Do I need a third-party spam filter if I already have Microsoft 365?

Not necessarily. Microsoft 365 includes Exchange Online Protection, which is competent at bulk spam and known malware. A third-party filter earns its place when you need per-user quarantine control, mail spooling during an outage, a human to call, or a second opinion from a different detection engine.

What actually changes when I add a third-party spam filter?

Your MX records point at the filtering service instead of your mail server. Mail arrives at the filter, is scanned, and clean mail is delivered onward to your existing server or tenant. You also lock your firewall so that inbound SMTP on port 25 is only accepted from the filter's IP ranges.

What happens to my email if my mail server goes down?

With a filter in front, the filter keeps accepting mail and spools it until your server answers again. This is called mail bagging. Without one, senders receive bounce messages or their mail servers retry until they give up.

Does adding a filter mean moving my mailboxes?

No. A filtering service steps between the internet and your existing mail server. Mailboxes, clients and calendars stay exactly where they are.

Third-Party Spam Filter in Front of Microsoft 365: Worth It?

If you run mail on Microsoft 365 or Google Workspace, you already have spam filtering. Exchange Online Protection is included, it is competent, and for a lot of organisations it is genuinely enough. Anyone who tells you otherwise is selling something.

So the honest question is not whether built-in filtering works. It is whether the specific gaps it leaves are gaps that cost you anything. This page walks through where those gaps actually are, what changes technically if you decide to close them, and where a third-party filter is a waste of money.

When a third-party filter earns its place

Your mail server can go down

This is the one people underestimate. When your mail server is unreachable, senders get bounces or their servers retry until they give up. A filter sitting in front keeps accepting mail and spools it until your server answers again. SpyderMail holds mail for 7+ days. If you have ever lost a day of inbound email to an outage, you already know what that is worth.

You want per-user quarantine

Built-in quarantine tends to be an all-or-nothing admin job. A dedicated filter gives every address, including aliases, its own quarantine with its own allow and block lists, and lets each user decide what is spam for them. That is less work for you, not more.

You want a different engine looking

Two detection engines with different rule sets and different update cycles catch different things. If a campaign gets through one, the other has a fair chance of stopping it. This is the genuine security argument, and it is a real one.

You want someone to phone

When a client's invoices stop arriving, the question is how quickly a human can look at the headers with you. Support quality is the least technical item on this list and often the one that decides it.

You do not host your own mail

You do not need to run an Exchange server to use a filtering service. If someone else hosts your mail, the change is a DNS record in their control panel. Nothing moves.

You need outbound filtering too

Outbound scanning matters if a compromised account in your organisation could start sending on your behalf. It protects your domain's reputation rather than your inbox.

When it is not worth it

We would rather say this plainly than have you find out after signing up.

You are a handful of users and spam is not actually a problem. If built-in filtering is holding and nobody complains, adding a layer solves nothing. Revisit it when that changes.
You want it to stop targeted phishing on its own. No filter catches every well-crafted message aimed at one person. Link rewriting helps, and we sell it, but the honest framing is risk reduction rather than elimination. Training your people still matters.
You are hoping it fixes deliverability of your outbound mail. That is an SPF, DKIM and DMARC problem. A filter in front of your inbox does not fix how the world sees your outbound.
You cannot change your MX records. If nobody in the organisation controls DNS and nobody will, this cannot be made to work. It is the one hard requirement.

What actually changes, technically

1. Your MX records point somewhere new

Today your MX records point at your mail server or your Microsoft 365 tenant. They get repointed at the filtering service, which scans the mail and delivers what is clean onward to exactly where it went before. Mailboxes, clients and calendars do not move.

With SpyderMail you get three MX addresses at different priorities, and Canadian customers land in Canadian data centres. They look like this:

yourdomain.com  MX preference = 10, mail exchanger = yourdomain-com.mx1-ca.mailanyone.net
yourdomain.com  MX preference = 20, mail exchanger = yourdomain-com.mx2-ca.mailanyone.net
yourdomain.com  MX preference = 30, mail exchanger = yourdomain-com.mx3-ca.mailanyone.net

You can confirm the change has taken with a single command:

nslookup -type=mx yourdomain.com

How long it takes to propagate depends entirely on the TTL on your existing records. Nothing breaks during the change: mail arriving at the old address still gets delivered while DNS catches up.

2. You lock your firewall to the filter

This step gets skipped and it matters more than anything else on this page. Once mail flows through a filter, configure your firewall to accept inbound SMTP on port 25 only from the filtering service's IP ranges.

If you do not, spammers can look up your server's real address and deliver straight to it, walking around the filter you are paying for. Spammers read MX records as easily as you do. A filter with an open port 25 behind it is a filter you are only partly using.

3. You think about your remote users

If your remote users send mail through your server over SMTP, locking port 25 affects them. The usual answer is a second authenticated submission port, 587 or 465, so their mail still originates from your server and still passes SPF checks at the receiving end.

If your remote users connect over VPN, webmail or remote desktop, this does not apply to you.

4. Your SPF record may need updating

SPF lets you declare which hosts are allowed to send mail as your domain. If you add outbound filtering, the filter becomes one of those hosts and belongs in the record. Inbound-only filtering does not change your SPF at all.

Built-in versus added filtering, side by side

	Built into Microsoft 365	Added filter in front
Bulk spam and known malware	Handled well	Handled well, by a second engine
Mail during an outage	Senders retry or bounce	Spooled and delivered later
Per-user quarantine control	Largely an admin task	Per address, including aliases
Second detection opinion	One engine	Two, with different rule sets
Support when something is wrong	Ticket queue	Depends entirely on the vendor
Extra cost	None, you already pay for it	Per user, per month
Setup effort	None	One DNS change, one firewall rule

Where SpyderMail fits

We have been filtering business email since 2010 and have put more than 6.5 billion messages through the service. Optrics Engineering, our parent company, has been in email security since the early days of the category.

Practically, SpyderMail steps between the internet and your existing mail server. We do not host your mail and we do not want to. What you get is per-user quarantine with daily summary emails that need no password to action, per-user allow and block lists, dual-layer virus scanning, anti-spoofing, 7+ days of mail bagging, geographically redundant data centres, and spam and virus definitions updated hourly.

The part we would actually put money on is the support. You get a person during office hours, the service is monitored 24/7 with staff on call, and there is no charge for SpyderMail-related support. That is the difference a small operator can offer and a large one structurally cannot.

If you are on Microsoft 365 specifically, we have a page on how SpyderMail sits alongside your tenant. If you want the full technical detail of what the service does, how it works covers it, and the setup guide has the MX, firewall and SPF specifics in full.

Should You Put a Third-Party Spam Filter in Front of Microsoft 365?