Bardin Gate AMGAir-Gap Mail Gateway

The problem it solves

Email is the most common way data leaves one network for another, and the hardest to put behind a gap. AMG does not let the two mail servers talk to each other directly. It accepts each message in the middle, makes it durable and, when the path is open, hands the same message to the server on the other side. Your mail arrives unchanged, or fails in a visible, standard way; it is never lost in silence.

One 2U appliance

It fits in a rack. There is no new mail server to buy.

No physical link

Your two networks are never connected to each other.

Mail unchanged

Envelope and content arrive as they were sent.

A durable queue

It survives a power loss and the failure of one disk.

What you get

• A transparent two-way relay

  The SMTP envelope and content arrive unchanged; only the standard Received trace header is added.

• Only two permitted peers

  Only the two configured IP addresses may hand mail over. AMG is never an open relay.

• TLS by default

  The peer's certificate is validated; mutual TLS and SMTP AUTH are optional. Turning TLS down needs a warning and is audited.

• Visible failure

  A permanent failure produces a standard delivery notice to the sending server; no message is dropped silently.

• Alerts on the unusual

  AMG learns the normal flow of mail between the two servers and alerts you when it departs from it, such as a sudden burst of messages.

• Events for your SIEM

  Accepted, delivered, deferred and failed, with no subject or body and with pseudonymised addresses.

• Easy to run

  You enter two IP addresses and the certificates in the console. The queue, retries and reporting then run on their own.

Next to your mail gateway, not instead of it

AMG is deliberately narrow. Content inspection, anti-malware, SPF, DKIM, DMARC and spam filtering stay with your own mail gateway on each network; AMG bridges the gap and nothing more. It has no mailboxes, does not scan, does not validate recipients and does not split an envelope by domain.

• Mail out of the internal network

  The internal mail server, with no path of its own to the Internet, hands mail to the outer network's server.

• Mail in from outside

  Your outer gateway passes on mail it has already inspected, and AMG carries it across to the internal server.

• Operational alerts

  Monitoring notices from an isolated network reach the support team outside.