# Email security RFP template: 25 questions to ask before you buy

URL: https://iblockspam.com/blog/email-security-rfp-template
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Choosing a filter
Author: iBlockSpam Team

> A copy-ready email security RFP: 25 questions on routing, quarantine, privacy, outages and cost, the evidence to request, a weighted scorecard and pilot tests.

## Short answer

A useful email security RFP asks how mail is routed and whether the filter can be bypassed, how held mail is released, who can see whose quarantine, what happens during outages, where mail is processed, and the full cost at your real counts. Ask for written answers, evidence and a pilot, then score every vendor the same way.

Buying email security is easy to get wrong in ways that only show up after cutover: a customer's order held with no one watching, mail that goes around the filter, or a bill that grows with every new hire. This template turns those risks into 25 questions, a scorecard and a short pilot, so you can compare vendors on written answers and evidence.

It's vendor-neutral. If you need the background first, read [how to choose a spam filter for a small business](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business); this guide is the procurement document you send afterwards.

## What should you write down before contacting vendors?

Vendors can only answer well if they know your environment. Put this at the top of the RFP:

| Item | Example | Why vendors need it |
|---|---|---|
| Mail platform | Microsoft 365 | Setup steps and connector design differ |
| Domains that receive mail | 3, plus 2 forwarding-only | Many products price per domain |
| Mailboxes, including shared | 65, of which 8 shared | Per-user pricing may count shared mailboxes |
| Inbound messages per month | From your platform's reports | Volume caps and overage rules |
| Largest attachments you receive | Drawings up to 150 MB | Size limits vary |
| Main problem | Phishing reaching accounts@ | You'll score against this |
| Biggest worry | Losing customer orders | Drives the quarantine questions |
| DNS host and who controls it | Registrar, IT partner | Needed for MX change and rollback |

Use measured numbers, not guesses. Message volume in particular is easy to underestimate. Microsoft 365 and Google Workspace both report it; see [email security metrics for admins](https://iblockspam.com/blog/email-security-metrics-for-admins).

## The 25 RFP questions

Copy these into a spreadsheet with one column per vendor. Ask for written answers and say which ones you'll test in the pilot.

### Section A: routing and coverage

1. Does the service filter inbound mail before it reaches our platform (MX change), or after delivery through an API? If both, which do you recommend for us, and why?
2. What do you filter: spam, malware, phishing, spoofing of our own domain, and lookalike senders?
3. Which steps does setup need on our platform: MX records, connectors, gateway settings, DNS records, permissions?
4. On Microsoft 365, how do you make sure Microsoft still sees the original sender? Microsoft documents [Enhanced Filtering for Connectors](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) for this.
5. How do we stop senders delivering straight to our platform and skipping you? On Google Workspace, does your guide use the [inbound gateway option](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway) that rejects mail not from gateway IPs?

**Evidence to request:** your setup guide for our platform, and a header trace of a test message through your service.

### Section B: quarantine, false positives and privacy

6. Does each user get their own quarantine and digest? How often can digests be sent?
7. Can users release their own held mail? Which verdicts can only an admin release?
8. How are shared addresses such as accounts@ handled? Who can see their held mail?
9. How do we allow a trusted sender without letting forged copies of that sender through?
10. How long do you keep held mail and message history?

**Evidence to request:** a demonstration with two test users showing that user A can't see user B's held mail.

### Section C: security of the service itself

11. Can we require multi-factor authentication for every admin? [NIST](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication) calls MFA on all accounts that offer it "essential" for small businesses.
12. Is there an audit log of admin actions that we can see?
13. Where is our mail processed and stored, and who are your subprocessors?
14. Will you sign a data processing agreement, and where is it published?
15. How do you tell us about a security incident that affects our data?

CISA's [Secure by Demand Guide](https://www.cisa.gov/resources-tools/resources/secure-demand-guide) has more questions of this kind, such as MFA at no extra cost and security logs in the base product.

### Section D: outages, visibility and support

16. If our mail server is down, how long do you hold our mail, and what happens after that?
17. If your service has a problem, what do senders see, and do they retry?
18. Can we tell, for any message, whether it was rejected, held, queued or delivered?
19. What support channels and hours do you offer, and how do we escalate?
20. Is there a public status page?

Sending servers retry on their own, but [RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.5.4.1) leaves the give-up time to each sender, saying it "generally needs to be at least 4-5 days". A gateway that queues your mail removes that guesswork. Our guide on [what happens to email when your server is down](https://iblockspam.com/blog/what-happens-to-email-when-server-is-down) explains the difference.

### Section E: cost, limits and exit

21. Do you price per domain, per user, per mailbox, by volume, or a mix? Do shared mailboxes and aliases count?
22. What's included each month: inbound messages, message size, outbound relay? What happens above the limit?
23. What costs extra: setup help, reporting, outbound relay, extra domains?
24. Do you offer a trial, a pilot or a money-back period, and on what terms?
25. If we leave, how do we export our lists and settings, and how long can we still reach held mail?

**Evidence to request:** a full annual quote at our real counts, on the same billing term as the other vendors.

## How do you score the answers?

Agree the weights before you read any answers. Score each category from 0 to 5, multiply by the weight, and add up. The example column shows the arithmetic only; it isn't a score for any real product.

| Category | Weight | What a 5 looks like | Example score | Vendor A | Vendor B | Vendor C |
|---|---|---|---|---|---|---|
| Security path and bypass protection | 25% | Trace shown, direct path closed in the pilot | 4 | | | |
| False-positive recovery and quarantine privacy | 20% | Users release safely; two-user test passed | 5 | | | |
| Integration and rollback | 20% | Written steps for our platform; rollback rehearsed | 5 | | | |
| Outages, visibility and support | 15% | Mail queued during outage; every message traceable | 3 | | | |
| Predictable total cost | 15% | Full annual quote, clear limits, no per-mailbox surprises | 4 | | | |
| Reporting and day-to-day use | 5% | Admins find answers in minutes | 4 | | | |

The example works out as 4 × 0.25 + 5 × 0.20 + 5 × 0.20 + 3 × 0.15 + 4 × 0.15 + 4 × 0.05 = **4.25 out of 5**.

Set one hard rule as well: any vendor that fails the bypass test or the two-user privacy test is out, whatever its total. A high average shouldn't hide a failure that matters.

## Which pilot tests should be part of the RFP?

Make these the acceptance criteria, and say so in the request:

1. **Clean mail from outside** reaches a normal user and a shared address, and the vendor's trace matches your platform's.
2. **A safe spam or malware test**, such as GTUBE or the EICAR test file, is held or blocked as expected.
3. **A held legitimate message** is released and reaches the inbox.
4. **The direct path is closed**: your platform refuses inbound mail that didn't come through the filter.
5. **Rollback is written down** before MX changes: old records saved, connector changes listed, a named person allowed to call it.

Our guide on [how to test that a spam filter is working](https://iblockspam.com/blog/how-to-test-spam-filter-is-working) gives the step-by-step and a sign-off sheet, and the [spam filter trial checklist](https://iblockspam.com/blog/spam-filter-trial-evaluation-checklist) covers a longer side-by-side pilot.

## Copy-ready request to vendors

> We are evaluating inbound email security for [number] domains on [platform], with about [number] mailboxes and [number] inbound messages a month. Please answer the 25 attached questions in writing, provide a full annual quote at these counts, and propose a pilot. Our acceptance criteria are: a trace of test mail through your service, a safe spam and malware test, a released message reaching the inbox, proof that users can't see each other's held mail, a closed direct-delivery path, and written rollback steps. We won't approve cutover based on a status indicator alone.

## How does iBlockSpam answer the cost and limits questions?

For reference, here are our published answers to some of the questions above. Check them on the [pricing page](https://iblockspam.com/pricing) when you compare.

| Question | iBlockSpam |
|---|---|
| Pricing unit (21) | Per domain; unlimited mailboxes (mailbox count, not message volume) and unlimited domain aliases |
| Monthly limits (22) | 100,000 inbound messages per domain, 400 MB maximum inbound message size, 500 outbound relay messages |
| Quarantine (6, 7) | Personal quarantine for every user with scheduled digests, plus a domain-wide quarantine for admins |
| History (10) | 30 days of message history |
| Outages (16) | Mail held for up to 5 days and delivered when your server is back |
| Processing (13) | Mail is processed in the United States; see our [subprocessors](https://iblockspam.com/legal/subprocessors) and [DPA](https://iblockspam.com/legal/dpa) |
| MFA (11) | Optional two-factor authentication, which account owners can require for everyone |
| Trial (24) | No free trial; a 30-day money-back guarantee on a domain's first annual subscription |
| Status (20) | Public [status page](https://iblockspam.com/status) |

## Next steps

1. Fill in the environment table with measured numbers, then pick the questions that match your risks.
2. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) on each domain so you know your starting MX, SPF and DMARC.
3. Send the request to two or three vendors and score the answers with the weights you agreed first.
4. To include iBlockSpam, see [pricing](https://iblockspam.com/pricing), look around the [portal demo](https://iblockspam.com/demo), or [contact us](https://iblockspam.com/contact) with your platform, domain count and monthly volume.

See more [buying guides](https://iblockspam.com/blog/topic/buying).

## Frequently asked questions

### What is the most important question in an email security RFP?

Ask how the vendor will prove that real mail flows through its service, can't go around it, and still reaches the right inbox. Detection claims are hard to compare, but routing, bypass and delivery can be tested in a pilot. A vendor that can't show you its own trace of a test message is hard to support later.

### Does a small business need a formal RFP for a spam filter?

Usually not a formal tender. But the same questions, sent by email to two or three vendors, protect you from surprise limits, per-mailbox charges and a cutover with no way back. Pick the 10 or 12 questions that match your risks and ask for written answers before anyone changes your MX records.

### How should we weight an email security scorecard?

Weight what would hurt most if it went wrong. For most businesses that's the security path and bypass protection, then false-positive recovery and quarantine privacy, then integration and rollback. Cost matters, but compare full annual cost at your real counts. Agree the weights before you read any answers, so a low price can't bend them.

### What evidence should a vendor provide during an email security pilot?

Ask for a trace of a test message through their service, a safe spam or malware test result, a released message reaching the inbox, proof that one user can't see another's held mail, and written rollback steps. Screenshots of a status badge or a sales deck don't count as acceptance evidence.

## Sources

- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [Google Workspace Admin Help: Set up an inbound mail gateway](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-an-inbound-mail-gateway)
- [RFC 5321: Simple Mail Transfer Protocol, section 4.5.4.1](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.5.4.1)
- [CISA: Secure by Demand Guide](https://www.cisa.gov/resources-tools/resources/secure-demand-guide)
- [NIST Small Business Cybersecurity Corner: Multi-Factor Authentication](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-rfp-template (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt