watch for spam complaints or deliverability warnings

Why This Matters

Email deliverability depends on sender reputation, which is tracked at the domain level. Repeated spam trap hits or high bounce rates from your domain can:

•   Lower your domain's sender reputation score
•   Cause legitimate emails (including Virtru encrypted messages) to land in spam folders
•   Trigger blocks from major email providers (Gmail, Outlook, Yahoo, etc.)

We recommend running list validation diagnostics using email verification tools before large-scale sends, especially for:

•   Purchased or imported contact lists
•   Lists that haven't been maintained for an extended period
•   Cold outreach campaigns

Header

Authentication

The Virtru Hosted Gateway authenticates inbound traffic via header authentication.  The application sending to the Virtru Hosted Gateway must have the ability to add an X-Header.

Example Header

00000000000000000000

Virtru will provide the Authentication code.

Decryption

The Virtru Hosted Gateway uses an X-Header to dictate a decryption request.  For every inbound decrypt request, this header must exist.

X-Virtru-Decrypt:1

Delivery

The Virtru Hosted Gateway will always perform final delivery using the recipient's MX record.

The Virtru Gateway will deliver using the following IP addresses. 

199.60.232.32
199.60.232.33
199.60.232.34