MailThreatZero Beta

For MSPs and multi-domain organizations

Email security for every customer domain.

One console. Predictable pricing.

Protect customer email with explainable verdicts, investigate suspicious messages, and monitor your own domains' reputation from one console, priced per protected domain. Start in Monitor Mode to review every decision before enforcing anything.

Request a Demo Try the self-guided demo

From $39 per protected domain per month. Up to 250 receiving addresses per domain, aliases counted; volume rates from 40 domains. Month to month, no setup fee. See the rate card.

Illustrative example

Your account statement is ready Example Org Updates
Quarantined score 13 · held at 10
  • +9Imitation sign-in form
  • +3Credential request
  • +1Newly registered link destination
Show the full reasoning
  • Network and reputation+1Sending IP is clean. The link's destination host is newly registered.
  • Sender authentication+0SPF, DKIM and DMARC all pass and align. The sender really is who it says.
  • Malware and attachment analysisdid not runNo attachment to analyze.
  • Spam, phishing and content analysis+9One link redirects twice and lands on a credential form that imitates a sign-in page. The visible text and the destination disagree.
  • Optional AI analysis+3Enabled on this domain. Reads the message as a credential request from a brand the recipient does not otherwise correspond with.
Illustrative example, not a real customer message. Try the self-guided demo.

The product

See it working

Screens from the running product on demonstration data. The self-guided demo needs no form and no account.

The dashboard. Select any screenshot to enlarge it.
  1. 1Every service checked live
  2. 230-day volume and verdicts
  3. 3What was caught, by category

  • Message tracking

    Find any message and open the per-stage breakdown behind its verdict.

  • Quarantine

    Read held mail safely, then release or delete it, with the action recorded.

  • Live mail flow

    Watch mail move through the scanning stages as it arrives.

Open the self-guided demo How a message is scored

Watch the walkthrough video

Captions are shown in the recording. The full text follows.

Read walkthrough transcript (47 captions)
  1. MailThreatZero - a managed secure email gateway for MSPs and multi-domain organizations. This is the live console.
  2. One console for every domain you protect: volume, verdicts, and the health of the services behind the gateway.
  3. MailThreatZero evaluates mail through five core scanning stages: network and reputation, sender authentication, malware and attachment analysis, spam/phishing/content analysis, and optional AI analysis. Each stage may use one or more specialized engines or intelligence sources.
  4. Content, header, phishing, attachment and QR analysis are enabled per domain. Every enabled and applicable scanning stage runs for each message.
  5. Domains: one gateway, many tenants. Each domain carries its own relay, thresholds and filtering policy.
  6. Per-domain filtering: which engines run, and which optional analysis is switched on for this domain only.
  7. QR codes are read out of images, PDFs and Office attachments, and scored on where they lead.
  8. Attachment reputation runs on the customer's own VirusTotal account: hash reputation and multi-engine analysis, no markup.
  9. Impersonation protection covers what a brand list cannot: a near-miss of your own domain, of a supplier you actually deal with, or of a named person.
  10. Payment and account-change language never scores on its own - the people who write it all day are the finance team. It counts only when something independent corroborates it.
  11. Warning banners: one per message, never a stack. A warning that appears on everything is one nobody reads by the second week.
  12. Monitor Mode: messages are scored and recorded while delivery remains unchanged. Evaluate policy on real mail before enabling enforcement.
  13. Scoring is a number you own: quarantine at one score, reject at another, per domain.
  14. DMARC aggregate report ingestion is part of the product, switched on per domain.
  15. Retention, a write-once period the database itself will not let you shorten, and outbound inspection - all set per domain.
  16. Delegated access: a customer's own admin signs in and sees their domains, and nothing else.
  17. Quarantine: read the held message safely, then release or delete. Every release is recorded against the person who made it.
  18. Flagged for Review: a real mistake goes back into the classifier as ham or spam, and the decision is recorded.
  19. Campaigns: one run across many mailboxes is a single row here, not one row per message.
  20. Open the run and it lists the senders, the source IPs and every domain of yours it touched.
  21. Outbound Review: a message carrying regulated data is held for review, not bounced - bouncing destroys the evidence.
  22. Detected values are masked in the findings. The unmasked message stays on the gateway for an administrator to review.
  23. Archive: searchable per domain, with retention, legal hold, and search across message bodies and the text inside attachments.
  24. Message Tracking: every message that passed through, searchable by sender, recipient, subject or IP.
  25. Any message opens to the decision behind it: every stage, its own verdict, and what that stage actually found.
  26. Authentication is judged before content: SPF, DKIM, DMARC, and whether anything aligned with the From domain.
  27. Each stage shows its score and what it found - and a stage that did not run says so, instead of showing a green pass.
  28. And the arithmetic: each stage's weight, its contribution, and the total that crossed this domain's quarantine threshold.
  29. Filtering decides what happens on arrival. Incident Response is for afterwards - when something already delivered turns out to be an attack.
  30. Sweep on anything that has turned out to be malicious - a URL, a hostname, a file hash, a sender, or the campaign fingerprint - and find every message that carried it.
  31. Delivered is not the same as still in the mailbox. What the gateway did is ours to answer; whether a copy is still there is the mail platform's, and it is never guessed.
  32. Live Mail Flow: messages moving through the scanning stages as they arrive.
  33. Link Protection: a rewritten link is checked again at the moment it is clicked - so a link that was clean on arrival is still caught.
  34. Country rules, set per domain or once on the account and inherited by every domain under it.
  35. Countries are picked on a world map, not from a list of codes.
  36. DMARC: aggregate reports ingested and analyzed per domain - who is sending as you, how much of it aligns, and what your policy does.
  37. Alerts name the problem and the fix, per domain.
  38. Fuzzy Rules: your own conditions and your own score adjustments, platform-wide or for one domain.
  39. AI Bypass Rules: traffic you already trust skips the AI pass, so the spend goes on mail that needs judging.
  40. AI analysis is optional and bring-your-own-key: your provider, your credentials, a credit limit per tenant, and no markup.
  41. What the AI pass actually cost, by tenant and by day.
  42. Storage: retention is a plan you buy and allocate to domains, not a support ticket.
  43. Billing: a per-tenant statement an MSP can put straight onto its own invoice.
  44. Reports: volume, threats and per-domain breakdowns, exportable for whoever asks.
  45. Product documentation is maintained alongside the platform, so operating guidance stays aligned with the current release.
  46. About: the exact version running, and what it is built on.
  47. Managed secure email gateway for MSPs and multi-domain organizations. mailthreatzero.com

Evaluate it

Evaluate it on your mail, not our marketing

MailThreatZero can begin in Monitor Mode on a real domain. Messages are scored, analyzed and recorded while normal delivery continues. You can see what the gateway would have held, why it reached that decision, and whether the policy needs adjusting before enforcement begins.

What an MSP can verify on its own live mail

  • Classification quality. Whether legitimate mail is classified correctly, across the senders your customer actually receives from.
  • False positives and missed threats. The ones your team finds while reviewing the decisions: what would have been held that should not be, and what got through that should not have.
  • Explainable per-message verdicts. Which engines ran, what each found, and how the score compared with the domain’s threshold.
  • Domain reputation and authentication. SPF, DKIM, DMARC and blocklist findings for your customer’s own domains.
  • Quarantine and investigation workflows. What administrators would investigate, quarantine or release, and how a related campaign is traced.
  • Policy tuning before enforcement. Adjust thresholds and rules against real traffic, then switch the domain to enforcement when the results hold up. It relays over SMTP to Microsoft 365, Google Workspace or another mail server; the evaluation guide covers each, and what has been run in production.

No requirement to trust a benchmark. Review what it does with your own traffic.

Request a Demo Try the self-guided demo

Why MSPs look at MailThreatZero

Built around the things MSPs actually have to operate

  • Per-domain pricing

    Up to 250 receiving addresses per protected domain, under one domain price, instead of watching the security bill rise every time a customer adds another employee.

    How the pricing works

  • Explainable decisions

    See which engines ran, what each one found and exactly how the final score crossed the domain’s threshold.

    Explainable scoring

  • One console for every customer

    Every customer you manage under one sign-in. Policies, investigations, reporting and reputation monitoring stay scoped to each customer’s domains, and a customer can be given an administrator account for their own domain alone.

    Built for MSPs

  • Monitor before enforcing

    Evaluate decisions on real mail before asking a customer to trust a new gateway.

    How an evaluation runs

  • Your AI account, or no AI at all

    Optional AI analysis on your own OpenAI or Anthropic account, paid directly to the provider with no MailThreatZero markup. AI can also be turned off completely.

    How AI is used

  • Monitor your customers’ own domain reputation

    Track protected domains and sending infrastructure for authentication problems, blocklist changes and deliverability risks, not just the reputation of people sending mail to you.

    Protected domain reputation monitoring · See a sample report

Already have email security? The short case for adding MailThreatZero: a held message investigated step by step, a pricing example from the rate card, and when another approach fits better.

Why MailThreatZero? →

Features

A lot more than spam filtering

Filtering, investigation, response, outbound protection, retention and MSP operations, in one console.

Protect

Investigate and respond

MSP and operations

Data, compliance and mail flow

61 capabilities across filtering, investigation, response, compliance and MSP operations, each with its status published (2 in beta, 9 in beta testing and not yet offered); 2 more are listed as not built. Counts as of v2.65.110. Explore all features →

Deployment and evaluation

Try it on one real domain before you enforce anything

  1. Add the domain

    Tell the console where the domain's filtered mail should go. A setup check confirms the destination will accept it before anything moves.

  2. Point MX in Monitor Mode

    Mail is scored and recorded, then delivered as normal. Connection-time blocklist refusals are off for the domain, and a scanning failure can still delay a message.

  3. Review the decisions

    See what would have been held and why, tune the domain's policy, and read the evaluation report.

  4. Enforce when you are ready

    Switch the domain to enforcement. Nothing is installed at the customer's site, and their mail platform stays as it is.

Works in front of Microsoft 365, Google Workspace and other mail servers. Certain capabilities depend on mail-flow configuration or optional integrations.

Request a Demo The full mail path

Pricing

Priced per protected domain

Up to 250 receiving addresses per domain, aliases counted. The rate falls as your total number of protected domains grows, and it applies to every domain in the account.

  • Standard

    $39per protected domain / month

    1–39 domains

    Up to 250 receiving addresses per protected domain

    Organizations and service providers starting out

  • Volume

    $37per protected domain / month

    40–99 domains

    Up to 250 receiving addresses per protected domain

    Growing organizations and MSP portfolios

  • Portfolio

    $35per protected domain / month

    100–249 domains

    Up to 250 receiving addresses per protected domain

    Large multi-domain organizations and MSP portfolios

  • Custom pricing

    Quotedcontact us for a quote

    250+ domains

    Contact us for an organization or service-provider quote.

    Contact Us

One schedule for every account. The rate for your total protected-domain count applies to every domain in the account. At 250 domains and above, pricing is custom. Billed month to month, with no setup fee and no minimum term. The archive is a separate, optional add-on.

See Pricing Everything included with a protected domain

Who runs it

Built by a former MSP owner

Dewey Straughn, founder

Dewey founded his MSP in 1999, ran it for 24 years and sold it in 2023. That work spanned security, infrastructure, data centers and business applications.

MailThreatZero is built around problems that background makes familiar: licensing that grows with every hire, filtering decisions nobody can explain to a customer, and needing every customer in one place without their data mixing.

About us

Operator
MailThreatZero is operated by mspreboot.com.
Hosting
Infrastructure we operate, in the United States. Subprocessors
Support
Email support with every protected domain, from the people who run the gateway. Service-impacting issues are handled first.
Incidents
Incidents affecting your domains are communicated directly to the contacts on the account. Service status
Retention
Delivered message bodies 30 days, tracking records 90 days; quarantined mail until released or deleted; archived mail for its plan term. Full retention table
Encryption
TLS for mail with every server that supports it; the console and API are HTTPS only. Security
Backups
Two layers. Application backups of the database (including quarantined messages) and the archive store run nightly, encrypted, kept daily for two weeks and weekly for three months; these are kept on the gateway host. Off-host VM-level backups cover the whole server, and those backups are replicated. Backups are for recovery after a loss; they are not live failover.
Maturity
What is generally available, in beta or not built is published. Feature status · Release notes
Evidence
The self-run KnowBe4 assessment: what it tested and the results. Self-run KnowBe4 assessment
Version
Running v2.65.110, released 20 October 2026.

Questions

The things buyers ask

Does it replace Microsoft 365 or Google Workspace?

No. It sits in front of them. Mailboxes, users and licensing stay where they are; inbound mail is filtered before it reaches them. See Microsoft 365 and Google Workspace.

What counts toward the 250 addresses per domain?

Up to 250 receiving addresses per protected domain - per domain, not shared across the account. Each distinct address that receives mail counts once. Mailboxes, users, aliases, distribution addresses and shared mailboxes all count toward that 250, so several aliases that deliver into one mailbox are still separate addresses, and there is no per-user component. How the allowance works.

Can we evaluate it before enforcing anything?

Monitor Mode records how MailThreatZero would classify messages while allowing normal delivery. Review decisions, tune policy, and validate the fit before enabling enforcement. It needs MX pointed at the gateway, because it can only score mail it receives. That is the one change you make to start; nothing else about delivery changes. The one-domain evaluation checklist.

Does it use AI?

Optionally, on your own OpenAI or Anthropic account, billed by them with no markup. AI is one signal among several and can be switched off per domain. More.

What support is included?

Email support is included with every protected domain. Mail-flow interruptions, widespread false positives, and suspected security incidents receive priority handling. Support terms and response targets are provided with each service plan.

Is there a beta program?

Yes, for a limited number of organizations, with published rewards and terms. The Founding Beta Partner Program.

See how it would handle your mail.

Request a demo, or open the self-guided demo now.

Request a Demo Try the self-guided demo