What is an email filtering service?

"Email filtering service" covers several different products that share one job: deciding which messages your users should see. Some come free with your mailboxes, some sit in front of them, and some work inside them. This guide defines the term, compares the five types, explains how hosted filtering works and what it costs, and helps you decide whether you need more than you have.

What is an email filtering service?

An email filtering service is software that inspects email and decides what happens to each message: deliver it, put it in a Junk or Spam folder, hold it in quarantine, or reject it. It looks for spam (unwanted bulk mail), malware (harmful attachments or links), phishing (messages that trick people into giving up credentials or money) and spoofing (mail forging a sender's address).

Most filtering is inbound: mail arriving from the internet. Some services also filter outbound mail, so a compromised account can't spray spam from your domain.

You almost certainly have one already. Microsoft says its built-in protection is "included in all organizations with cloud mailboxes" (Microsoft Learn), and Google says "more than 99.9% of spam, phishing attempts, and malware are automatically blocked in Gmail" (Google Workspace). That's Google's own figure. The buying question is whether a separate service adds something you need.

Email filtering service vs spam filter vs secure email gateway: what's the difference?

These three terms overlap, and vendors use them loosely. A spam filter is one function, an email filtering service is a product that bundles several functions, and a secure email gateway is one way of deploying that product.

When you compare products, ignore the label and ask where it sits in the mail flow and which checks it runs.

What are the types of email filtering service?

There are five common types of email filtering service. They differ in where they sit in the mail flow, which changes what they can see.

The hosted MX type is also called a secure email gateway; our guide to what a secure email gateway is explains it in depth. For the API model, Microsoft notes that this integration "typically requires granting the non-Microsoft service full access to mailboxes" (Microsoft Learn). The trade-offs between the two are covered in secure email gateway vs API email security, and self-hosted options in hosted vs on-premise spam filters.

How does a hosted email filtering service work?

A hosted email filtering service works by receiving your mail first. You change your domain's MX records, which tell other servers where to deliver mail for your domain (RFC 5321), to point at the service. The service filters each message and relays the clean ones to your mail server.

Sender's server  ->  Filtering service (MX)  ->  Your mail server  ->  User's inbox
                         |
                         +-> Quarantine (held mail, user digests)

Your mail platform must be told about the extra hop. Microsoft 365 uses an inbound Partner connector with Enhanced Filtering for Connectors; Microsoft says that failing to enable it (or, as its less recommended alternative, to bypass spam filtering with a mail flow rule) "inevitably results in misclassification" of inbound mail (Microsoft Learn). Google Workspace uses its inbound gateway setting. Read what an MX record is if the DNS side is new to you.

What does a filter add to a message?

Filters record their verdict in message headers so you can see what happened. Here is an example of the kind of header a filtering service might add, alongside the standard authentication results (example values only; X-Filter-Verdict is an illustrative name, not a real header, and each service uses its own header names):

Authentication-Results: filter.example.net;
       spf=pass smtp.mailfrom=invoices.example.com;
       dkim=pass header.d=example.com;
       dmarc=pass header.from=example.com
X-Filter-Verdict: clean; score=1.2; threshold=5.0

DMARC, defined in RFC 9989, checks that the domain in the visible From address is authenticated by an aligned SPF or DKIM result. Paste any header into the Email Header Analyzer to read it, and see how spam filters work for the checks behind the score.

What should an email filtering service include?

An email filtering service for a business should include more than a spam score. Use this checklist when you compare options:

1. Spam, malware and phishing filtering, with spoofing protection based on SPF, DKIM and DMARC.
2. A quarantine users can manage, with digest emails so false positives get released quickly.
3. Allow and block lists that resist spoofing, ideally requiring sender verification for allowed senders.
4. Attachment controls: file-type rules and Office macro handling.
5. Outage protection: mail held while your server is unreachable, and how long.
6. Message history so you can answer "did this email arrive?".
7. Outbound filtering if you want to catch compromised accounts.
8. Clear limits: message volume, maximum message size, number of domains.
9. Data handling: where mail is processed and how long it's kept.
10. A rollback path: documented steps to put your MX back.

Our vendor-neutral checklist for choosing a spam filter turns these into questions to ask, and the spam filter trial checklist shows how to test one fairly.

What happens when an email filtering service gets it wrong?

Every email filtering service makes two kinds of mistake. A false positive is a real message held or rejected, such as a customer's order stuck in quarantine. A false negative is a bad message delivered, such as a phish in the inbox. Tuning one way increases the other, so the way a service handles mistakes matters as much as its detection rate.

Good handling looks like this:

• Users can see and release their own held mail, with a digest so they don't have to go looking.
• Releasing a message offers to allow that sender, but allow rules still check that the sender is genuine, so a spoofer can't ride on them.
• Admins can search message history to prove whether a message arrived, was held or was rejected, and why.
• There's a simple way to report a missed phish, and someone acts on reports.

If a legitimate sender keeps being held, the cause is often its own SPF, DKIM or DMARC setup. Our guide to legitimate email flagged as spam covers the fixes.

How much does an email filtering service cost?

Email filtering services are usually priced per user (per mailbox) or per domain. The model matters more than the headline number.

Per-domain pricing has its own limits to read, such as monthly message volume. For example, iBlockSpam's beta pricing is $12 per domain per month billed annually or $15 month-to-month, with unlimited mailboxes (a mailbox count, not unlimited message volume) and 100,000 inbound messages a month included per domain. See pricing and the per-domain vs per-user comparison. For the full cost picture, including admin time, read how much email security costs a small business.

Do you need a separate email filtering service?

You need a separate email filtering service only if your built-in filtering leaves a gap you can point to. Common reasons:

• Your mail runs on cPanel or another host with basic filtering. See external spam filtering for cPanel.
• You manage domains on several platforms and want one policy.
• Users don't check Junk or quarantine, and you want digests.
• You can't afford to lose mail when your server or connector fails.
• Per-user add-on prices are climbing because of shared mailboxes.

If you're on Microsoft 365 or Google Workspace, check what you already have first: do you need a spam filter with Microsoft 365 and is Google Workspace's spam filter enough answer that for each platform. Whatever you choose, it should sit on top of SPF, DKIM and DMARC for your own domains.

Next steps

• See where your mail is filtered today with the MX Lookup.
• Check your sending reputation with the Blacklist Checker and your records with the Email Health Check.
• Write down the one or two gaps you actually have before you compare products.
• If you're a small business weighing a hosted filter, the small business page shows what iBlockSpam covers.

Browse our other guides on choosing email protection.