Stop the spam, phishing and scams that slip past Microsoft 365.
GecoSpam sits in front of your Microsoft 365 inboxes and checks every external email with layered filters and our own AI. It tests links, opens attachments safely and spots impersonation, then delivers only the clean mail. Microsoft’s protection stays switched on too.
- UK-hosted
- No MX changes
- Works alongside Defender
- Billed per licensed user
How it works
Three steps. No MX change, no software on anyone’s computer.
Connect your tenant
We add a mail-flow rule in Exchange Online that sends external inbound mail to GecoSpam. Your MX records stay as they are, and internal mail between colleagues never leaves Microsoft.
We check every message
Each email goes through more than a dozen checks: SPF, DKIM and DMARC, link reputation, a sandbox that opens links safely, attachment and PDF analysis, malware scanning, impersonation detection and our own AI classifier.
Clean mail is delivered
Legitimate mail goes straight back to Microsoft 365 and on to the inbox. Anything suspicious is quarantined, and users can review it from a daily digest or the portal.
Key features
Built in layers, because no single filter catches everything.
Our own AI classifier
Trained on real business email and improved by what your users report. It runs on our own GPUs, not a third-party AI service.
Link sandbox
Suspicious links are opened in an isolated sandbox to see where they really lead, and also checked against threat-intelligence feeds such as Google Safe Browsing and NextDNS.
Attachment & PDF analysis
Documents are inspected for hidden links, scripts and lures. Files are also scanned with ClamAV and checked against hashes of known malware.
Impersonation & BEC protection
We flag emails that pretend to be your directors, finance team or other key staff, including look-alike names and “quick favour” gift-card scams.
SPF, DKIM & DMARC checks
Spoofed and unauthenticated senders are scored accordingly, before they can reach an inbox.
Quarantine portal
Users and admins can preview held mail and Release it or Mark it Clean in one click at app.gecospam.net.
Daily spam digest
One short email a day lists what was held, so nothing important goes missing.
Report to spam@
Users forward anything that got through to a submission mailbox, and every report helps train the filters.
Allow & block lists per company
Each organisation controls its own trusted and blocked senders and domains.
An extra layer, not a replacement.
GecoSpam doesn’t ask you to switch off anything Microsoft provides. Exchange Online Protection and Defender for Office 365 (if you have it) keep running, so mail is checked twice by two different engines.
- No MX record changesRouting uses a standard Exchange Online mail-flow rule, so removing it is just as simple.
- External mail onlyInternal email between colleagues stays inside Microsoft 365.
- Licences synced from M365Your bill follows your licensed-user count automatically, so there’s no manual seat counting.
- UK-hostedMail is processed on UK infrastructure.
- Built and supported by an MSPWe manage Microsoft 365 tenants every day, and GecoSpam was built to fix problems we saw for our own clients.
Try it on your real mail, with nothing held back.
In monitor mode, GecoSpam scores every external email but delivers all of it as normal. After 30 days you’ll get a report of the phishing, scams and spam we would have caught and how they compare with what reached your inboxes. When you’re ready, switch to protection with one click.
Start your free trial- Free for 30 days
- No card needed
- Nothing is quarantined during the trial
- Cancel by removing one mail-flow rule
Simple per-user pricing. Every feature is included.
No tiers to compare and no add-ons to buy. Pay for the licensed Microsoft 365 users you protect.
GecoSpam Direct
- Every feature, including AI, sandbox and impersonation checks
- Quarantine portal, daily digests and spam@ reporting
- UK-based support
- Minimum £15 per organisation per month
GecoSpam Partner
- Volume price £0.80 at 500+ users across all clients
- Minimum £5 per client tenant per month
- Per-client allow and block lists, quarantine and a multi-tenant console
- Free use on your own tenant
Less than Microsoft Defender for Office 365 Plan 1 (£1.54 per user per month, paid yearly).
Prices exclude VAT. Billed on licensed Microsoft 365 users, synced automatically. Shared mailboxes without a licence aren’t charged. No setup fees.
Frequently asked questions
Does GecoSpam replace Microsoft Defender or Exchange Online Protection?
No. It adds a separate layer of checks. Microsoft’s filtering stays switched on, so mail is checked by both.
Do I need to change my MX records?
No. GecoSpam uses a standard Exchange Online mail-flow rule to route external inbound mail. Your DNS stays as it is.
Does internal mail go through GecoSpam?
No. Only email arriving from outside your organisation is routed through it.
Where is my email processed?
In the UK. GecoSpam is hosted on UK infrastructure, and our AI classifier runs on our own hardware rather than a third-party AI service.
What happens if an email is wrongly quarantined?
Users can release it from the daily digest or the portal, and mark it clean so similar mail gets through next time. Admins can also add senders to the company allowlist.
What if something gets through?
Forward it to the spam@ submission address. Every report goes into training, so the filters keep learning.
What happens if GecoSpam is unavailable?
Exchange Online queues messages and retries if it can’t reach GecoSpam, so mail is delayed rather than lost, and it can be routed around us by turning off a single rule.
How is billing calculated?
Per licensed Microsoft 365 user, synced automatically from your tenant. When you add or remove licences, your bill follows.
Can MSPs resell GecoSpam?
Yes. Partners get wholesale pricing, per-client allow and block lists, and one portal for all their tenants.
How long does setup take?
Usually less than an hour, including the mail-flow rule and a short test.
Can I cancel?
Yes. To leave, remove the mail-flow rule and mail goes back to flowing straight into Microsoft 365.
See what’s getting through today.
Run GecoSpam in monitor mode for 30 days at no cost. You’ll get a clear report of what it would have caught, with no risk to your mail flow.