Hosted vs on-premise spam filter: which should you choose?

Spam filtering can run in three places: in a provider's cloud in front of your mail, on your own hardware or server, or inside the mailbox platform you already use. Each choice moves work and risk to a different place. This guide explains how each model works, where each one is genuinely strong, and how to pick.

What are the three ways to filter spam?

Many businesses use two of these at once, for example a hosted gateway in front of Microsoft 365, with Microsoft's built-in protection still running behind it.

How does a hosted spam filter work?

A hosted filter is a cloud gateway. You change your domain's MX records to point at the provider. Sending servers deliver to the provider, which checks each message and passes clean mail to your real server over SMTP (RFC 5321).

Your mail platform has to trust the gateway. Microsoft fully supports this with Enhanced Filtering for Connectors when the "MX record points to the non-Microsoft service" (Microsoft Learn). Google Workspace has an inbound gateway setting with an option to reject "messages from senders other than the inbound gateway." Our setup guides cover Microsoft 365 and Google Workspace.

Where hosted filtering is strong

• Outages. Because the gateway runs elsewhere, it can accept and hold mail while your server is down, then deliver it later.
• Bad traffic never reaches you. Spam, malware and connection floods are handled on the provider's network, not your internet line.
• No hardware to maintain. The provider patches, scales and updates the filter.
• One policy for several platforms. The same rules can cover Microsoft 365, Google Workspace and an older cPanel server.

Where hosted filtering is weaker

• Your mail passes through another company. Check where it's processed, how long it's kept, and the provider's data terms.
• Setup has a few moving parts. You need the MX change, a trust setting on your platform, and a lock-down so attackers can't send straight to your mailbox provider.
• Two filters can disagree. Microsoft notes that false positives increase "as more products are added" (Microsoft Learn).

How does an on-premise spam filter work?

An on-premise filter runs on equipment you control: a hardware appliance, a virtual machine, or filtering software on the mail server itself, such as SpamAssassin on a cPanel server. Your MX record points to your own network, and the filter checks mail before your server stores it.

Where on-premise filtering is strong

• Full control. You choose the rules, logs, retention and update timing.
• Data stays in-house. Useful when a policy or contract requires mail to stay on your own systems.
• Deep integration. Local filters can use your own directory, custom scripts and internal logs.

Where on-premise filtering is weaker

• You own the patching. Mail filters face the internet directly, so missed updates matter. Lifecycles end, too: Microsoft's lifecycle page lists the end of extended support for Exchange Server 2019 in October 2025 (Microsoft Lifecycle). The same planning applies to any appliance or filtering software.
• Shared failure. If the filter and mail server share a building, power supply or internet line, one outage takes both down. Senders then retry on their own schedule. RFC 5321 says the give-up time "generally needs to be at least 4-5 days" (RFC 5321), but that depends on each sender's settings.
• Capacity. Spam waves and large attachments use your bandwidth and hardware before they're rejected.
• Skills. Someone has to tune rules, watch queues and check whether your IP lands on a blocklist. The Blacklist Checker helps with the last part.

How good is built-in filtering in Microsoft 365 and Google Workspace?

Both major platforms filter mail with no extra setup. Microsoft says its anti-malware, anti-spam and anti-phishing protections are included "in all organizations with cloud mailboxes" and are on by default (Microsoft Learn). Google says Gmail "displays warnings, and moves untrustworthy emails to the spam folder" by default, and scans all messages for malware (Google Workspace Admin Help).

Built-in filtering is a reasonable starting point for many small businesses. It has limits worth knowing:

• It only covers that platform's mailboxes.
• Policies, quarantine notifications and reporting work the platform's way, which may not match how your users work.
• Microsoft also sells its built-in protection as an add-on for on-premises mail servers. In that setup, Microsoft says deferred messages "remain in our queues for one day" while your server can't accept mail (Microsoft Learn; add-on overview).

Our comparisons for Microsoft 365 and Google Workspace go deeper on each platform.

What does each model really cost?

Sticker prices hide most of the difference. Compare a three-year total for each option.

• Hosted: a subscription, priced per user, per domain or by volume, plus a few hours of setup. Check what's included: quarantine retention, outbound relay, message limits, and support.
• On-premise: hardware or virtual machine capacity, software licenses or subscriptions for updated rules and malware signatures, a replacement cycle, and staff time for patching, monitoring and troubleshooting. Staff time is usually the largest line, and the easiest to underestimate.
• Built-in: included in your mailbox license, though stronger threat features are often sold as an upgrade or a higher plan.

Also price the cost of failure. An hour of missing mail during a busy period, or one released phishing message that leads to a fake invoice being paid, can outweigh years of fees.

Can you combine models?

Yes, and many businesses do. Common combinations:

• Hosted gateway plus built-in filtering. The gateway filters first and queues mail during outages. The platform's own protection keeps running behind it. Enable Enhanced Filtering for Connectors on Microsoft 365 so it still sees the original sender (Microsoft Learn).
• Built-in filtering plus an API add-on. No MX change; the add-on scans after delivery. Our guide to gateway vs API email security explains the trade-offs.
• On-premise server behind a hosted gateway. A common way to keep mailboxes in-house while moving the internet-facing filtering, and the outage queue, off-site.

Whatever you combine, decide which layer owns each decision, and give users one place to look for held mail where you can.

Which model should you choose?

Work through these questions in order:

1. Where are your mailboxes? If everything is in Microsoft 365 or Google Workspace, start by reviewing the built-in settings. If you have an on-premise server or several platforms, a gateway in front of all of them is simpler than separate filters.
2. Is too much getting through today? Check a week of missed spam and phishing before buying anything. If the built-in filter is doing well, tune it first.
3. What happens in an outage? If your mail server is on-premise and an outage would cost you orders or appointments, a hosted filter that queues mail is a strong argument.
4. Who will maintain it? If no one on your team will patch and watch an appliance, don't buy one.
5. Do rules require mail to stay in-house? If yes, on-premise may be the only fit. Get that requirement in writing first.
6. What does it cost over three years? Include hardware refresh and staff time for on-premise, and per-user or per-domain fees for hosted options.

Our vendor-neutral buying checklist turns these into questions to ask each provider.

Can you move from on-premise filtering to a hosted filter?

Yes, and it's mostly an MX change. Keep the old filter running during a short overlap, point MX at the new service, and let your mail server accept mail from both until queues drain. Then close direct access from anywhere other than the new gateway. Our guides on changing MX records without losing email and switching spam filter providers walk through it. If you run Exchange on-premise, see our Exchange Server notes.

Next steps

1. Look up your current MX records with the MX Lookup to see which model you use today.
2. Run the Email Health Check to spot SPF, DKIM and DMARC gaps that no filter fixes on its own.
3. Write down your outage tolerance and data-location rules before you talk to vendors.
4. If a hosted filter fits, compare plans on our pricing page, and read about outage spooling.

More comparisons are in our buying guides.

If you're replacing an on-premise appliance, our comparisons include a Barracuda alternative page that sets a hosted, per-domain filter against it.