For managed service providers
A multi-tenant secure email gateway for MSPs, priced per domain.
Per-user filtering costs climb every time a customer hires, and a “where is my email?” ticket turns into guesswork when the filter will not say why. MailThreatZero is a secure email gateway for every customer domain you manage: one console, a published per-domain price, and the evidence behind every verdict.
A demo request needs only your name and email. The self-guided demo needs nothing at all.
Why MSPs look at it
Three things that change for your service desk
-
A bill that ignores headcount
$39 per protected domain per month, falling to $37 at 40 domains and $35 at 100. Each domain includes up to 250 receiving addresses, aliases and shared mailboxes counted. A customer hiring ten people does not change your cost.
Per-domain or per-mailbox: which costs less for your portfolio
-
Verdicts you can show a customer
Every message records which stages ran, what each scored and which one pushed it over the domain’s threshold. Closing a disputed-email ticket means opening the record, not guessing.
-
Every customer in one console
Policy, quarantine, tracking and reporting for all your tenants under one sign-in, each scoped to its own domains. Give a customer an administrator account for their domain alone, and try any domain in Monitor Mode before enforcing.
See it
One message, explained
Message tracking from the running product, on demonstration data: every message any of your customers received, searchable, each opening to the per-stage breakdown behind its verdict.
Open the self-guided demo How a message is scored
The self-guided demo walks through four synthetic messages with their evidence and decisions. No form, no account, and nothing in it touches real mail.
Your next step
Pick the smallest step that answers your question
You do not need to apply for anything to see the product or talk to the people who build it.
Who builds it
Built by Dewey Straughn, who founded his MSP in 1999 and spent 24 years running it before selling in 2023. His background includes security, infrastructure, data centers, and building business applications. MailThreatZero is operated by MSP Reboot, and you talk to the people who build and run the gateway, not a reseller.
Current status: the gateway filters production mail every day, and every protected domain today relays to a customer-operated mail server. The Microsoft 365 and Google Workspace configurations follow each platform’s documented inbound settings but have not yet carried a production customer’s mail — details in the evaluation guide. Capabilities still in beta are labelled on the feature status page.
The detail
Pricing, console, reporting and deployment
Open whichever part you need.
Per-domain pricing and your margin
A customer growing from 20 mailboxes to 60 changes your cost with per-user licensing. It does not change it here, within the 250-address allowance per domain.
- Per-user model: mailboxes across all customers × monthly per-user price.
- MailThreatZero: protected domains × the domain rate for your total domain count. One published schedule for every account: $39, then $37 from 40 domains and $35 from 100, with 250 or more quoted.
- Where per-mailbox wins: a portfolio of very small domains. The calculator compares both totals using the per-mailbox price from your own invoice; we do not estimate another vendor’s price.
- Your margin is yours. You set your own resale price; we publish no required or recommended one.
- Month to month, no setup fee, so a pilot customer is not a commitment.
What the multi-tenant console covers
- Multi-tenant dashboard. One sign-in across every customer; domains, policy, quarantine and reporting for all of them, each tenant’s data scoped to them.
- Onboarding wizard. The domain, its destination and its mail platform, with that platform’s configuration generated as copy-ready settings and checks of DNS, the destination and acceptance before cut-over.
- Policy per domain. Thresholds, which engines run, geographic rules, allow and deny lists, advanced content filters and retention, so one customer’s tuning never becomes another’s.
- Roles. Platform administrator, tenant, domain administrator and read-only user, with TOTP two-factor on any administrative account.
- Delegated customer access. A domain-administrator account scoped to the customer’s own domain and quarantine.
- Message search and quarantine across customers. Search by sender, recipient, subject, IP, domain and verdict; release, delete or list a sender from the same screen. A released message reinjects the retained original.
- Portfolio health and reputation. Customers ranked worst-first by DNS results, quarantine backlog, administrators without two-factor and domains that stopped receiving mail, plus each protected domain’s reputation graded from blocklist, authentication and registration signals.
Reporting your customers can see
- Per-domain summaries of what was delivered, quarantined and rejected, over selectable ranges, with threat detection broken down by filter.
- Scheduled summary emails, opt-in per domain, plus a platform summary for you.
- DMARC aggregate reports ingested and analyzed per domain, with alerting on unauthorized senders, senders that authenticate without aligning, new sources and reports that stop arriving.
- An audit log of administrative and security-sensitive activity.
- Usage and billing per tenant: domains at your tier rate plus any storage, the figure you put on your own invoice.
How a customer domain is deployed
- Mail routes through the gateway. The domain’s MX points at
mt0.mailthreatzero.com, and filtered mail is handed to the customer’s platform over its supported inbound path: an Exchange Online inbound connector, a Google Workspace inbound gateway, or any SMTP destination you configure. - Monitor Mode still routes mail. It scores and records each message without enforcing the verdict, but the MX change is still required and some things still apply. Rollback is switching the domain back to Monitor Mode, or pointing MX back.
- Outbound inspection and DLP are available for mail routed through the gateway, over authenticated submission on port 587 with a per-domain credential. Coverage depends on mail-flow configuration.
- Attachment intelligence uses your own accounts. Signature scanning, document and macro analysis are included; multi-engine reputation runs on your own VirusTotal account, billed by them with no markup from us.
- Internal mail capture is in beta testing. Journal ingestion for the archive add-on is built but not yet switched on for customers.
From the same operator: MSP operations consulting at MSP Reboot, free open-source MSP tools at MSPZero, skills assessment and training for your team in gr0wpath, and Exploit Hound for exposure management — a separate product that maps vulnerabilities and exposed services, where MailThreatZero filters email.
See it on a call before you change any MX record.
A walkthrough of the console with the people who build it. Name and email are enough.