v2.60.72026-09-03
Links that point straight at an IP address are checked again, against the right lists.
Added
- A link pointing at a bare IP address rather than a name is now checked against the IP reputation lists. What a listing means for somebody about to click is not what it means for mail, so the lists are read accordingly: an address known to be a compromised machine or part of a hijacked network block is treated as dangerous, one merely known for sending spam is recorded but never blocks a click, and a listing that only says an address should not be sending mail directly is ignored here entirely - it says nothing about a web link, and acting on it would flag ordinary self-hosted services.
Fixed
- The mail scanner knew two of the four codes an IP list uses to report a bad query and would have counted the other two as listings. All four are now read from a single shared table, so the mail path and the link checker cannot disagree about what an error looks like.
v2.60.62026-09-03
Incidents now say what they are in plain words, and dismissing one makes it stay dismissed.
Fixed
- A domain blocklist was being asked about IP addresses. It answers such a query with a refusal code, and the gateway read that refusal as a listing - raising a high-severity incident against an address that was never listed at all. Domain blocklists are no longer asked about IP addresses, their error codes are now read for what they are, and an answer the gateway does not know is now treated as no evidence rather than as a threat.
- Marking an incident a false positive now stays marked. The nightly link re-check deliberately ignores closed incidents so that a host going bad again is still noticed, and the side effect was that a dismissed incident came straight back. Dismissed hosts are now remembered per customer, listed on their own tab with the reason and who decided it, and can be undone at any time.
Added
- Every incident now opens with a short plain-English explanation: what happened, why it matters, whether the reason it was raised is still true, and the one thing to do next. Whether the evidence still holds is shown separately from how severe the incident was when raised, because the two often disagree - a listing withdrawn overnight is common for the shared tracking hosts that email services use, and that is a reason to close an incident rather than pull mail out of people's mailboxes.
v2.59.232026-08-26
DNS checks now say which records are yours to create and which are ours.
Fixed
- A DNS finding about the gateway's own signing key was shown against every protected domain as though the domain owner had to act on it. The record lives in our DNS, not yours. Findings now state who publishes each record, and one that is ours no longer marks your domain as needing changes.
v2.59.212026-08-25
ARC sealing is described by what it is doing, not by what it will do once configured.
Fixed
- The site said the gateway seals its authentication result with ARC. It stamps the result on every message and strips any forged Authentication-Results header, both of which were accurate - but sealing does not begin until the ARC public key is published in DNS, and the gateway will not sign with a key it cannot resolve. The wording now says so.
v2.59.112026-08-25
Reporting a quarantined message as spam now teaches your own filter.
Fixed
- The “report as spam” link in a quarantine digest recorded the report and notified your administrator, but did not add the message to your organization's Bayesian corpus. It does now. Training stays within your organization - one customer's decisions never affect another's filtering.The classifier begins contributing to scores once a corpus has enough confirmed samples; until then it is accumulating.
v2.59.62026-08-25
The contact form works without JavaScript.
Fixed
- The contact form previously did nothing unless the page's script had loaded and run, so a visitor with JavaScript blocked lost whatever they typed. It is now an ordinary form that submits on its own, with server-side validation and its own confirmation and error pages.
v2.59.22026-08-24
The console tells you when your browser tab is running an old version.
Improved
- Each release replaces the console's code, so a tab left open across an update can be running something that no longer exists on the server - which showed up as a page that simply stopped working. The console now checks on focus and periodically, shows the version it is actually running, and offers to reload.
v2.59.12026-08-24
Releasing or deleting a message from a quarantine email now updates its record.
Fixed
- Release, delete, allow-list and block actions taken from the links in a quarantine notification updated the held message but not the message's own tracking record, so a message released weeks earlier could still read as quarantined in message tracking. All four actions now update both.
v2.58.02026-08-24
Pricing is per protected domain, with 250 mailboxes included on each.
New
- One published schedule for every account, by the number of protected domains: $39 per domain for 1–39, $37 for 40–99, $35 for 100–249, and custom pricing at 250 and above. The rate for your tier applies to every domain you protect, not only to the ones above the threshold. Each protected domain includes up to 250 mailboxes.Accounts on an earlier rate card keep it; a published change does not move an existing account onto new rates.
v2.26.12026-08-14
Support for behavioral attachment analysis on an analysis host you run yourself.
New
- Behavioral attachment analysis on your own hardware. MailThreatZero can now use a CAPE analysis host that you operate, and read the behavioral evidence it produces into the same explainable score as every other engine. Nothing is sent to a third-party service. Requires setupNo behavioral analysis is performed until you build and configure an analysis host - it needs virtualization and licensed guest software. Until then, attachment checks continue to use the existing reputation and static engines.
- Connection test reports whether the analysis host is reachable and whether it actually has analysis machines available - a host that is running but has no guests registered is reported as a fault rather than as success. Requires setup
v2.25.02026-08-14
Recovery codes for two-factor sign-in, and a tuning change that stops legitimate commercial mail sitting near the quarantine line.
New
- Two-factor recovery codes. Ten single-use codes are issued when you enable two-factor authentication, so losing your authenticator app no longer means losing access to the console. Codes are stored hashed and each works once.
Improved
- Reduced the weight of an antivirus link heuristic that fires on ordinary click-tracked marketing links. It was scoring legitimate commercial mail close to the quarantine threshold without ever having identified a genuine phishing message.
v2.24.02026-08-14
AI scanning model chosen by measurement against real mail, and two false-positive sources removed.
Improved
- The optional AI analysis stage now runs on a model selected by replaying this platform's own delivered and quarantined mail through several candidates, rather than by price or headline capability.
- Malware scanning no longer reports an antivirus link heuristic a second time as a malware detection. The same signal was being counted twice, once at malware severity.
Fixed
- Saving AI settings no longer clears the selected model, and the console now shows which model is in use.
v2.23.02026-08-13
Real AI cost reporting, measured per message.
New
- AI cost reporting. Every AI call records the token counts the provider itself returned, broken down by model, by domain and by day. Costs are estimated from a published rate card shown on the same page, so any figure can be checked by hand.
v2.22.02026-08-13
Payment and invoice fraud detection.
New
- Vendor and payment fraud detection. Watches for bank-detail changes, invoice redirection and lookalike supplier domains, and requires corroboration from another engine before it can act - so a supplier's genuine invoice is not held on wording alone.
v2.21.02026-08-13
Single sign-on for the console.
New
- Single sign-on through Microsoft Entra ID, Google Workspace or any conformant OpenID Connect provider. Roles stay under your control here - an identity provider authenticates a person, it cannot grant a permission.
