# Free vs paid spam filter: is free good enough for a business?

URL: https://iblockspam.com/blog/free-vs-paid-spam-filter
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Choosing a filter
Author: iBlockSpam Team

> What free spam filtering includes, from Microsoft 365 and Gmail to SpamAssassin, Rspamd and cPanel, what it lacks, and when a paid filter is worth it.

## Short answer

Free is often enough if you're on Microsoft 365 or Google Workspace, have turned on their built-in protections, and users manage their own spam folders. Paid filtering earns its cost when you need user quarantine digests, mail held during outages, one policy across platforms, or support you can call. Self-hosted free filters cost admin time instead of money.

Every business email account already has some spam filtering, usually without anyone paying for it separately. The real question isn't free versus paid, it's whether the filtering you have covers the problems you actually have. This guide lists the free options, what they leave out, and when free is honestly enough.

## What free spam filtering options are there?

There are three kinds, and they work very differently.

| Option | Where it runs | What it costs you | Typical fit |
|---|---|---|---|
| Built-in filtering in Microsoft 365 or Google Workspace | Your provider's cloud | Included in your license | Businesses already on either platform |
| Self-hosted open-source filters (SpamAssassin, Rspamd) | Your own mail server | Admin time, server resources | Teams that run their own mail servers |
| Hosting-panel filters (for example cPanel Spam Filters) | Your web host's mail server | Included with hosting | Small sites with mail on shared or VPS hosting |

### Built-in filtering in your mailbox provider

Microsoft says its built-in protections against spam, malware and phishing "are included in all organizations with cloud mailboxes", and they're on by default ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/eop-about)). Google says Gmail "displays warnings, and moves untrustworthy emails to the spam folder" by default, and admins can turn on extra Safety settings for attachments, links and spoofing at no extra cost ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)).

This is the strongest free option for most businesses, because the provider runs it, updates it and sees a huge volume of mail. Its stronger features depend on your plan, though. Our comparison of [Google Workspace vs Microsoft 365 email security](https://iblockspam.com/blog/google-workspace-vs-microsoft-365-email-security) shows which editions include sandboxing and link checks.

### Self-hosted open-source filters

[Apache SpamAssassin](https://spamassassin.apache.org/) is a long-running open-source anti-spam platform that gives system administrators "a filter to classify email and block spam". It scores each message against many rules and marks it as spam above a threshold; [what is a spam score](https://iblockspam.com/blog/what-is-a-spam-score) explains how. [Rspamd](https://rspamd.com/) is a newer filter whose detection engine is open source under the Apache 2.0 license, and it runs in front of mail servers such as Postfix and Exim.

Both are capable. Neither is a service. You install them, feed them DNS blocklists, keep their rules updated, train them and watch their logs.

### Hosting-panel filters

Many web hosts include spam filtering with email hosting. cPanel's Spam Filters feature is "powered by Apache SpamAssassin" ([cPanel docs](https://docs.cpanel.net/cpanel/email/spam-filters/)). Each account can move spam to a Spam Box folder or auto-delete it above a score. cPanel warns that Auto-Delete "could include non-spam messages, which would cause you to lose those messages", so leave it off.

## What do free spam filters usually lack?

Free filters can catch a lot of spam. What they tend to miss is everything around the filtering decision.

### A quarantine users actually see

When a free filter holds a message, the user has to know where to look. Built-in filters mostly use a Spam or Junk folder. Admin quarantines often stay silent: Google says recipients are never notified when a message goes to its admin quarantine, and Microsoft's default quarantine policies send no notifications. Paid filters usually give each user a personal quarantine with a regular digest, so a held invoice gets noticed the same day. Our guide to [email quarantine](https://iblockspam.com/blog/what-is-email-quarantine) covers the trade-offs.

### Mail held during outages

If your mail server is down, a filter that runs on that server is down too. Delivery then depends on each sender's retry policy. [RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.5.4.1) says "the give-up time generally needs to be at least 4-5 days", but plenty of senders give up sooner. A hosted filter in front of your server can hold mail and deliver it when the server returns. See [what happens to email when your server is down](https://iblockspam.com/blog/what-happens-to-email-when-server-is-down).

### Support when something goes wrong

With built-in filtering, support goes through your provider's general queue. With self-hosted filters, support is you, plus mailing lists and forums. When legitimate mail is going missing, the difference between "open a ticket" and "someone who knows mail filtering" can be days.

### Admin time

This is the hidden price of free. Self-hosted filters need patching, rule updates, Bayes training, blocklist configuration and log review. Built-in filters need less, but someone still has to review quarantine, release false positives and adjust allow and block lists. If nobody owns that work, it doesn't happen.

### One policy across platforms

Free filters are tied to one platform. A business with a Microsoft 365 domain, a Google Workspace domain and an old cPanel mailbox has three filters, three sets of rules and three places to look for missing mail.

## What does a free filter really cost to run?

Put a rough number on the work before you decide. For a self-hosted filter, the recurring jobs look like this:

- Applying operating system and package updates, and restarting services safely.
- Keeping rule sets and DNS blocklist settings current. Some blocklists refuse queries from large public resolvers, so a filter that uses them needs its own resolver.
- Training the filter on spam and legitimate mail that it got wrong.
- Reading logs when a customer says your reply never arrived, and fixing the cause.
- Watching disk space, mail queues and the server's own reputation, for example with the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker).

Built-in filtering needs far less, but quarantine review, releases and allow-list requests still take someone's time every week. Multiply those hours by what that person costs, and compare the result with a subscription. Sometimes free still wins. Often it's closer than it looks.

## How do free and paid compare side by side?

| Need | Built-in (Microsoft 365, Google Workspace) | Self-hosted (SpamAssassin, Rspamd) | Typical paid gateway |
|---|---|---|---|
| Spam and malware filtering | Yes | Yes, once configured | Yes |
| User-visible quarantine with digests | Optional on Microsoft; not for Google's admin quarantine | Spam folder only, unless you build it | Usually included |
| Mail held while your server is down | Not for your own mailboxes | No | Usually included |
| Covers several platforms with one policy | No | Per server | Yes |
| Who maintains it | Provider | You | Provider |
| Support | Provider's general support | Community | Vendor support |
| Extra cost | None beyond your plan | Server and admin time | Subscription |

## When is a free spam filter enough?

Free is a reasonable choice when most of these are true:

1. You run only Microsoft 365 or only Google Workspace.
2. You've turned on what you already have: Microsoft's Standard preset security policy, or Google's Safety settings with spam or quarantine actions.
3. Users check their Junk or Spam folders, and false positives are rare.
4. Someone reviews the admin quarantine at least weekly.
5. Outages are rare, and a delayed message wouldn't cost you money.
6. Your domain has SPF, DKIM and an enforced DMARC policy, so spoofing your own name is hard.

If all six fit, spend effort on configuration before spending money. Our [Microsoft 365 spam getting through](https://iblockspam.com/blog/microsoft-365-spam-getting-through) guide covers the common gaps on that platform.

Self-hosted filters are enough when you already run your own mail servers, have someone who enjoys the work, and accept that mail filtering is now one of their jobs.

## When is a paid spam filter worth it?

Paying makes sense when the gaps above have a real cost:

- **Missed mail costs money.** A held invoice or quote that nobody notices for a week is expensive. Digests help.
- **You can't afford to lose mail during an outage.** This matters most for on-premises Exchange and cPanel servers. Some paid filters spool mail; iBlockSpam, for example, holds it for up to 5 days.
- **You manage several domains or platforms.** MSPs and multi-brand businesses benefit from one policy and one portal.
- **Nobody has time to tune a filter.** A managed service shifts maintenance to the vendor.
- **You need specific controls**, such as blocking risky attachment types, Office macros or mail from certain countries.

Before you buy, ask how pricing works. Per-user plans can look cheap for three mailboxes and expensive for thirty; per-domain plans cost the same either way. Our guide to [email security cost for small businesses](https://iblockspam.com/blog/email-security-cost-small-business) works through examples, and [how to choose a spam filter](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business) has the questions to ask vendors.

## Can you combine free and paid filtering?

Yes, and it's common. A gateway in front of Microsoft 365 or Google Workspace filters first, and the built-in filter keeps working afterwards. Configure the platform to see the real sender: Enhanced Filtering for Connectors on Microsoft 365, or the inbound gateway setting on Google Workspace. Don't switch the built-in filter off with blanket bypass rules.

If you run cPanel, an external filter can sit in front of SpamAssassin, which then acts as a gentle second layer. Our guide to an [external spam filter for cPanel/WHM](https://iblockspam.com/blog/external-spam-filter-cpanel-whm) covers the trust settings that make that work.

## Next steps

- List every domain you receive mail for and where its MX points. The [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows it in seconds.
- Turn on the built-in protections you already pay for before you compare products.
- For one month, note how many legitimate messages went missing and how long they took to find. That number tells you whether free is working.
- If you decide to try a paid filter, run a short trial first. Our [spam filter trial checklist](https://iblockspam.com/blog/spam-filter-trial-evaluation-checklist) shows what to measure. iBlockSpam's [pricing](https://iblockspam.com/pricing) is per domain, with unlimited mailboxes.

Related: [per-domain vs per-user pricing](https://iblockspam.com/compare/per-domain-vs-per-user-pricing) explains how the two price models compare as you grow, and our [comparison pages](https://iblockspam.com/compare) cover built-in filtering and paid gateways side by side, including a [Microsoft 365 built-in vs gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) breakdown.

## Frequently asked questions

### Is the spam filter included with my email provider really free?

It's included in what you already pay. Microsoft says its built-in protections come with every organization that has cloud mailboxes, and Gmail filters every Google Workspace mailbox. There's no separate charge, but stronger features such as Microsoft's Safe Attachments or Google's Security Sandbox depend on which plan or edition you buy.

### Are SpamAssassin and Rspamd good enough for a business?

They can filter well, and many mail servers run them. The software is free, but the work isn't: someone has to install, update, tune and monitor it, handle false positives and keep the server patched. They also run on your mail server, so they can't hold mail if that server is down. They suit teams that already run their own mail.

### What do paid spam filters do that free ones don't?

The usual differences are a personal quarantine with digest emails for each user, mail held while your server is down, one policy across several domains or platforms, extra controls such as attachment-type and country filters, and a support team to call. Whether those matter depends on your users and how much admin time you have.

### Does a hosting control panel spam filter protect my whole domain?

It filters mail that reaches that server. cPanel's Spam Filters, for example, use Apache SpamAssassin and are set per account. They don't help if the server is down, and they only act after your server has accepted the message. Check that every account has a sensible threshold and that Auto-Delete is off.

## Sources

- [Microsoft Learn: Built-in security features for all cloud mailboxes](https://learn.microsoft.com/en-us/defender-office-365/eop-about)
- [Google Workspace Admin Help: Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)
- [Apache SpamAssassin project](https://spamassassin.apache.org/)
- [Rspamd project](https://rspamd.com/)
- [cPanel docs: Spam Filters](https://docs.cpanel.net/cpanel/email/spam-filters/)
- [RFC 5321: Simple Mail Transfer Protocol, section 4.5.4.1](https://www.rfc-editor.org/rfc/rfc5321.html#section-4.5.4.1)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.

---

Source: iBlockSpam, https://iblockspam.com/blog/free-vs-paid-spam-filter (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt