v2.65.812026-10-07
Domain reputation findings now show the exact DNS records to fix them.
Added
- Each Domain Reputation finding with a DNS remedy shows the record to publish, with its name, type and value and a copy button: SPF built only from senders actually seen, your own DMARC record with just the faulty tag changed, MX, TLS-RPT, MTA-STS (the record and the policy file), and reverse DNS for a sending IP.
- Platform administrators have one settings page for every provider that needs a key, a licence or a connection, including the DNS blocklists used to judge inbound senders. A blocklist is only enabled after its own test entry answers.
v2.65.782026-10-07
Google Postmaster Tools can be connected to Domain Reputation.
Added
- Google's sender-requirement verdicts and daily Gmail statistics for your protected domains, shown in Google's own words. Google no longer publishes a domain reputation score, so none is shown. Needs a Google account connected by the platform operator and each domain verified in it. Beta testing
v2.65.772026-10-06
Protected domain reputation monitoring.
Added
- Every protected domain is checked about every six hours for how the outside world sees it: blocklist status of its own sending servers, SPF, DKIM and DMARC health, receivers' DMARC reports, registration, and mail-security DNS. The history is kept, every change in the score is explained, and alerts are sent once per change. A source that cannot be checked is shown as unknown, never as clean.
v2.65.692026-09-30
Authentication results are reported against the right domain.
Fixed
- The authentication result added to delivered mail now names the domain in the message's From address, SPF is evaluated against the server that actually connected, and a domain's strict DKIM alignment setting is honoured.
v2.65.682026-09-30
A document with a dangerous macro is no longer delivered because the macro was removed.
Fixed
- When content disarm removed a macro from an Office document, the other reasons to hold the message were being discarded with it. A message is now held if anything other than the removed content still warrants it, and every disarm decision is recorded.
v2.65.672026-09-30
Rejected mail is no longer bounced to a forged sender.
Changed
- A message rejected after acceptance because of what it contained is now discarded and recorded, instead of generating a bounce to a sender address that is usually forged. Configuration refusals and genuine delivery failures still bounce.
v2.65.652026-09-29
Attachments are judged by what they contain, including inside archives.
Fixed
- PDFs with JavaScript, HTML files that redirect on opening, and macro documents inside archives are now scored on their contents, and a file that could not be read says so rather than passing. A message claiming to come from the recipient's own domain must authenticate.
v2.65.612026-09-26
A link that points where it says no longer counts as a mismatch.
Fixed
- A link whose visible text is its own address was scored as if the text and the destination disagreed, which could hold legitimate mail. The comparison now reads the address correctly.
v2.65.602026-09-26
Lookalike sender domains in international characters are scored.
Fixed
- A sender domain written in international characters to imitate a familiar name, such as a Cyrillic spelling of a well-known brand, is now scored, including when it authenticates.
- A Reply-To on the recipient's own domain is no longer ignored because the sender authenticated: authentication proves who sent the message, not where replies should go.
v2.65.532026-09-24
One authentication failure is no longer counted three times.
Fixed
- A message that did not authenticate was charged for SPF, for DKIM and again for the DMARC failure those two caused. The score now counts the larger of the two, not both. Replayed over 30 days of real mail, one message changed outcome: a legitimate message that had been held.
v2.65.502026-09-24
A real sender is no longer flagged as a lookalike of itself.
Fixed
- Lookalike detection could penalise a genuine correspondent for resembling a similar domain you also receive mail from. A domain you really correspond with is now never scored as an imitation.
v2.65.472026-09-23
A DNS outage no longer counts as an authentication pass.
Fixed
- When DNS could not be reached, authentication was reported as passing, which relaxed several impersonation checks. It is now reported as a temporary error, which neither passes nor fails a sender, and lookups no longer depend on a single resolver.
v2.65.462026-09-22
Recipients can report delivered mail as spam.
Added
- An optional footer link lets a recipient report a delivered message as spam, feeding training and triage. Off until it is switched on for a domain.
v2.65.402026-09-20
The public threat intelligence map shows data.
Added
- The threat map now draws from this gateway's own observations and the Tor Project's exit list, chosen after reading each feed's licence. Other feeds stay off until their terms allow publishing. Beta
v2.63.02026-09-15
Password reset links work once.
Fixed
- A password reset link could be used more than once while it was valid, including after the password had been reset. Each link now works exactly once.
v2.61.752026-09-12
Preview a policy change before applying it.
Added
- A proposed attachment policy can be replayed against a domain's recent mail to show what would change, with the rule responsible named, before it is applied. A guided evaluation report summarises a Monitor Mode trial.
v2.60.72026-09-03
Links that point straight at an IP address are checked again, against the right lists.
Added
- A link pointing at a bare IP address rather than a name is now checked against the IP reputation lists. What a listing means for somebody about to click is not what it means for mail, so the lists are read accordingly: an address known to be a compromised machine or part of a hijacked network block is treated as dangerous, one merely known for sending spam is recorded but never blocks a click, and a listing that only says an address should not be sending mail directly is ignored here entirely - it says nothing about a web link, and acting on it would flag ordinary self-hosted services.
Fixed
- The mail scanner knew two of the four codes an IP list uses to report a bad query and would have counted the other two as listings. All four are now read from a single shared table, so the mail path and the link checker cannot disagree about what an error looks like.
v2.60.62026-09-03
Incidents now say what they are in plain words, and dismissing one makes it stay dismissed.
Fixed
- A domain blocklist was being asked about IP addresses. It answers such a query with a refusal code, and the gateway read that refusal as a listing - raising a high-severity incident against an address that was never listed at all. Domain blocklists are no longer asked about IP addresses, their error codes are now read for what they are, and an answer the gateway does not know is now treated as no evidence rather than as a threat.
- Marking an incident a false positive now stays marked. The nightly link re-check deliberately ignores closed incidents so that a host going bad again is still noticed, and the side effect was that a dismissed incident came straight back. Dismissed hosts are now remembered per customer, listed on their own tab with the reason and who decided it, and can be undone at any time.
Added
- Every incident now opens with a short plain-English explanation: what happened, why it matters, whether the reason it was raised is still true, and the one thing to do next. Whether the evidence still holds is shown separately from how severe the incident was when raised, because the two often disagree - a listing withdrawn overnight is common for the shared tracking hosts that email services use, and that is a reason to close an incident rather than pull mail out of people's mailboxes.
v2.59.232026-08-26
DNS checks now say which records are yours to create and which are ours.
Fixed
- A DNS finding about the gateway's own signing key was shown against every protected domain as though the domain owner had to act on it. The record lives in our DNS, not yours. Findings now state who publishes each record, and one that is ours no longer marks your domain as needing changes.
v2.59.212026-08-25
ARC sealing is described by what it is doing, not by what it will do once configured.
Fixed
- The site said the gateway seals its authentication result with ARC. It stamps the result on every message and strips any forged Authentication-Results header, both of which were accurate - but sealing does not begin until the ARC public key is published in DNS, and the gateway will not sign with a key it cannot resolve. The wording now says so.
v2.59.112026-08-25
Reporting a quarantined message as spam now teaches your own filter.
Fixed
- The “report as spam” link in a quarantine digest recorded the report and notified your administrator, but did not add the message to your organization's Bayesian corpus. It does now. Training stays within your organization - one customer's decisions never affect another's filtering.The classifier begins contributing to scores once a corpus has enough confirmed samples; until then it is accumulating.
v2.59.62026-08-25
The contact form works without JavaScript.
Fixed
- The contact form previously did nothing unless the page's script had loaded and run, so a visitor with JavaScript blocked lost whatever they typed. It is now an ordinary form that submits on its own, with server-side validation and its own confirmation and error pages.
v2.59.22026-08-24
The console tells you when your browser tab is running an old version.
Improved
- Each release replaces the console's code, so a tab left open across an update can be running something that no longer exists on the server - which showed up as a page that simply stopped working. The console now checks on focus and periodically, shows the version it is actually running, and offers to reload.
v2.59.12026-08-24
Releasing or deleting a message from a quarantine email now updates its record.
Fixed
- Release, delete, allow-list and block actions taken from the links in a quarantine notification updated the held message but not the message's own tracking record, so a message released weeks earlier could still read as quarantined in message tracking. All four actions now update both.
v2.58.02026-08-24
Pricing is per protected domain, with up to 250 receiving addresses included on each.
New
- One published schedule for every account, by the number of protected domains: $39 per domain for 1–39, $37 for 40–99, $35 for 100–249, and custom pricing at 250 and above. The rate for your tier applies to every domain you protect, not only to the ones above the threshold. Each protected domain includes up to 250 receiving addresses; aliases and shared addresses count.Accounts on an earlier rate card keep it; a published change does not move an existing account onto new rates.
v2.26.12026-08-14
Support for behavioral attachment analysis on an analysis host you run yourself.
New
- Behavioral attachment analysis on your own hardware. MailThreatZero can now use a CAPE analysis host that you operate, and read the behavioral evidence it produces into the same explainable score as every other engine. Nothing is sent to a third-party service. Requires setupNo behavioral analysis is performed until you build and configure an analysis host - it needs virtualization and licensed guest software. Until then, attachment checks continue to use the existing reputation and static engines.
- Connection test reports whether the analysis host is reachable and whether it actually has analysis machines available - a host that is running but has no guests registered is reported as a fault rather than as success. Requires setup
v2.25.02026-08-14
Recovery codes for two-factor sign-in, and a tuning change that stops legitimate commercial mail sitting near the quarantine line.
New
- Two-factor recovery codes. Ten single-use codes are issued when you enable two-factor authentication, so losing your authenticator app no longer means losing access to the console. Codes are stored hashed and each works once.
Improved
- Reduced the weight of an antivirus link heuristic that fires on ordinary click-tracked marketing links. It was scoring legitimate commercial mail close to the quarantine threshold without ever having identified a genuine phishing message.
v2.24.02026-08-14
AI scanning model chosen by measurement against real mail, and two false-positive sources removed.
Improved
- The optional AI analysis stage now runs on a model selected by replaying this platform's own delivered and quarantined mail through several candidates, rather than by price or headline capability.
- Malware scanning no longer reports an antivirus link heuristic a second time as a malware detection. The same signal was being counted twice, once at malware severity.
Fixed
- Saving AI settings no longer clears the selected model, and the console now shows which model is in use.
v2.23.02026-08-13
Real AI cost reporting, measured per message.
New
- AI cost reporting. Every AI call records the token counts the provider itself returned, broken down by model, by domain and by day. Costs are estimated from a published rate card shown on the same page, so any figure can be checked by hand.
v2.22.02026-08-13
Payment and invoice fraud detection.
New
- Vendor and payment fraud detection. Watches for bank-detail changes, invoice redirection and lookalike supplier domains, and requires corroboration from another engine before it can act - so a supplier's genuine invoice is not held on wording alone.
v2.21.02026-08-13
Single sign-on for the console.
New
- Single sign-on through Microsoft Entra ID, Google Workspace or any conformant OpenID Connect provider. Roles stay under your control here - an identity provider authenticates a person, it cannot grant a permission.
