Pricing
Predictable pricing per protected domain
Protect up to 250 receiving addresses per domain with one predictable domain-based price. Your per-domain rate decreases as the number of protected domains grows.
Pricing
Gateway filtering
One rate per protected domain, per month, in US dollars. The rate for your total protected-domain count applies to every domain in the account. At 250 domains and above, pricing is custom.
-
Standard
$39per protected domain / month
1–39 domains
Up to 250 receiving addresses per protected domain
Organizations and service providers starting out
-
Volume
$37per protected domain / month
40–99 domains
Up to 250 receiving addresses per protected domain
Growing organizations and MSP portfolios
-
Portfolio
$35per protected domain / month
100–249 domains
Up to 250 receiving addresses per protected domain
Large multi-domain organizations and MSP portfolios
-
Custom pricing
Quotedcontact us for a quote
250+ domains
Contact us for an organization or service-provider quote.
Rates are based on the total number of protected domains in your account. The applicable per-domain rate is applied to all protected domains.
What the 250-address allowance counts
- Per domain. The allowance is per protected domain and is not pooled. A domain with 30 addresses does not lend its remainder to one with 300.
- What counts. Every address on the domain that receives mail through the gateway counts once, however many messages it receives.
- Aliases, shared mailboxes and distribution addresses. Aliases, shared mailboxes and distribution addresses each count as a separate address, because that is what they are on the wire - the gateway sees the recipient, not the mailbox behind it. Where several addresses forward into one mailbox, the count reads higher than your mailbox count, not lower.
- Duplicates. Addresses are de-duplicated: an address that receives a thousand messages counts once. Addresses the gateway handles on its own behalf - postmaster, mailer-daemon, abuse, double-bounce - and test-mode traffic are excluded.
- A worked example. A customer domain with 180 user mailboxes, 3 shared mailboxes (info@, billing@, support@) and 12 aliases that each receive mail counts 195 addresses: within the 250. If it adds 60 more aliases that receive mail, it counts 255: nothing is blocked or billed automatically, and we agree the rate for that domain with you before anything changes.
- What we can actually see. The gateway can only see addresses that have actually received mail, so any figure it reports is a lower bound on addresses rather than a mailbox census. A quiet mailbox is invisible to it.
- How it is applied. The allowance is a term of the agreement, not a meter. No part of the product gates delivery, filtering or features on it.
- Above the allowance. Nothing blocks or bills a domain that goes over. If a domain is materially above the allowance, the rate for it is agreed rather than published - ask us for a quote and we will write it down. Ask for a quote.
Up to 250 receiving addresses per protected domain - per domain, not shared across the account. Each distinct address that receives mail counts once. Mailboxes, users, aliases, distribution addresses and shared mailboxes all count toward that 250, so several aliases that deliver into one mailbox are still separate addresses, and there is no per-user component. No setup fee, no minimum term. Archiving is the one metered component, because bytes kept for years are a cost that genuinely does scale.
Included in every domain
- Up to 250 receiving addresses per protected domain - per domain, not shared across the account. Each distinct address that receives mail counts once. Mailboxes, users, aliases, distribution addresses and shared mailboxes all count toward that 250, so several aliases that deliver into one mailbox are still separate addresses, and there is no per-user component.
- Every scanning stage that is enabled, applicable and reached, with each engine configurable per domain
- Gateway hosting, updates, signature feeds and maintenance
- DMARC aggregate report collection, analysis and alerting per domain
- Quarantine, message tracking and per-message filter breakdown
- Multi-tenant administration with role-based access and TOTP two-factor
- Email support
Certain capabilities depend on mail-flow configuration or optional integrations.
Optional services and integrations
- AI analysis API usage — use your own OpenAI or Anthropic account and pay the provider directly. MailThreatZero adds no markup.
- Attachment reputation and multi-engine analysis use your own VirusTotal account. Provider charges, if any, are paid directly to VirusTotal. MailThreatZero adds no markup.
- Message archiving — an optional MailThreatZero add-on, billed separately based on retained storage and retention term
AI analysis is off until you enable it. AI and attachment reputation are billed by the provider on your own account; archiving is a MailThreatZero add-on billed by us.
One product at every tier
Standard, Volume and Portfolio differ only in the rate. Every protected domain gets every capability below, and each cell shows what it takes to use it.
| Capability | Standard · Volume · Portfolio |
|---|---|
| Prevent | |
| Inbound MX gateway filtering | IncludedMail routed through the gateway |
| Spam, phishing and malware scanning (multiple independent engines) | Included |
| BEC and impersonation detection | IncludedSwitched on per domain |
| Payment and invoice fraud detection | BetaSwitched on per domain |
| QR-code phishing detection | IncludedSwitched on per domain |
| SPF, DKIM, DMARC and ARC evaluation | Included |
| Link protection and delayed URL re-analysis | IncludedSwitched on per domain |
| Static and structural attachment analysis | Included |
| Behavioral attachment analysis (VirusTotal, Joe Sandbox, or a self-hosted CAPE host) | Requires setupExternal service |
| Content disarm and reconstruction (CDR) | IncludedSwitched on per domain |
| Inbound sender IP reputation (DNS blocklists) | Included |
| Country and network (ASN) policy | IncludedSwitched on per domain |
| Header and sender analysis | Included |
| Homograph (IDN) domain detection | Included |
| Warning banners on delivered mail | IncludedSwitched on per domain |
| Per-domain allow and block lists | Included |
| Custom policy rules | IncludedSwitched on per domain |
| Detect | |
| Campaign correlation across a tenant | Included |
| Explainable per-message scoring | Included |
| Monitor Mode on real traffic | IncludedSwitched on per domain |
| Outbound behavioral anomaly detection | IncludedMail routed through the gateway |
| User-reported phishing triage | Requires setupIntegration required |
| DMARC aggregate report analysis | IncludedSwitched on per domain |
| Daily DNS health checks | Included |
| Live mail flow and SMTP refusals | Included |
| Shared threat intelligence map | Beta |
| Respond | |
| Message tracking and threat hunting | Included |
| Quarantine, release and end-user digests | Included |
| Automatic remediation policy and dry-run decision engine | IncludedSwitched on per domain |
| Recipient spam reporting link | IncludedSwitched on per domain |
| Protect data | |
| Outbound DLP | IncludedMail routed through the gateway |
| Email archiving | Add-onBilled by retained storage and term |
| WORM retention | Add-onBilled by retained storage and term |
| Emergency inbox and continuity | IncludedSwitched on per domain |
| Legal hold (per message) | Add-onBilled by retained storage and term |
| eDiscovery cases | Add-onBilled by retained storage and term |
| Outbound review queue | IncludedMail routed through the gateway |
| Outbound TLS visibility and enforcement | Included |
| Operate | |
| MSP multi-tenancy with per-domain policy | Included |
| Up to 250 receiving addresses per protected domain | Included |
| Reporting and scheduled summaries | IncludedSwitched on per domain |
| REST API | Included |
| Two-factor authentication with recovery codes | Included |
| Bring your own AI provider, and run without AI entirely | IncludedYour own provider account |
| Passkeys / WebAuthn | Included |
| Protected domain reputation monitoring and history | Included |
| Spamhaus, SURBL and Google Web Risk for protected domain reputation | Requires setupExternal service |
| Attachment policy presets with change preview | Included |
| Administrator audit history | Included |
| Delegated customer administration | Included |
| Your branding on customer reports and digests | IncludedSwitched on per domain |
| Continuous filtering pipeline validation | Included |
Now in beta testing: Account-takeover risk from Microsoft and Google identity telemetry, Mailbox lookup in Microsoft 365 and Google Workspace, Post-delivery removal, Bulk campaign remediation, Journal ingestion (internal mail capture), Webhooks and SIEM, Single sign-on, SCIM provisioning, Google Postmaster Tools connection. Feature status tracks each one.
Archive storage add-on
Message history and quarantine data for investigation come with the domain rate. Long-term archiving is a separate add-on available today, priced on retained capacity and retention term.
Archiving is a separate add-on. You buy a bucket of retained storage and divide it across your domains yourself — the bucket is what you bought, the split is yours to change. What you buy is fixed at purchase: a later price or size change does not alter it.
| Package | Storage | Retention | Price | Over-bucket |
|---|---|---|---|---|
| Archive Starter A small portfolio with ordinary mail volume | 100 GB | 1 year | $15/mo | $0.20/GB |
| Archive Standard The common choice for a growing portfolio | 500 GB | 3 years | $60/mo | $0.15/GB |
| Archive 7-Year Designed for organizations requiring extended retention periods | 2,000 GB | 7 years | $200/mo | $0.12/GB |
Over-bucket usage is billed at the rate shown rather than cut off. A domain that exceeds its share keeps being retained, so the record stays complete and the overage is simply visible and billable.
Archive packages are added to an existing subscription through your account contact, so the retention term and bucket size are agreed before anything is billed. Talk to us about archiving.
What it costs in practice
- 1 partner-managed domain$39/domain — $39/month. Up to 250 receiving addresses per protected domain, and no per-user component.
- 10 partner-managed domains$39/domain — $390/month. Up to 250 receiving addresses per protected domain, and no per-user component.
- 50 partner-managed customer domains$37/domain — $1,850/month. Up to 250 receiving addresses per protected domain, and no per-user component.
- 100 partner-managed customer domains$35/domain — $3,500/month. Up to 250 receiving addresses per protected domain, and no per-user component.
- A direct organization protecting one domain$39/domain — $39/month. Up to 250 receiving addresses per protected domain, and no per-user component.
From 250 protected domains the rate is quoted. There is no published figure because there is no single one.
An account keeps the rate card it was sold. A new published price does not change an agreement already in place.
Before you commit
Request a Demo Before You Commit
See the filtering work on your own mail before you enforce anything.
Point one customer domain at the gateway in Monitor Mode. Real mail is received and scored, every decision is recorded with the reasoning behind it, and delivery carries on unchanged. You get to see what MailThreatZero would have caught, and what it would have held that you would rather it had not, before a single message is stopped.
That is the same filtering the price above covers — Monitor Mode is a setting on the domain, not a reduced trial tier. The evaluation guide covers what an evaluation needs and how to switch enforcement on and off.
Per-domain or per-mailbox pricing: which costs less?
Per-mailbox pricing grows with a customer's headcount. Per-domain pricing grows with the number of domains you protect, and ignores headcount up to the address allowance. Neither is cheaper everywhere, and the crossover is simple to find.
- The crossover
- Divide your per-domain rate by what you pay per mailbox today. A domain with more mailboxes than that costs less per domain; one with fewer, or exactly that many, costs less per mailbox. Equal is not cheaper, so the first mailbox count that favours per-domain is the whole-number result plus one.
- Where per-mailbox wins
- A portfolio of very small domains: a two-person practice is cheaper on almost any per-mailbox price.
- Where per-domain wins
- Domains with more people than the crossover, and customers whose headcount moves. Hiring ten people changes a per-mailbox bill and does not change this one, within Up to 250 receiving addresses per domain.
- What the comparison leaves out
- A filter already included in a licence you keep is not a saving when you add this, and filtering is not archive. The calculator asks for your real per-mailbox figure and shows both totals.
We do not print a crossover figure here, because it depends on a per-mailbox price only you know. Why the model suits growing customers, with a worked example, is on Why MailThreatZero?; for MSP portfolios, see multi-tenant email security for MSPs.
Work out your number
The calculator uses the rates on the cards above. To compare, enter what you pay today; we do not estimate what another vendor would charge you.
Whole number of email domains, not mailboxes. Each protected domain includes up to 250 receiving addresses.
Paid directly to OpenAI or Anthropic on your own key. Leave at zero if you will not enable AI analysis.
Every address that receives mail on the domain: user mailboxes, aliases, shared and distribution addresses. Paste a column straight from a spreadsheet; each line is one protected domain. When you fill this in it sets the domain count, and every line is checked against the 250-address allowance separately.
Licensed user and shared mailboxes, which is usually fewer than the addresses above. Used only for the cost per mailbox and for comparing with what you pay per mailbox today; it does not affect the allowance.
Billed separately from filtering, and shown on its own line. You buy a bucket of retained storage and divide it across your domains yourself.
Your current provider's figure, from your own invoice — not an assumption of ours. Needs your actual mailbox count above to compare against.
Tick this if your current protection comes with a licence you already pay for — Microsoft 365 Business Premium or E3/G3 include Defender for Office 365 Plan 1, for example. The comparison then reports no saving, because there is none to report.
Costs this figure does not include
- AI provider usage, if you enable AI analysis: billed by OpenAI or Anthropic on your own key. The calculator adds only the figure you enter.
- VirusTotal or Joe Sandbox plans, if you connect them for attachment reputation checks: billed by that provider.
- Archive usage above the package bucket, which depends on retained volume.
- Your mailbox platform (Microsoft 365, Google Workspace or your own server) and DNS hosting, which you keep paying as today.
- Domains materially above the 250-address allowance, and accounts of 250 or more domains: both are quoted, not published.
The domain rate itself is the whole of the gateway charge: no setup fee and no per-message charge. Whether it replaces a cost depends on what you have today. Protection that comes bundled in a licence you keep (for example Defender for Office 365 Plan 1 in Microsoft 365 Business Premium) is not saved by adding this; a separately billed filter you remove is.
Why per protected domain rather than per mailbox: Why MailThreatZero?
Archive storage is an optional add-on. Selecting a package in the calculator adds its monthly price to the totals above. Usage beyond the package's included bucket is charged separately and is not estimated here, because that depends on retained volume, which this calculator does not ask for.
Pricing questions
What exactly is a "domain"?
One email domain that you point at the gateway — the part after the @. Every mailbox, alias and distribution address on it is filtered, and each counts toward that domain's 250-address allowance. Subdomains that receive mail separately count as their own domain.
How many addresses does a protected domain cover?
Up to 250 receiving addresses, and aliases, shared mailboxes and distribution addresses count toward that number (how it is counted). Within it, a protected domain costs the same with five addresses or two hundred. There is no seat count anywhere in the bill, so hiring does not change what you pay while each domain stays within the included receiving-address allowance.
Which rate applies to me?
The same one. There is a single schedule for every account, and your total number of protected domains picks the row: $35–$39 per protected domain. The separate direct and partner cards ended on 2026-08-24.
That means volume rates are not a partner-only benefit. An organization protecting forty of its own domains pays the same per-domain rate as a service provider with forty customer domains.
If you publish new rates, does my price change?
No. Your account is pinned to the rate card it was sold on, and publishing a new one does not move you. When we changed the published rates, every account that already existed stayed on the card it had.
This is enforced in the billing code rather than promised in a policy: a statement resolves the rate from your account's own card, and it names that card on the statement so a figure can be checked later. Moving an account to a different card is a deliberate act that is recorded — it cannot happen as a side effect of us changing a price.
Does message volume change the price?
No. Archiving is the one metered component, because bytes kept for years are a cost that genuinely does scale.
Is there a setup fee or a contract?
No setup fee, and it is month to month. There is no minimum term to sign.
How do we pay?
PayPal is accepted for the monthly subscription. Billing is month to month with no setup fee and no minimum term, and AI and VirusTotal usage is billed to you by those providers directly rather than passing through us.
Are infrastructure, updates and maintenance included?
Yes — we operate the gateway, including hosting, software updates, signature feeds and maintenance. There is nothing for you to run or patch.
What is included in filtering at this price?
The five core scanning stages: network and reputation, sender authentication, malware and attachment analysis (including document and macro analysis), and spam, phishing and content analysis, which includes impersonation checks. The fifth, optional AI analysis, and VirusTotal intelligence use accounts you supply and are billed directly by those providers. Long-term message archiving is an optional MailThreatZero add-on billed separately based on retained storage and retention term. Certain capabilities depend on mail-flow configuration or optional integrations.
What will AI actually cost?
That depends on your provider, model and how much of your mail is inconclusive after the deterministic stages. AI analysis runs only when the deterministic stages leave a message inconclusive, so most mail is decided without any AI call. You are billed by the provider directly, so you can see and cap it yourself. Start with AI off and turn it on once you have seen your own volumes.
How does archive storage work?
Archiving is available now as a separate add-on. Optional archive storage is billed separately based on retained capacity and retention term. Retention runs from one to seven years depending on the package, with the seven-year package designed for organizations requiring extended retention periods. Each message keeps the term in force when it was archived, and legal hold or WORM protection can keep it longer (retention table). You buy a bucket and divide it across your domains yourself. Message history and quarantine data for investigation are included with the domain rate and do not need the add-on.
What support comes with it?
Email support is included with every protected domain. Mail-flow interruptions, widespread false positives, and suspected security incidents receive priority handling. Support terms and response targets are provided with each service plan.
Want the number for your portfolio?
Tell us how many domains you protect and we will put it in writing.