# How should an MSP price managed spam filtering?

URL: https://iblockspam.com/blog/msp-spam-filter-pricing-margin-guide
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Choosing a filter
Author: iBlockSpam Team

> How an MSP can price managed spam filtering: work out cost to serve per client domain, add setup and quarantine support time, test margins and design packages.

## Short answer

Price managed spam filtering from your full cost to serve each client domain, not the supplier's fee alone. Add setup time spread over the contract, expected support for held mail and missing-mail tickets, billing overhead and a contingency. Then set a price that covers that total with your target margin, and review clients whose tickets run high.

Email filtering looks like an easy recurring service for an MSP or web host. Clients already trust you with their DNS, and they call you when spam arrives or real mail goes missing. The risk is pricing it from the supplier's monthly fee and then absorbing every "where's my email?" ticket for free.

This guide shows how to work out your cost to serve a client domain, test your margin with your own numbers, and package the service so the work you do is the work you're paid for. The numbers in it are illustrative only. They aren't a quote from any supplier, including us.

## Why isn't the supplier's fee your real cost?

The subscription is the easiest number to see and often not the biggest one. A client domain also costs you:

- **Setup:** MX change, platform connector or gateway settings, testing, rollback notes and client communication.
- **Support:** releasing held mail, answering "did it arrive?" questions, adjusting allow and block lists.
- **Change handling:** a web designer or registrar change that quietly moves MX or breaks SPF.
- **Account administration:** renewals, invoicing, onboarding and offboarding users.
- **Incidents:** a phishing message that got through, or a client who paid a fake invoice and needs help fast.

Two clients with the same mailbox count can differ a lot. A business that publishes sales@ on every web page will usually see more spam, more held mail and more tickets than one that rarely receives mail from strangers.

## How do you calculate cost to serve?

Use one line per client domain per month:

**Cost to serve = filtering subscription + (setup hours × hourly cost ÷ contract months) + (support hours × hourly cost) + admin and billing + contingency**

Then:

**Margin = (your price − cost to serve) ÷ your price**

Use your own loaded hourly cost for technicians, meaning pay plus employer costs and overhead, not just the wage.

### An illustrative example

These inputs are invented to show the arithmetic. Replace every one with your own.

| Input | Illustrative value | Monthly cost |
|---|---|---|
| Filtering subscription | $10 per domain per month | $10.00 |
| Setup | 3 hours at $60, spread over 24 months | $7.50 |
| Support | 15 minutes a month at $60 | $15.00 |
| Admin and billing | Flat allowance | $3.00 |
| Contingency | Flat allowance | $4.50 |
| **Cost to serve** | | **$40.00** |

At a price of $65 per month, the contribution is $25, a margin of about 38% ($25 ÷ $65). At $50, it falls to $10, or 20%. If support time doubles to 30 minutes a month, cost to serve rises to $55 and the $65 price leaves only $10.

The lesson from the arithmetic: support minutes move the margin more than a few dollars on the subscription. Measure them before you set prices.

### Which numbers should you measure first?

If you already look after email for clients, you have most of the data:

1. **Ticket counts by client domain** for the last three to six months, tagged "held mail", "missing mail", "spam got through" or "DNS change".
2. **Minutes per ticket**, even as a rough average per category.
3. **Setup hours** for your last few onboardings, including testing and the follow-up calls in the first week.
4. **Monthly inbound volume** per client domain, from the client's mail platform reports.

Clients that sit well above your average on any of these need a different price or a different service level, not a bigger discount.

## Which pricing model should you offer clients?

| Model | How it works | Works well when | Watch out for |
|---|---|---|---|
| Per user | Fee per mailbox or seat | Your support effort scales with headcount | Shared mailboxes and role addresses can count as seats |
| Per domain | Flat fee per protected domain | Most of your work is per domain (setup, DNS, monitoring) | One domain with very high volume or tickets |
| Bundled | Filtering inside a wider managed plan | Clients buy a full support package | Filtering cost hidden inside the bundle; easy to underprice |
| Tiered by service | Same filtering, different support levels | Clients differ in how much help they want | Tiers must match work you'll actually do |

Per-user add-ons are a useful reference point. Microsoft lists [Defender for Office 365](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365) Plan 1 at $2.00 per user per month at the time of writing (October 2026), and its [licensing terms](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description) say licenses are needed for "Shared mailboxes that benefit from Defender for Office 365 protections". Our [per-domain vs per-user pricing comparison](https://iblockspam.com/compare/per-domain-vs-per-user-pricing) shows where the break-even points fall.

## How do you package the service?

Design packages around your responsibilities, not around supplier features. For example:

| Package | Who it suits | What you do |
|---|---|---|
| Essentials | Client with someone in-house who can handle digests | Setup, acceptance tests, DNS monitoring, escalations only |
| Managed | Small business with no IT staff | Essentials, plus held-mail requests, list changes, a quarterly review |
| Managed Plus | Several domains or high-risk teams such as finance | Managed, plus change review before DNS edits, incident help, a monthly summary |

Only promise what your team can deliver at the hours your price assumes. A "monthly report" you write by hand takes time every month.

## How do you keep quarantine tickets down?

Held-mail requests are usually the largest ongoing cost, so design them out where you can:

1. **Turn on user digests** so people find their own held mail. A filter with a personal quarantine for every user lets them release safe messages without a ticket.
2. **Name an owner for each shared address**, such as accounts@ or sales@, who checks its held mail. See [shared mailbox spam protection](https://iblockspam.com/blog/shared-mailbox-spam-protection).
3. **Explain what's safe to release.** A one-page guide for users cuts the "is this OK?" calls. Our [false positives guide](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) is a good base.
4. **Prefer sender-verified allow entries** to whole-domain allows, so a forged sender doesn't ride on a trusted name.
5. **Count tickets per client domain.** After three months you'll know which clients cost more than your model assumed.

## What should your onboarding checklist include?

Use the same steps for every new client domain, and charge for them:

1. Confirm who owns the domain and who can change DNS.
2. Save the current MX, SPF and DMARC records with the [Email Health Check](https://iblockspam.com/tools/email-health-check).
3. Check monthly inbound volume against the filter's limits.
4. Configure the platform side, such as a Microsoft 365 connector with [Enhanced Filtering](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) or a Google Workspace inbound gateway.
5. Lower the MX TTL, then make the change; see [how to change MX records without losing email](https://iblockspam.com/blog/change-mx-records-without-losing-email).
6. Run the acceptance tests in [how to test that a spam filter is working](https://iblockspam.com/blog/how-to-test-spam-filter-is-working).
7. [Close the direct route](https://iblockspam.com/blog/block-direct-to-tenant-bypass) to the client's mail platform.
8. Hand over the support rules: who releases held mail, response times, what's billable.

Microsoft lists "more cost", "more complexity" and more false positives among the trade-offs of adding a non-Microsoft layer ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). Price for that complexity rather than pretending it isn't there.

## What should the client contract say?

CISA's advisory on [threats to MSPs and their customers](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a) asks MSPs to explain clearly the services a customer is buying and not buying, and to agree who owns tasks such as detection and incident response. For email filtering, write down:

- What's included and what's billed by the hour.
- Who may change DNS, and how changes are approved.
- Who releases held mail, and how fast.
- How you report a suspected incident, and how quickly.
- What happens to access and DNS when the contract ends.

Protect your own access too. [NIST](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication) calls MFA on every account that offers it "essential", and CISA's advisory asks customers to require MFA on all MSP accounts.

## What should you ask a filtering supplier?

- How is pricing set for partners, and does each client's mailbox count change it?
- What's included per domain: inbound messages, message size, outbound relay, history?
- How do you see every client's status in one place, and how do clients grant or remove your access?
- Who bills the client, and can you resell or bundle the service?
- What does support look like for partners, and who talks to the client?
- How does a client leave, and what happens to their settings and held mail?

## Where does iBlockSpam fit?

iBlockSpam prices filtering per domain, with unlimited mailboxes (mailbox count, not message volume) and 100,000 inbound messages per domain per month. Partner terms, including pricing, are agreed individually, so we don't publish a partner rate card. Today each client pays for its own domains, which means your managed-service fee is separate from the filtering subscription.

Approved partners get a partner console that lists every client account that has granted access, with per-domain status, search, filters and CSV export. Clients grant full or read-only access and can remove it at any time. You can try the [partner console demo](https://iblockspam.com/demo/partner) with sample clients.

## Next steps

1. Build the cost-to-serve table with your real hourly cost and three months of ticket data.
2. Decide which pricing model matches how your costs behave, then write your packages around the work you'll do.
3. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) on a few client domains to see what onboarding will involve.
4. Read about [email filtering for MSPs](https://iblockspam.com/solutions/msp), then [apply to become a partner](https://iblockspam.com/partners/apply) to talk about terms.

See more [buying guides](https://iblockspam.com/blog/topic/buying).

## Frequently asked questions

### How do MSPs usually charge clients for spam filtering?

Common models are a per-user fee that rises with headcount, a flat fee per domain, or filtering bundled into a wider managed-services plan. The right one depends on how your own costs behave. If most of your effort is per domain, such as setup, DNS and monitoring, a per-domain fee tracks your costs more closely than a per-seat fee.

### Should an MSP charge a setup fee for email filtering?

A separate setup fee makes the economics easier to see, because MX changes, connector work, testing and rollback planning take real hours. If you waive it, spread the setup cost over the expected contract length in your model, and check that a client who leaves early doesn't turn a profitable account into a loss.

### What makes a managed email filtering client unprofitable?

Usually support time, not the subscription. Frequent requests to release held mail, users who don't read quarantine digests, DNS changed by someone else, and very high inbound volume all add hours. Track tickets per client domain for a few months and reprice or change the service level for clients well above your average.

### What should an MSP agree in writing with a client about email filtering?

Write down what the service includes and excludes, who releases held mail, who may change DNS, response times, how incidents are reported, and how access works when the contract ends. CISA advises MSPs to explain clearly what customers are and aren't buying, and to agree who handles detection and incident response.

## Sources

- [CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a)
- [Microsoft: Microsoft Defender for Office 365 plans and pricing](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-office-365)
- [Microsoft Learn: Microsoft Defender service description (licensing terms)](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description)
- [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [NIST Small Business Cybersecurity Corner: Multi-Factor Authentication](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/msp-spam-filter-pricing-margin-guide (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt