A method performed by data processing apparatuses (e.g., 102, 104, 202, 204-210), the method comprising: receiving, by a network gateway (102, 202) from a device within the same network (100, 200) as the network gateway, a domain name service request for an address of a first resource outside the network, the first resource associated with a security policy of the network, the domain name service request being addressed to a domain name service outside the network; returning, by the network gateway to the device within the network in response to determining, by the network gateway based on a uniform resource locator or a universal resource identifier included in the domain name service request and rules indicating which destination should be decrypted and which should be passed directly to a destination on the Internet, that, instead of passing the domain name service request to the domain name service, the network gateway responds to the device with a man in the middle gateway address, an address (112, 212, 214) of a man in the middle gateway (104, 204-210) within the network, the man in the middle gateway address having previously been associated with a first resource address of the the first resource; establishing a first encrypted connection between the device and the man in the middle gateway, and a second encrypted connection between the man in the middle gateway and the first resource, to facilitate encrypted communication traffic between the device and the first resource; and selectively decrypting, by the man in the middle gateway, and inspecting the encrypted communication traffic passing between the device and the first resource depending on the address of the first resource. receiving, by a network gateway (102, 202) from a device within the same network (100, 200) as the network gateway, a domain name service request for an address of a first resource outside the network, the first resource associated with a security policy of the network, the domain name service request being addressed to a domain name service outside the network; returning, by the network gateway to the device within the network in response to determining, by the network gateway based on a uniform resource locator or a universal resource identifier included in the domain name service request and rules indicating which destination should be decrypted and which should be passed directly to a destination on the Internet, that, instead of passing the domain name service request to the domain name service, the network gateway responds to the device with a man in the middle gateway address, an address (112, 212, 214) of a man in the middle gateway (104, 204-210) within the network, the man in the middle gateway address having previously been associated with a first resource address of the the first resource; establishing a first encrypted connection between the device and the man in the middle gateway, and a second encrypted connection between the man in the middle gateway and the first resource, to facilitate encrypted communication traffic between the device and the first resource; and selectively decrypting, by the man in the middle gateway, and inspecting the encrypted communication traffic passing between the device and the first resource depending on the address of the first resource.