How to choose an email security service: gateways, pricing and comparisons
What to compare when you choose an email security service, and what the pricing models really cost.
15 guides
Email security RFP template: 25 questions to ask before you buy
A copy-ready email security RFP: 25 questions on routing, quarantine, privacy, outages and cost, the evidence to request, a weighted scorecard and pilot tests.
10 min read Choosing a filterHow should an MSP price managed spam filtering?
How an MSP can price managed spam filtering: work out cost to serve per client domain, add setup and quarantine support time, test margins and design packages.
9 min read Choosing a filterDefender for Office 365 Plan 1 vs Plan 2: which do you need?
What Exchange Online Protection includes, what Defender for Office 365 Plan 1 and Plan 2 add, which Microsoft 365 plans include each, and list prices.
9 min read Choosing a filterHow much does email security cost a small business?
What drives email security cost for a small business: per-user vs per-domain pricing, add-ons and admin time, with worked examples at 5, 25 and 100 users.
11 min read Choosing a filterEmail security for ecommerce stores: protect orders, customers and payments
Email security for online stores: authenticate Shopify and WooCommerce mail, stop fake emails to your customers, supplier invoice fraud and dispute scams.
10 min read Choosing a filterEmail security for K-12 schools: the threats and a practical checklist
Email security for K-12 schools and districts: ransomware, payroll and vendor fraud, student data and FERPA, CISA advice, free resources and a checklist.
10 min read Choosing a filterEmail security for local government: a practical guide for municipalities
Email security for cities, counties and towns: free .gov domains, DMARC, ransomware and vendor payment fraud, free CISA and CIS resources, and a checklist.
10 min read Choosing a filterFree vs paid spam filter: is free good enough for a business?
What free spam filtering includes, from Microsoft 365 and Gmail to SpamAssassin, Rspamd and cPanel, what it lacks, and when a paid filter is worth it.
9 min read Choosing a filterThe FTC Safeguards Rule and email security: what it requires
What the amended FTC Safeguards Rule (16 CFR 314) means for email: who it covers, MFA, encryption, training, logging, breach notice and how email controls map to it.
10 min read Choosing a filterGoogle Workspace vs Microsoft 365: which has better email security?
Compare built-in email security in Google Workspace and Microsoft 365: spam, phishing, sandboxing, links, quarantine, reports, editions and the gaps both share.
10 min read Choosing a filterHow to evaluate a spam filter during a trial or pilot
How to evaluate a spam filter in a trial or pilot: pick a pilot domain, record a baseline, run ten real tests, time support, plan your exit and score the results.
10 min read Choosing a filterHosted vs on-premise spam filter: which should you choose?
Cloud spam filtering gateway, on-premise appliance or software, or your mailbox platform's built-in filter: how each works, the trade-offs, and how to choose.
9 min read Choosing a filterHow to choose a spam filter for a small business
A vendor-neutral checklist for choosing a business spam filter: deployment, quarantine, false positives, outage spooling, outbound, admin time and pricing.
9 min read Choosing a filterSecure email gateway vs API-based email security: which do you need?
How an MX-based secure email gateway and API-based cloud email security each work, where each one wins, the trade-offs, and when to run both together.
9 min read Choosing a filterHow to stop spam for your whole domain, not one inbox at a time
MX-level filtering vs inbox rules vs blocking senders vs spoofing protection: what each one stops, where it runs and when to use it for a business domain.
8 min readAbout these guides
Choosing an email security service mostly comes down to four questions: where it sits in your mail flow, what it costs as you grow, what it adds to the filtering you already have, and what happens if you leave. Feature lists tend to look alike; these differences don't.
- Where it sits. A secure email gateway filters at the MX, before mail reaches your mailbox provider, so it can reject or quarantine mail and hold it while your server is down. An API-based tool connects to Microsoft 365 or Google Workspace and typically acts on mail after it arrives. The gateway vs API guide compares the two.
- How it's priced. Per-user pricing grows with headcount; per-domain pricing grows with the number of domains. Count both before you compare quotes, and check what's included, such as message volume, maximum message size and outbound relay.
- What it adds. Microsoft 365 and Google Workspace both filter mail already. A separate service should add something you can name, such as a quarantine users review from digest emails, outage spooling or configuration monitoring.
- How you leave. Ask how allow lists are exported, how long message history is kept, and what a switch away involves.
Our guide to stopping spam for a whole domain walks through the options, starting with the built-in ones. For side-by-side comparisons, see Microsoft 365 built-in filtering vs a gateway and per-domain vs per-user pricing.
Frequently asked questions
What should I ask an email security vendor before buying?
Ask where filtering happens (at the MX or after delivery), what happens to mail when your server is down, who can release quarantined mail, how the price changes as you add users or domains, what volume and size limits apply, where mail is processed, and how you would switch away. Get the answers in writing.
When does per-domain pricing cost less than per-user pricing?
It depends on your mix of users and domains. Per-user prices multiply by every licensed user, while a per-domain price stays the same as the team grows. A business with many mailboxes on one domain usually pays less per domain; one with many small domains and few users may pay less per user. Compare yearly totals for your real numbers.
What does a separate filter add to Microsoft 365 or Google Workspace filtering?
Built-in filtering is a reasonable baseline. A separate MX-level filter can add a quarantine users review from digest emails, spooling that holds mail while your server is down, one set of rules across several mail platforms, and an independent second check on what gets through. Whether that's worth paying for depends on what mail problems cost you.