An SMB mail filter lists at US$2 to US$3 a mailbox; DMARC costs nothing
Published per-mailbox prices for the small-business filters in TechBag’s email security guide, what Microsoft 365 and Gmail already include, and the free DNS fix, as of September 2026.
A small company’s extra layer of email security lists at US$2 to US$3 a mailbox a month, and the part that stops criminals sending mail in its name costs nothing but three DNS records.1 2 The 2023 version of this post argued that email security matters and listed nine good habits. It still matters. What a founder needs now is narrower: what the mailbox licence already does, what to add, and what that costs in rupees.
01Why the inbox is still the front door
Verizon’s 2026 breach report, covering incidents from November 2024 to October 2025, found a human element in 62% of breaches and ransomware in 48%, up from 44% a year earlier.3 Stolen credentials have slipped as the first step, to 13% of breaches, behind exploited vulnerabilities at 31%, but most of those credentials are still phished or stolen from a laptop that opened the wrong attachment.3 For a 25-person firm with no security team, the mailbox is where an outsider most often starts a conversation with someone who can pay an invoice.
02What it costs, and what you already own
Start with the licence. Exchange Online Protection filters every Microsoft 365 mailbox; Defender for Office 365 Plan 1, with Safe Links, Safe Attachments and anti-phishing, is inside Business Premium. Gmail blocks 99.9% of spam, phishing and malware in every Google Workspace edition.1 A startup on Business Premium or Workspace already has a filter. What neither platform does in depth is spot the payload-free message, the “please change our bank details” email from a lookalike domain.
The small-business filter layer lists at US$2 to US$3 a mailbox; Microsoft’s own add-on is the cheapest line
Published entry-tier price, US$ per mailbox per month, as recorded in TechBag’s email security guide, September 2026
Source: TechBag email security guide (vendor-doc-verified 22 August 2026); Microsoft Defender for Office 365 pricing page · as of 30 September 2026 · Trend Micro's figure is a US$60-a-year listing divided by 12; Proofpoint Essentials runs to US$5.33 at the Professional tier on its October 2021 US list
03Three free settings before any purchase
First, publish SPF, DKIM and a DMARC policy for your domain. DMARC is an open standard and costs only a DNS entry; it is the one control that stops someone spoofing you to your customers, which no inbound filter can.2 Gmail has required SPF or DKIM from every sender, and DMARC from bulk senders, since 1 February 2024, so a domain without them risks its own invoices landing in spam.4 Second, turn on multi-factor authentication for every mailbox, including the shared accounts nobody owns. Third, write down who may approve a change of bank details, and require a phone call to a known number before anyone does.
In India. At ₹83 to the dollar, the TechBag guide convention, a 25-mailbox firm pays US$600 a year at US$2, about ₹49,800, or ₹58,764 with 18% GST; at US$3 it is ₹74,700, or ₹88,146 with GST. All of these vendors bill in US dollars; buying through a reseller gives an INR invoice with GST shown. Phishing and spoofing are reportable incidents under CERT-In’s Directions of 28 April 2022, which allow six hours to report.5 And a mailbox full of customer data is personal data: the DPDP Rules, notified on 13 November 2025, bring the security and breach-notice duties into force on 13 May 2027.6
Sources
- TechBag, Email security decision guide (22 products, 14 vendors; prices, what Microsoft 365 and Gmail include, India data centres) — as committed 30 September 2026; records verified 22 August 2026
- IETF, RFC 7489: Domain-based Message Authentication, Reporting and Conformance (DMARC) — March 2015
- Help Net Security, Lessons for organizations from the Verizon 2026 DBIR (62% human element, 48% ransomware, 31% exploitation, 13% credential abuse) — 25 May 2026 Report PDF not fetched.
- Google Workspace Admin Help, Email sender guidelines — requirements from 1 February 2024
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; phishing and spoofing among reportable incidents) — 28 April 2022
- DPDP Rules 2025, commencement timeline (notified 13 November 2025; safeguard and breach duties from 13 May 2027) — 13 November 2025
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
