Why MailThreatZero?
Email security you can price, operate, and explain.
For MSPs and organizations that run mail for many domains. MailThreatZero is a secure email gateway in front of Microsoft 365, Google Workspace or your own mail server, with one console for every customer domain, a published per-domain price, and the evidence behind every verdict.
Most buyers already have email security. This page covers what changes if you add MailThreatZero, and how to tell whether it fits.
Three reasons to consider it
-
Priced per domain, not per person
$39 per protected domain per month, lower at volume, up to 250 receiving addresses each. Hiring does not move the bill.
-
Every verdict comes with its reasons
Each message keeps what every stage found, what it scored, and the threshold that applied.
-
Try it on real mail before enforcing
Monitor Mode shows what the policy would have held on a customer’s own mail.
Predictable per-domain pricing
- The problem
- Per-user filtering grows with every hire, so an MSP forecasting its costs is forecasting other companies’ headcount.
- Our approach
- One published schedule by protected-domain count: $39 per domain, $37 from 40 domains, $35 from 100, quoted from 250. Your tier’s rate applies to every domain. Month to month, no setup fee.
- What you get
- A fixed input for packaging a managed security line item, and a margin that does not reopen when a customer grows.
Illustrative example. An MSP protecting 10 customer domains pays $390 a month. One of those customers grows from 20 staff to 60: the bill is unchanged while that domain stays within its allowance. At 40 domains every domain moves to the $37 rate: $1,480 a month.
What counts. Each distinct address that receives mail counts once, so aliases, shared and distribution addresses count too (details). The allowance is a contract term, not a meter: nothing is blocked or billed automatically, and a domain well over it is quoted.
Not in the domain price. AI and VirusTotal usage on your own accounts (no markup from us), the archive add-on, and your mailbox platform.
Per-user pricing can cost less for very small domains. The pricing calculator compares both using the per-mailbox price from your own invoice.
Filtering decisions you can explain
- The problem
- A customer asks why an invoice never arrived, and the filter says “blocked” and nothing else.
- Our approach
- Every stage records what it found and its score; the total is compared with the domain’s quarantine and reject thresholds (defaults 10 and 20). A check that did not run is shown as not run, never as a pass.
- What you get
- An answer you can send the customer, and a fix aimed at the stage that decided it.
Example: investigating a held message
Synthetic data: the same scenario as the self-guided demo. No real customer, sender or result.
An invoice from billing@supplier.example.com to
accounts@customer.example.net was quarantined. The technician searches message
tracking by sender and opens the record:
| Stage | Score | What it found |
|---|---|---|
| Network and reputation | 0 | Sending IP not on any enabled blocklist. |
| Sender authentication | 4 | SPF passes for the relaying service but does not align; no DKIM signature. |
| Malware and attachment analysis | 0 | PDF scanned, no active content. |
| Spam, phishing and content analysis | 7 | Invoice wording from a first-time sender. |
| Optional AI analysis | – | Not enabled on this domain: shown as skipped, not as a pass. |
| Total | 11 | Over the quarantine threshold of 10. |
Neither signal decides it alone. The technician releases the message (the release is recorded), asks the supplier to sign with DKIM, and adds a narrow, expiring exception meanwhile. Full investigation guide.
Evaluate policy before enforcement
- The problem
- Moving a customer to a new filter can mean a week of releasing false positives.
- Our approach
- In Monitor Mode a domain’s mail is scored and recorded, then delivered, so you can review what would have been held and tune it first.
- What it requires
- The domain’s MX points at the gateway, and the mail platform accepts mail from it. It is not a zero-change trial: mail takes an extra hop, connection-time blocklist refusals are off for the domain, banners and link rewriting still change the message if enabled, and a scanner failure defers mail for the sender to retry. It records rather than protects while it runs.
Switching it off is the enforcement step; switching it back on rolls back immediately, with no DNS change. The one-domain evaluation checklist.
Control at the customer and domain level
- The problem
- One customer’s tuning should never change another’s, and customers want to see their own quarantine without seeing anyone else’s.
- Our approach
- Thresholds, engines, geographic rules, allow and deny lists and retention are set per domain. Roles are platform administrator, tenant, domain administrator and read-only, with TOTP on any administrative account.
- Tune one noisy customer without touching the rest.
- Hand an office manager their own quarantine with a domain-administrator account scoped to their domain.
- Find everyone who got the same lure: one message opens every other from the same sender, lure or link across the tenant.
Optional AI under your control
AI analysis uses your own OpenAI or Anthropic account. It runs only when the deterministic stages leave a message inconclusive, is enabled per account and can be switched off per domain. You pay the provider directly and we add no markup. When it runs, the truncated content of that message goes to your provider. It is one signal among several: nothing else depends on it, and it is not a promise of better detection. How AI is used
Visibility beyond inbound filtering
- Protected domain reputation, included for every domain and checked about every six hours. Sample report
- DMARC aggregate reports parsed and alerted on per domain, once the
domain’s
rua=points at the gateway. - Outbound DLP for mail routed out through the gateway on port 587.
- Archive with search and legal hold: a paid add-on.
- Attachment sandboxing on a provider account you hold or a CAPE host you run. Requires setup
Every capability and its status: feature status.
Built for MSPs who
- manage mail for many domains or customers,
- have customers whose headcounts change,
- need to explain individual verdicts to customers,
- can point MX at a gateway that relays to their mail platform over SMTP,
- and want to evaluate on real mail before enforcing.
Questions
Does it replace Microsoft 365 or Google Workspace?
No. It filters inbound mail in front of them; mailboxes and licensing stay where they are. Microsoft 365 · Google Workspace
How does it fit with the email protection we already have?
It sits at the MX record, ahead of your platform’s own filtering, which stays on. Detailed comparison
What changes are required to evaluate it?
Point the domain’s MX at the gateway and let the platform accept mail from it, usually with a connector the console generates. Evaluation guide
Is AI required?
No. It is optional and can be switched off per domain; every other stage still runs.
What counts toward the address allowance?
Up to 250 receiving addresses per protected domain - per domain, not shared across the account. Each distinct address that receives mail counts once. Mailboxes, users, aliases, distribution addresses and shared mailboxes all count toward that 250, so several aliases that deliver into one mailbox are still separate addresses, and there is no per-user component. How the allowance works.
Which capabilities need additional setup or payment?
Paid: the archive add-on, plus usage on your own AI and VirusTotal accounts. Setup: DMARC reporting, outbound DLP, link rewriting and sandboxing. Feature status
See it on your own terms.
A walkthrough with the people who build it (name and email only), or the self-guided demo with no form at all.
Built by an MSP owner who ran one for 24 years. Operated by MSP Reboot. Security and data handling: Trust Center.