--- title: "An SMB mail filter lists at US$2 to US$3 a mailbox; DMARC costs nothing" summary: "Published per-mailbox prices for the small-business filters in TechBag’s email security guide, what Microsoft 365 and Gmail already include, and the free DNS fix, as of September 2026." url: https://www.thetechbag.com/blog/importance-email-security-startups-smbs-protecting-clients format: Note desk: "Security operations" published: 2025-08-28 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["email security","SMB","startups","Microsoft Defender for Office 365","Gmail","Proofpoint Essentials","DMARC","pricing","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/importance-email-security-startups-smbs-protecting-clients.png --- # An SMB mail filter lists at US$2 to US$3 a mailbox; DMARC costs nothing *Published per-mailbox prices for the small-business filters in TechBag’s email security guide, what Microsoft 365 and Gmail already include, and the free DNS fix, as of September 2026.* Note · Security operations · By TechBag · Published 2025-08-28 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/importance-email-security-startups-smbs-protecting-clients A small company’s extra layer of email security lists at US$2 to US$3 a mailbox a month, and the part that stops criminals sending mail in its name costs nothing but three DNS records.[1] [2] The 2023 version of this post argued that email security matters and listed nine good habits. It still matters. What a founder needs now is narrower: what the mailbox licence already does, what to add, and what that costs in rupees. ## Why the inbox is still the front door Verizon’s 2026 breach report, covering incidents from November 2024 to October 2025, found a human element in 62% of breaches and ransomware in 48%, up from 44% a year earlier.[3] Stolen credentials have slipped as the first step, to 13% of breaches, behind exploited vulnerabilities at 31%, but most of those credentials are still phished or stolen from a laptop that opened the wrong attachment.[3] For a 25-person firm with no security team, the mailbox is where an outsider most often starts a conversation with someone who can pay an invoice. ReportedVerizon DBIR 2026 Human element in 62% of breaches; ransomware in 48%; vulnerability exploitation the first step in 31% and credential abuse in 13%.[3] ## What it costs, and what you already own Start with the licence. Exchange Online Protection filters every Microsoft 365 mailbox; Defender for Office 365 Plan 1, with Safe Links, Safe Attachments and anti-phishing, is inside Business Premium. Gmail blocks 99.9% of spam, phishing and malware in every Google Workspace edition.[1] A startup on Business Premium or Workspace already has a filter. What neither platform does in depth is spot the payload-free message, the “please change our bank details” email from a lookalike domain. **Figure: The small-business filter layer lists at US$2 to US$3 a mailbox; Microsoft’s own add-on is the cheapest line** *Published entry-tier price, US$ per mailbox per month, as recorded in TechBag’s email security guide, September 2026* Defender for Office 365 P1 in Business Premium US$2 Proofpoint Essentials Business US$2.75 Forcepoint Email Security listing US$2.4 Barracuda Email Protection Advanced US$3 Trend Micro Email Security listing US$5 Defender for Office 365 P2 US$5 | | Value (US$) | | --- | --- | | Defender for Office 365 P1 | 2 | | Proofpoint Essentials Business | 2.75 | | Forcepoint Email Security | 2.4 | | Barracuda Email Protection Advanced | 3 | | Trend Micro Email Security | 5 | | Defender for Office 365 P2 | 5 | Source: TechBag email security guide (vendor-doc-verified 22 August 2026); Microsoft Defender for Office 365 pricing page · as of 30 September 2026 · Trend Micro's figure is a US$60-a-year listing divided by 12; Proofpoint Essentials runs to US$5.33 at the Professional tier on its October 2021 US list TechBag countTechBag count TechBag’s guide held 22 email security products from 14 vendors on 30 September 2026, 14 of them mail filters. Five of the 14 printed any list price; the rest were quote-only. Two documented an Indian data centre: Proofpoint and Sophos.[1] ## Three free settings before any purchase First, publish SPF, DKIM and a DMARC policy for your domain. DMARC is an open standard and costs only a DNS entry; it is the one control that stops someone spoofing *you* to your customers, which no inbound filter can.[2] Gmail has required SPF or DKIM from every sender, and DMARC from bulk senders, since 1 February 2024, so a domain without them risks its own invoices landing in spam.[4] Second, turn on multi-factor authentication for every mailbox, including the shared accounts nobody owns. Third, write down who may approve a change of bank details, and require a phone call to a known number before anyone does. Our view Our view: a company under 50 people should do the three free settings this week, move to Business Premium or confirm Workspace’s controls are on, and buy a third-party filter only when a real lookalike-domain attempt gets through. The earlier pieces on [BEC losses](https://www.thetechbag.com/blog/do-we-need-e-mail-security-protect) and on [how the filter field has changed](https://www.thetechbag.com/blog/15-top-best-e-mail-security-software) cover that next step. **In India.** At ₹83 to the dollar, the TechBag guide convention, a 25-mailbox firm pays US$600 a year at US$2, about ₹49,800, or ₹58,764 with 18% GST; at US$3 it is ₹74,700, or ₹88,146 with GST. All of these vendors bill in US dollars; buying through a reseller gives an INR invoice with GST shown. Phishing and spoofing are reportable incidents under CERT-In’s Directions of 28 April 2022, which allow six hours to report.[5] And a mailbox full of customer data is personal data: the DPDP Rules, notified on 13 November 2025, bring the security and breach-notice duties into force on 13 May 2027.[6] How we did this Figures as of 30 September 2026 Prices and counts are taken from TechBag’s email security guide as committed on 30 September 2026 (records vendor-doc-verified on 22 August 2026), counted by product record: entry tier, US$ per mailbox per month, annual terms. Reported price ranges for quote-only products are excluded from the chart. The breach figures are Verizon’s, read through Help Net Security’s summary; the report PDF was not fetched. The original post’s three statistics (61% credentials, 95% human error, US$2.2 million SMB breach cost) could not be traced to a current edition and are dropped. INR uses ₹83 to the dollar and adds 18% GST. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Email security decision guide (22 products, 14 vendors; prices, what Microsoft 365 and Gmail include, India data centres)](https://www.thetechbag.com/browse/security/email-security) — as committed 30 September 2026; records verified 22 August 2026 2. [IETF, RFC 7489: Domain-based Message Authentication, Reporting and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc7489) — March 2015 3. [Help Net Security, Lessons for organizations from the Verizon 2026 DBIR (62% human element, 48% ransomware, 31% exploitation, 13% credential abuse)](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026 Report PDF not fetched. 4. [Google Workspace Admin Help, Email sender guidelines](https://support.google.com/a/answer/81126) — requirements from 1 February 2024 5. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; phishing and spoofing among reportable incidents)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 6. [DPDP Rules 2025, commencement timeline (notified 13 November 2025; safeguard and breach duties from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — 13 November 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Email & collaboration security guide](https://www.thetechbag.com/browse/security/email-security) — what Microsoft 365 and Gmail include, and every filter priced - [Proofpoint Email Protection](https://www.thetechbag.com/proofpoint/proofpoint-email-security) — Essentials for small businesses, with the India data centre