Email security RFP template: 25 questions to ask before you buy

Buying email security is easy to get wrong in ways that only show up after cutover: a customer's order held with no one watching, mail that goes around the filter, or a bill that grows with every new hire. This template turns those risks into 25 questions, a scorecard and a short pilot, so you can compare vendors on written answers and evidence.

It's vendor-neutral. If you need the background first, read how to choose a spam filter for a small business; this guide is the procurement document you send afterwards.

What should you write down before contacting vendors?

Vendors can only answer well if they know your environment. Put this at the top of the RFP:

Use measured numbers, not guesses. Message volume in particular is easy to underestimate. Microsoft 365 and Google Workspace both report it; see email security metrics for admins.

The 25 RFP questions

Copy these into a spreadsheet with one column per vendor. Ask for written answers and say which ones you'll test in the pilot.

Section A: routing and coverage

1. Does the service filter inbound mail before it reaches our platform (MX change), or after delivery through an API? If both, which do you recommend for us, and why?
2. What do you filter: spam, malware, phishing, spoofing of our own domain, and lookalike senders?
3. Which steps does setup need on our platform: MX records, connectors, gateway settings, DNS records, permissions?
4. On Microsoft 365, how do you make sure Microsoft still sees the original sender? Microsoft documents Enhanced Filtering for Connectors for this.
5. How do we stop senders delivering straight to our platform and skipping you? On Google Workspace, does your guide use the inbound gateway option that rejects mail not from gateway IPs?

Evidence to request: your setup guide for our platform, and a header trace of a test message through your service.

Section B: quarantine, false positives and privacy

6. Does each user get their own quarantine and digest? How often can digests be sent?
7. Can users release their own held mail? Which verdicts can only an admin release?
8. How are shared addresses such as accounts@ handled? Who can see their held mail?
9. How do we allow a trusted sender without letting forged copies of that sender through?
10. How long do you keep held mail and message history?

Evidence to request: a demonstration with two test users showing that user A can't see user B's held mail.

Section C: security of the service itself

11. Can we require multi-factor authentication for every admin? NIST calls MFA on all accounts that offer it "essential" for small businesses.
12. Is there an audit log of admin actions that we can see?
13. Where is our mail processed and stored, and who are your subprocessors?
14. Will you sign a data processing agreement, and where is it published?
15. How do you tell us about a security incident that affects our data?

CISA's Secure by Demand Guide has more questions of this kind, such as MFA at no extra cost and security logs in the base product.

Section D: outages, visibility and support

16. If our mail server is down, how long do you hold our mail, and what happens after that?
17. If your service has a problem, what do senders see, and do they retry?
18. Can we tell, for any message, whether it was rejected, held, queued or delivered?
19. What support channels and hours do you offer, and how do we escalate?
20. Is there a public status page?

Sending servers retry on their own, but RFC 5321 leaves the give-up time to each sender, saying it "generally needs to be at least 4-5 days". A gateway that queues your mail removes that guesswork. Our guide on what happens to email when your server is down explains the difference.

Section E: cost, limits and exit

21. Do you price per domain, per user, per mailbox, by volume, or a mix? Do shared mailboxes and aliases count?
22. What's included each month: inbound messages, message size, outbound relay? What happens above the limit?
23. What costs extra: setup help, reporting, outbound relay, extra domains?
24. Do you offer a trial, a pilot or a money-back period, and on what terms?
25. If we leave, how do we export our lists and settings, and how long can we still reach held mail?

Evidence to request: a full annual quote at our real counts, on the same billing term as the other vendors.

How do you score the answers?

Agree the weights before you read any answers. Score each category from 0 to 5, multiply by the weight, and add up. The example column shows the arithmetic only; it isn't a score for any real product.

The example works out as 4 × 0.25 + 5 × 0.20 + 5 × 0.20 + 3 × 0.15 + 4 × 0.15 + 4 × 0.05 = 4.25 out of 5.

Set one hard rule as well: any vendor that fails the bypass test or the two-user privacy test is out, whatever its total. A high average shouldn't hide a failure that matters.

Which pilot tests should be part of the RFP?

Make these the acceptance criteria, and say so in the request:

1. Clean mail from outside reaches a normal user and a shared address, and the vendor's trace matches your platform's.
2. A safe spam or malware test, such as GTUBE or the EICAR test file, is held or blocked as expected.
3. A held legitimate message is released and reaches the inbox.
4. The direct path is closed: your platform refuses inbound mail that didn't come through the filter.
5. Rollback is written down before MX changes: old records saved, connector changes listed, a named person allowed to call it.

Our guide on how to test that a spam filter is working gives the step-by-step and a sign-off sheet, and the spam filter trial checklist covers a longer side-by-side pilot.

Copy-ready request to vendors

We are evaluating inbound email security for [number] domains on [platform], with about [number] mailboxes and [number] inbound messages a month. Please answer the 25 attached questions in writing, provide a full annual quote at these counts, and propose a pilot. Our acceptance criteria are: a trace of test mail through your service, a safe spam and malware test, a released message reaching the inbox, proof that users can't see each other's held mail, a closed direct-delivery path, and written rollback steps. We won't approve cutover based on a status indicator alone.

How does iBlockSpam answer the cost and limits questions?

For reference, here are our published answers to some of the questions above. Check them on the pricing page when you compare.

Next steps

1. Fill in the environment table with measured numbers, then pick the questions that match your risks.
2. Run the Email Health Check on each domain so you know your starting MX, SPF and DMARC.
3. Send the request to two or three vendors and score the answers with the weights you agreed first.
4. To include iBlockSpam, see pricing, look around the portal demo, or contact us with your platform, domain count and monthly volume.

See more buying guides.