Feature status
What is available today
What is generally available today, what is in beta or beta testing, what requires setup, and what is not built, so you can plan a deployment around the real status of each capability.
How to read this
- Generally available Works end to end today.
- Beta testing Built and covered by tests against the provider's recorded or published API behavior, but not yet verified against a live customer account or tenant, so it is not offered as a capability today.
- Beta Built and off by default. When switched on it reports rather than acts, so you can see what it would have done before it does anything. Distinct from beta testing, which is built and being proven against a provider's platform but not yet verified against a live customer account, and is not offered.
- Requires setup Works, but needs infrastructure or credentials you provide.
- Not built Not implemented, and not represented as available anywhere. No date is given unless one is committed.
Prevent
- Inbound MX gateway filteringGenerally availableDeployment requiredInbound mail is filtered at the gateway before it reaches your mail platform.
- Spam, phishing and malware scanning (multiple independent engines)Generally availableIncludedAntivirus, spam analysis, content and phishing checks each contribute to one weighted score.
- BEC and impersonation detectionGenerally availableOptionalLookalikes of your own domain and your suppliers' domains, and display names of named people.
- Payment and invoice fraud detectionBetaOptionalPayment and account-change requests, scored only when something about the sender corroborates them.Off by default, and monitor-only when first switched on. Payment language alone scores nothing, however much of it there is — a finance team discusses invoices, and that is what a finance team does. It scores only when the language is corroborated by something about the sender: no correspondence history with that person, a near-miss of a domain you really deal with, authentication that failed, a reply that would go somewhere else. One corroborating signal is a suspicion; two is a finding, and the finding names which. It is offered as beta until it has been validated against real payment-fraud traffic, and starting monitor-only lets you confirm it leaves ordinary finance mail alone before it acts.
- QR-code phishing detectionGenerally availableOptionalQR codes in message bodies and attachments are decoded and judged on where they lead.
- SPF, DKIM, DMARC and ARC evaluationGenerally availableIncludedCryptographic DKIM verification, SPF and DMARC policy applied as published, and ARC sealing of the verdict.
- Link protection and delayed URL re-analysisGenerally availableOptionalLinks are assessed at delivery and re-checked for a week after; rewriting adds a check at the click.
- Static and structural attachment analysisGenerally availableIncludedSignature scanning, document and macro analysis, archive inspection and attachment-type policy.
- Behavioral attachment analysis (VirusTotal, Joe Sandbox, or a self-hosted CAPE host)Requires setup — requires a VirusTotal or Joe Sandbox account you supply, or a CAPE host you operateExternal serviceHash lookups and optional detonation on a VirusTotal or Joe Sandbox account you hold, or a CAPE host you run.Off by default. Runs on a provider account you supply or a CAPE analysis host you operate — MailThreatZero does not offer detonation as a hosted service. Behavioral evidence feeds the same explainable score as every other engine.
- Content disarm and reconstruction (CDR)Generally availableOptionalRebuild Office and PDF attachments without their macros, scripts and embedded files, and hold the original.Office documents (docx, xlsx, pptx and their macro-enabled forms) are rebuilt without the VBA project; PDFs lose document JavaScript, automatic actions, launch actions and embedded files, with pages, text and images kept. The original is held in quarantine for retrieval. A file that cannot be rebuilt confidently is held, not passed: legacy .doc and .xls are never rebuilt. A message is delivered rebuilt only when the rest of its evidence would have delivered it; every rebuild is recorded and shown in message tracking. Two modes: rebuild documents that look suspicious, or every supported document.
- Inbound sender IP reputation (DNS blocklists)Generally availableIncludedFor mail sent to you: the connecting IP is checked against DNS blocklists. When scoring, each listing is read by what its return code means; at connection time, a listing on one of the refusing lists is refused whatever its code.
- Country and network (ASN) policyGenerally availableOptionalRaise the score of mail from countries or networks you choose, per domain.A listed country adds 5 points to a message's score and a listed network adds 3. That can be enough to quarantine a message at a domain's threshold, but on its own it never rejects one: it is evidence in the score, not a block. Allow lists are recorded and shown, but do not exempt anything.
- Header and sender analysisGenerally availableIncludedFor mail sent to you: display-name spoofing, Reply-To mismatches, lookalike-domain and brand-impersonation checks on message headers.
- Homograph (IDN) domain detectionGenerally availableIncludedInternationalised domain names whose decoded form is confusable with a familiar ASCII name.
- Warning banners on delivered mailGenerally availableOptionalOne banner per message for the most serious reason it qualified; signed and encrypted mail is never modified.
- Per-domain allow and block listsGenerally availableIncludedAllow and block senders per domain; an allow entry never overrides a malware verdict.
- Custom policy rulesGenerally availableOptionalDeterministic rules on sender, content and authentication that force an outcome, with an audit trail.
Detect
- Campaign correlation across a tenantGenerally availableIncludedOne message opens every other message from the same sender, lure or link across the tenant.
- Explainable per-message scoringGenerally availableIncludedEvery engine's raw and weighted score and what it found, against the threshold that decided the action.
- Monitor Mode on real trafficGenerally availableOptionalScore and record every message while delivering it anyway, to tune a domain's policy on its real traffic.
- Outbound behavioral anomaly detectionGenerally availableDeployment requiredSending volume, sudden new recipients and outbound phishing, each compared with the account's own history.
- Account-takeover risk from Microsoft and Google identity telemetryBeta testingIntegration requiredSign-in risk from Microsoft and Google identity telemetry, alongside the gateway's own sending-behavior signals.Coverage depends on your provider licence - sign-in risk signals are not available on every plan. Not yet verified against a live customer tenant; the gateway-side sending-behavior detection it complements is generally available and is listed separately.
- User-reported phishing triageRequires setup — requires a connected tenant, for removing matching copies from other mailboxesIntegration requiredReported messages are triaged and correlated into campaigns; matching copies can be removed from mailboxes.Reporting, triage and campaign correlation work on the gateway alone. Removing matching copies from other mailboxes requires a connected tenant.
- DMARC aggregate report analysisGenerally availableOptionalReceivers' DMARC reports are ingested per domain and alert on unauthorized senders, new sources and missing reports.
- Daily DNS health checksGenerally availableIncludedMX, SPF, DKIM and DMARC re-checked daily, with a ready-to-paste fix for anything that drifts.
- Live mail flow and SMTP refusalsGenerally availableIncludedMail arriving right now, and the connections refused before a message was accepted, with the reason.
- Shared threat intelligence mapBetaIncludedAttack sources seen across the platform, shared as counts with no customer identities.Public map of senders and infrastructure seen attacking protected domains, from the gateway's own observations and published open feeds. Public now, and labelled beta while its data sources are broadened.
Respond
- Message tracking and threat huntingGenerally availableIncludedFind any message by sender, recipient, subject or Message-ID, with its exact recipients and every decision.
- Quarantine, release and end-user digestsGenerally availableIncludedHeld mail with its reasons, release and delete workflows, and digests recipients can act on themselves.
- Mailbox lookup in Microsoft 365 and Google WorkspaceBeta testingIntegration requiredFind copies of a delivered message in recipients' mailboxes.Built against the Microsoft Graph and Google Directory APIs and covered by tests, and in beta testing until it has run against a live customer tenant.
- Post-delivery removal with verificationBeta testingIntegration requiredMove delivered copies to a recoverable folder and read the result back per mailbox.Every action is a MOVE to a recoverable folder, never a delete, and the result is read back and reported per mailbox. Built and covered by tests against recorded Graph and Gmail behavior; not yet verified against a live customer tenant.
- Bulk campaign remediationBeta testingIntegration requiredHandle a confirmed campaign once, across every recipient, instead of message by message.Joins campaign detection to per-message remediation so one confirmed run is handled once. Built and tested; not yet verified against a live customer tenant.
- Automatic remediation policy and dry-run decision engineGenerally availableOptionalA per-domain policy decides which deterministic signals would qualify for removal, as a dry run.The DECISION, not the removal. A per-domain policy (off by default) states which deterministic signals qualify — a signature, a detonation, a confirmed hash, an administrator — and how large a batch may be handled without approval. AI, heuristics and reputation may contribute evidence but can never authorise removal alone. The policy screen on each domain, and the API, configure it and preview what it would decide about a piece of evidence, as a dry run that touches nothing. Execution is a separate capability, listed separately, and is not offered: nothing in this product removes delivered mail unattended.
- Automatic post-delivery remediation execution (unattended removal)Not builtRemoval of delivered mail without a person approving it.Not built, and deliberately so. The policy engine above decides; nothing acts on that decision without a person. Removal of delivered mail happens only through the mailbox integrations, one reviewed action at a time, and unattended execution will not be offered until it can be validated against a live tenant.
- Recipient spam reporting linkGenerally availableOptionalA footer link that lets a recipient report a delivered message as spam, feeding training and triage.
Protect data
- Outbound DLPGenerally availableDeployment requiredOutbound messages are inspected for sensitive data; a match is held for review rather than bounced.
- Email archivingGenerally availableAdd-onSearchable long-term retention of mail that passed through the gateway.
- WORM retentionGenerally availableAdd-onArchived messages under write-once retention enforced in the database, with daily hash-chain sealing.
- Emergency inbox and continuityGenerally availableOptionalAn emergency inbox keeps people reading and sending when their own mail platform is down.
- Legal hold (per message)Generally availableAdd-onA held message is never removed by retention expiry, and deletion requests against it are refused.A held message is never removed by retention expiry and its content is never collected while the hold stands; deletion requests against it are refused rather than silently ignored. Holds are placed per message with a reason and are audited. Holding a whole search result, a sender or a date range is not built — holds are placed one message at a time. Grouping them under a matter IS built: see eDiscovery cases.
- eDiscovery casesGenerally availableAdd-onGroup preserved messages under a named matter, recording who preserved each one and why.Cases group preserved messages under a named matter, recording who preserved each one and why. Adding a message places a legal hold that suspends deletion; closing the matter releases the holds that case alone was keeping, and a message another open case or a hand-placed hold still needs stays held. Driven from Archive & continuity > eDiscovery in the console, or through the API. Export is not built: the case lists what is preserved, and the messages are retrieved from the archive.
- Outbound review queueGenerally availableDeployment requiredYour own users' mail held on the way out, for an administrator to release or reject.
- Outbound TLS visibility and enforcementGenerally availableIncludedEvery outbound handshake recorded as trusted, untrusted or plaintext; TLS can then be required for a destination.
- Journal ingestion (internal mail capture)Beta testingDeployment requiredInternal user-to-user mail captured for the archive through your platform's journal rule.Built and tested: a journal rule on Microsoft 365 or Google Workspace can deliver internal user-to-user mail to a per-tenant journal address, and the report is unwrapped to the original message and its true recipients. The journal endpoint is not yet switched on for customers, so internal mail is not captured today; until it is, the archive holds mail that passed through the gateway.
Operate
- MSP multi-tenancy with per-domain policyGenerally availableIncludedEvery customer in one console, each tenant isolated, with policy set on the domain rather than the account.
- Up to 250 receiving addresses per protected domainGenerally availableIncludedPriced per protected domain, with up to 250 receiving addresses included per domain; aliases and shared addresses count toward the 250.
- Reporting and scheduled summariesGenerally availableOptionalPer-domain summaries by filter, scheduled weekly or monthly reports, and a platform summary for you.
- REST APIGenerally availableIncludedA REST API with scoped keys: domains, summaries, messages, quarantine and incidents, plus quarantine release.
- Webhooks and SIEM deliveryBeta testingOptionalSigned incident delivery to a SIEM as JSON, or to Slack or Microsoft Teams.Built and covered by tests; not yet delivered to a live customer SIEM, Slack or Teams endpoint.
- Single sign-on (OpenID Connect)Beta testingIntegration requiredConsole sign-in through your OpenID Connect identity provider.Built and covered by tests; not yet run against a live customer identity provider.
- Two-factor authentication with recovery codesGenerally availableIncludedTOTP two-factor sign-in with one-time recovery codes.
- Bring your own AI provider, and run without AI entirelyGenerally availableExternal serviceOptional AI analysis on your own OpenAI or Anthropic account, or no AI at all.
- SAML 2.0Not builtSAML 2.0 sign-in.
- SCIM provisioningBeta testingIntegration requiredYour identity provider creates and disables console accounts, so offboarding happens in one place.Built and covered by tests; not yet run against a live customer identity provider. An identity provider (Entra, Okta) creates and disables console accounts, so offboarding happens in one place. A tenant-scoped bearer token authenticates SCIM 2.0 at /scim/v2; what a provisioned user may do comes from the group-to-role mapping an operator configures, not from the directory. An unmapped group earns the lowest role and superadmin can never be granted this way. Tokens are issued and revoked from Settings > Directory Sync (SCIM), shown once, and stored hashed.
- Passkeys / WebAuthnGenerally availableIncludedPasswordless console sign-in with passkeys and hardware security keys.Passwordless console sign-in with WebAuthn. Every attestation and assertion signature is verified for real, challenges are server-issued and single-use, a person may enrol several authenticators, and an authenticator whose signature counter goes backwards — the signature of a cloned credential — is revoked rather than trusted. Enrol from My Profile; sign in with the passkey button on the login page. It is additive: it mints the ordinary session and never touches the password or TOTP path, which remain for anyone not enrolled. Nothing secret is stored, only public keys. Verified end to end in a browser with a software authenticator; not yet exercised with a hardware key.
- Protected domain reputation monitoring and historyGenerally availableIncludedMonitors your own protected domains, not inbound senders: how they look to the outside world, from sending-IP blocklist status, SPF, DKIM, DMARC and DNS health to registration and score history.Every protected domain is checked automatically about every six hours: its own sending IPs against SpamCop, Barracuda and PSBL, its SPF, DKIM and DMARC records, receivers' DMARC aggregate reports, its registration (RDAP) and its mail-security DNS. Each check is kept, so the page shows the score over 24 hours to 90 days and explains every change from the evidence. A source that cannot be checked is shown as Unknown, never as clean.
- Spamhaus, SURBL and Google Web Risk for protected domain reputationRequires setup — requires a Spamhaus DQS key, a licensed SURBL zone, or a Google Web Risk API keyExternal serviceSpamhaus, SURBL and Google Web Risk as additional sources for monitoring your own domains.Off until the platform operator supplies a Spamhaus DQS key, a licensed SURBL zone or a Google Web Risk API key. Spamhaus's and SURBL's free services exclude commercial filtering providers, and Google Safe Browsing is non-commercial only, so domain reputation monitoring queries none of them without one. Until then they are shown as unavailable and are never counted as checked.
- Google Postmaster Tools connectionBeta testingIntegration requiredGoogle's sender-requirement verdicts and daily Gmail statistics for your own domains, in Google's words.Built and covered by tests against Google's published v2 API schema; not yet run against a live Postmaster account. Google removed domain and IP reputation from Postmaster Tools, so this reports Google's sender-requirement compliance verdicts and daily Gmail statistics, in Google's words. It needs a Google Cloud OAuth client, a connected Google account, and each domain registered and DNS-verified in that account; only domains with enough mail to Gmail get data.
- Attachment policy presets with change previewGenerally availableIncludedNamed presets that show the exact before and after for every setting before they are applied.
- Administrator audit historyGenerally availableIncludedSign-ins, releases, allow-list changes, training decisions and settings changes, with the user, address and time.
- Delegated customer administrationGenerally availableIncludedDomain-administrator accounts scoped to a customer's own domains, so they review their own quarantine.
- Your branding on customer reports and digestsGenerally availableOptionalThe summaries and quarantine digests your customers receive carry your name, not ours.
- Continuous filtering pipeline validationGenerally availableIncludedEach scanning stage is exercised on a schedule with known test content, and a failure raises an alert.
Why this page exists
Every capability is labelled with its current status, so you can plan a rollout around what is generally available today and know in advance which parts are in beta or need setup.
Nothing here carries a date unless we have committed to one. Release notes record what actually shipped, and this page is updated for v2.65.110.