Google Workspace

Email security in front of Google Workspace

MailThreatZero sits at your MX record and scans inbound mail before Gmail accepts it. Your Workspace account, your users and your licensing stay as they are.

Priced per protected domain, not per user. Adding staff does not add to the bill.

What actually changes

Your MX record points at mt0.mailthreatzero.com instead of at Google's mail servers. Mail arrives here first.
An inbound gateway entry in the Google Admin console tells Gmail that mail from the gateway is legitimate, and to read the original sender from the message rather than treating us as the sender.
Direct delivery is refused, so nobody can hand mail to Google around the filter.

Nothing is installed and no mailbox moves. The console generates each of these with your own values filled in when you connect a domain.

The setting that decides whether this works

Gmail's Inbound gateway setting is the Google equivalent of Microsoft's Enhanced Filtering, and getting it wrong has the same consequence.

Without it

Gmail sees every message as coming from the gateway. SPF is evaluated against us rather than against the real sender, so it fails for nearly everything and DMARC fails with it. Legitimate mail starts landing in spam and the authentication results in your reports become meaningless.

With it

Gmail looks past the gateway to the true source, authentication is evaluated against the sender who actually sent the message, and both filters see the same thing. This is the configuration the setup guide produces.

Why per-domain matters on Workspace

Google licenses per user. So does most of what is sold alongside it. MailThreatZero charges for the domain: $39 per protected domain per month for for every account, with up to 250 mailboxes per protected domain.

A ten-person customer and a hundred-person customer cost an MSP the same to protect, which is the only way a per-customer price stays predictable. Rates and a calculator.

What we use the Google APIs for — and what we do not

Mail does not travel through the Gmail API. It arrives over SMTP and leaves over SMTP. The APIs are used for three things, each one authorized by you through domain-wide delegation:

Verifying your setup before cutover: Confirming the inbound gateway and routing are right before the MX record moves.
Finding and removing delivered copies: Searching for every copy of a message that turned out to be malicious after delivery, and moving them out. A separate scope from reading, granted separately.
Account risk telemetry: Google's login audit — suspicious sign-ins, leaked-password lockouts, government-attack warnings — and Gmail forwarding settings and filters that send mail to an outside address. Read-only, off until you turn it on per domain.

Domain-wide delegation is account-wide by construction: a service account authorized for these scopes can act on any mailbox in the Workspace account. Google provides no per-mailbox restriction equivalent to Exchange Online's application access policy. That is Google's design, not our choice, and you should know it before granting anything.

Post-delivery removal against a live Workspace account is implemented and tested against the API, but has not yet been exercised on a production customer account.

Trying it without switching anything

Monitor Mode runs the full pipeline on one domain's real traffic and records what it would have done, changing no deliveries. You end up comparing verdicts on your own mail instead of reading somebody's numbers.

Talk to us about a trial domain See where the APIs sit