Google Workspace

Email security in front of Google Workspace

MailThreatZero sits at your MX record and scans inbound mail before Gmail accepts it. Your Workspace account, your users and your licensing stay as they are.

Priced per protected domain, not per user. Adding staff does not change the price while you stay within the included receiving-address allowance.

What actually changes

Your MX record points at mt0.mailthreatzero.com instead of at Google's mail servers. Mail arrives here first.
An inbound gateway entry in the Google Admin console tells Gmail that mail from the gateway is legitimate, and to read the original sender from the message rather than treating us as the sender.
Direct delivery is refused, so nobody can hand mail to Google around the filter.

Nothing is installed and no mailbox moves. The console generates each of these with your own values filled in when you connect a domain.

The setting that decides whether this works

Gmail's Inbound gateway setting is the Google equivalent of Microsoft's Enhanced Filtering, and getting it wrong has the same consequence.

Without it

Gmail sees every message as coming from the gateway. SPF is evaluated against us rather than against the real sender, so it fails for nearly everything and DMARC fails with it. Legitimate mail starts landing in spam and the authentication results in your reports become meaningless.

With it

Gmail looks past the gateway to the true source, authentication is evaluated against the sender who actually sent the message, and both filters see the same thing. This is the configuration the setup guide produces.

Why per-domain matters on Workspace

Google licenses per user. So does most of what is sold alongside it. MailThreatZero charges for the domain: from $39 per protected domain per month, on one rate card for every account, with up to 250 receiving addresses per protected domain.

A ten-person customer and a hundred-person customer cost an MSP the same to protect, which is the only way a per-customer price stays predictable. Rates and a calculator.

What we use the Google APIs for — and what we do not

Mail does not travel through the Gmail API. It arrives over SMTP and leaves over SMTP. The APIs are used for three things, each one authorized by you through domain-wide delegation:

Verifying your setup before cutover: Confirming the inbound gateway and routing are right before the MX record moves.
Finding and removing delivered copies Beta testing: Searching for every copy of a message that turned out to be malicious after delivery, and moving them out. A separate scope from reading, granted separately.
Account risk telemetry Beta testing: Google's login audit — suspicious sign-ins, leaked-password lockouts, government-attack warnings — and Gmail forwarding settings and filters that send mail to an outside address. Read-only, off until you turn it on per domain.

Domain-wide delegation is account-wide by construction: a service account authorized for these scopes can act on any mailbox in the Workspace account. Google provides no per-mailbox restriction equivalent to Exchange Online's application access policy. That is how Google's delegation model works, and it is worth weighing before granting anything.

Current status. Each of the three API uses above is built and covered by tests against a simulated Google API, and is not yet in use on a live customer Workspace account. The mail path is separate and is ordinary SMTP: domains protected today relay to customer-operated mail servers, and no production domain delivers through a Workspace inbound gateway yet, so a Workspace evaluation comes with a cut-over we work through with you.

Evaluating it on one Google Workspace domain

Monitor Mode runs the full pipeline on one domain’s real traffic and records what it would have done without enforcing the verdict. It is not a zero-change trial: the domain’s MX still points at the gateway, the Google Workspace inbound gateway entry still has to accept mail from it, and a few things still apply while it monitors. After a couple of weeks you are comparing verdicts on your own mail rather than reading anyone’s numbers.

As noted above, a Google Workspace evaluation comes with a cut-over we work through with you.

Request a Demo The one-domain evaluation checklist