Tech excellence, human relevance
ServicesReferencesCompanyContact Deutsch

Services / Messaging & Email Security

HIN Gateway migration: Stargate or an alternative

HIN is replacing the classic, SEPPmail-based Mail Gateway with the new HIN Gateway, developed in the “Stargate” project. This is more than an appliance swap: architecture, key management and transport change. We assess with you whether Stargate or another solution fits your environment, and support the cutover through to the shutdown of the old gateway.

Get in touch →

What changes with Stargate

The new HIN Gateway is a mail-capable mesh node per organization: SMTP-compatible towards your own mail system, internally with decentralized key management, WireGuard transport between the instances, and deployment as a VM image or with Docker Compose. This changes firewall rules, operational responsibility, monitoring and the interaction with Exchange Online or Exchange Server. The rule set that has grown on the old gateway, application mail from scanners and business applications, and the handling of recipients without a HIN address all have to be planned anew.

Services

Assessment Which functions the current gateway actually performs: rules, application mail, domains, recipients without a HIN address, dependencies on Exchange and the firewall.
Move to Stargate Installation, network and firewall rules, mail routing to and from the mesh node, testing and cutover.
Evaluating alternatives Whether operating without an own gateway or another encryption solution is the better fit depends on mail volume, application mail and requirements; the decision is documented in a traceable way.
Exchange integration Adjusting connectors and transport rules so that no mail loops and no spoofing verdicts occur.

How an engagement runs

  1. 1 Assessment Record the functions, dependencies and submitting systems of the existing gateway.
  2. 2 Target design and planning Stargate or an alternative, maintenance windows aligned with HIN’s dates.
  3. 3 Parallel operation and cutover Test traffic through the new gateway, then move routes one at a time and reversibly.
  4. 4 Decommissioning Remove the old gateway from routing, firewall and monitoring, document the target environment.

Further reading

1 Aug 2026 · HIN Gateway HIN Platform Renewal 2026: Access Gateway, Client, and Deadlines Through September 14 Firewall approval by August 14, Access Gateway version 4 from August 17, SAML endpoints, hardware tokens, and HIN Client by September 14. The mail gateway is not affected and will be replaced separately. 23 Sep 2026 · Mail flow and SMTP Mail loop with encryption gateway behind EXO - Prevent spoofing issues If the encryption gateway (HIN in this example) is behind Exchange Online, every incoming message reaches EOP a second time: with a foreign sender domain, an invalid DKIM signature, and the gateway IP as the source. The result is a spoof verdict and junk. Four settings prevent this without disabling filtering using SCL -1: a PTR record, Enhanced Filtering disabled, a spoof exception for the gateway infrastructure, and CloudServicesMailEnabled on both connectors. 8 Jul 2026 · HIN Gateway Backing up and restoring the HIN Mail Gateway after a failure A cluster protects the HIN Mail Gateway against node failures, but it does not replace a backup. Configuration, key material, restore sequence and the changes introduced by Stargate are crucial.

Planning something similar?

In a first conversation, we'll look at where you stand, the risks and the most sensible next step.

Get in touch →

Also in Messaging & Email Security

Secure email & gatewaysMail flow troubleshootingSPF, DKIM & DMARCLoad testing & sizingTotemomail migrationSEPPmail migrationMail gateway migrations