The security architect has concluded that the optimal mail flow positions the existing Cisco Secure...

Cisco Secure Email Threat Defense uses Secondary Gateway mode when inbound mail first reaches an additional gateway and then passes to Secure Email Threat Defense before final delivery. In this scenario, the existing Cisco Secure Email Gateways are the Internet-facing termination point, and Secure Email Threat Defense is downstream of them but upstream of the cloud mail platform. That sequence exactly matches Secondary Gateway mode. Primary Gateway mode would place Secure Email Threat Defense first and require inbound mail to reach it directly. Primary with Additional Gateway would also place Secure Email Threat Defense before another gateway, reversing the stated design. “Secondary with Additional Gateway” is not the documented flow required for the described single upstream gateway layer. Therefore, the correct incoming-traffic domain setting is Secondary Gateway. Cisco Secure Email Threat Defense mail-flow modes