How to choose a spam filter for a small business

Most spam filters block obvious junk. The differences that matter to a small business show up elsewhere: how easily staff find a held invoice, what happens when your mail server is down, and how much of your week the filter quietly takes. This guide gives you a vendor-neutral checklist, the questions to ask, and a simple way to run a fair trial.

What should a small business look for in a spam filter?

Start with fit, not feature lists. Every serious product scans for spam, malware and phishing. What varies is how each one fits your mail platform, your staff and your budget. Use this checklist to compare options side by side.

Which deployment model fits your business?

There are three common shapes:

1. Built-in platform filtering. Microsoft 365 and Google Workspace both filter mail by default. Microsoft says its anti-malware, anti-spam and anti-phishing protections are "on by default" for all cloud mailboxes (Microsoft Learn).
2. A gateway in front of your mail. Your MX record points to the filtering service, which holds or rejects bad mail and passes clean mail to your server. Microsoft fully supports this with Enhanced Filtering for Connectors (Microsoft Learn), and Google Workspace has an inbound gateway setting.
3. An API add-on. The tool connects to your mailboxes and scans mail after delivery.

If you're unsure which you need, read secure email gateway vs API email security and hosted vs on-premise spam filters. For Microsoft 365, our built-in vs gateway comparison walks through the trade-offs.

How should quarantine work for your users?

Quarantine is where most day-to-day friction lives. When a filter holds a real message, someone has to notice and release it. If only the admin can do that, the admin becomes a help desk.

Look for:

• Personal quarantine for each user, so they can release their own mail.
• Digest emails on a schedule users can live with, such as daily.
• An admin view across the whole domain, for shared mailboxes and investigations.
• Clear labels, so users can tell spam from a phishing hold. Some messages, such as confirmed malware, should stay admin-only.

Our guide to email quarantine explains how these pieces fit together.

How does the filter handle false positives?

Every filter makes mistakes. Microsoft notes that "the rate of false positives (good items marked as bad) increase as more products are added" (Microsoft Learn). So ask how mistakes get fixed, not whether they happen.

Check that you can:

• Release a message and see why it was held.
• Allow a sender in a way that can't be abused by spoofing. Plain address allow entries are risky because the "From" address is easy to fake. Entries that require the sender to pass authentication are safer. See false positives for why.
• Report misses and wrong holds back to the vendor.

What happens to your email if your server goes down?

Sending servers retry for a while when your server is unreachable. RFC 5321 says the give-up time "generally needs to be at least 4-5 days" (RFC 5321), but each sender sets its own limit. A gateway that queues mail on your behalf removes that uncertainty.

Ask each vendor how long they hold mail when your server is down, and whether you can see what's queued. Then compare. Microsoft's own built-in protection for on-premises servers keeps deferred messages "in our queues for one day" (Microsoft Learn), which shows how much this can vary. Our guide on what happens when your mail server is down covers the details.

Does the filter cover outbound email?

Inbound filtering protects your staff. Outbound filtering protects everyone else from a compromised account in your business, and it protects your sending reputation. If a vendor offers an outbound relay, check the monthly message allowance, whether it signs with DKIM for your domain, and how it fits into your SPF record without breaking the 10-lookup limit. The SPF Checker shows where you stand today.

How much admin effort will it take?

For a small business, the cheapest product can be the most expensive if it needs weekly attention. Estimate the effort honestly:

• Setup: an MX change, plus connector or gateway settings on your mail platform. Ask for written, platform-specific steps and a rollback plan.
• Lock-down: with a gateway, attackers can try to send straight to your mailbox provider and skip it. Check that the vendor explains how to block direct delivery.
• Ongoing: list cleanup, quarantine questions, and alerts when something changes.

Where is your mail processed and kept?

A spam filter sees every message your business receives, so treat it like any other supplier that handles your data. Ask where mail is processed, how long message history is kept, and how long quarantined mail stays before it's deleted. Short retention keeps less of your data in another system, but it also limits how far back you can investigate a missed phishing message. If you work in a regulated field, check the vendor's data processing terms against your own obligations before the trial, not after.

Per-user vs per-domain pricing: which costs less?

Prices are usually set per user (per mailbox), per domain, or by message volume. The same business can get very different totals:

• Per user is often cheaper for one to three mailboxes, but every new hire, shared mailbox or role address may add a seat.
• Per domain charges once per domain. It tends to cost less as mailbox counts grow, but check the message volume and size limits that come with it.
• Add-ons such as outbound relay, longer retention or advanced threat features can change the picture.

Work it out with your real numbers. Our per-domain vs per-user pricing comparison shows worked examples and the break-even points.

What questions should you ask vendors before you buy?

Send the same list to every vendor and compare the answers in writing. For a longer, procurement-style version with 25 questions and a weighted scorecard, use our email security RFP template.

1. Which mail platforms do you support, and do you have setup steps for mine?
2. Where is mail processed and stored?
3. How long do you keep quarantined mail and message history?
4. How long do you queue mail if my server is down?
5. What are the monthly message and maximum message size limits?
6. Can users release their own mail? How often are digests sent?
7. How do I allow a sender safely, and how do I report mistakes?
8. Is outbound filtering or relay included, and what are its limits?
9. How do I export my lists and settings if I leave?
10. How long can I reach the old quarantine after canceling?

Be wary of answers that promise perfection. No filter stops every threat. Even Microsoft states that "total protection never reaches 100 percent" (Microsoft Learn).

How do you run a fair trial?

A trial on real mail tells you more than any feature sheet.

1. Record a baseline. Note your current MX, SPF and DMARC records with the MX Lookup and the Email Health Check.
2. Lower your MX TTL a day before the switch, so you can roll back quickly.
3. Run for at least two weeks, including a busy period such as month-end.
4. Keep a simple log: missed spam, wrongly held messages, user questions, and time spent.
5. Test the edges: a large attachment, a message from a new supplier, and a test while your server is briefly unreachable, if the vendor supports it.
6. Check headers on delivered mail with the Email Header Analyzer to confirm the filter is in the path.
7. Decide on your log, not on impressions.

Filtering is one layer. CISA's phishing guidance also stresses staff training and DMARC on your own domain (CISA), so pair your choice with the small business email security checklist.

Next steps

1. Fill in the checklist table above for your current setup, and note the gaps.
2. Send the ten vendor questions to two or three providers, and compare the written answers.
3. Price each option with your real mailbox and domain counts. iBlockSpam uses per-domain pricing with unlimited mailboxes (mailbox count, not message volume: 100,000 inbound messages per domain per month are included); see whether that model suits you, and read how it works.
4. If you're replacing an existing filter, follow how to switch spam filter providers.

Related: free vs paid spam filters, what email security costs a small business and the spam filter trial checklist. If you're weighing named products, our comparison pages set iBlockSpam against common choices, such as this SpamTitan alternative page.

See more buying guides, or the small business overview.