Email security providers compared
Six providers in one table. We do not compare catch rates; none of them is independently verifiable. We compare what actually decides it: which country your data is processed in, what KVKK says, who you sign the contract with, and whether you can see the price up front.
Short answer There is nothing in the filtering capability of these six providers that would decide between them. The distinction lies in where data is processed, who you buy from and whether you can see the price up front. The one-line summary of the table: with all five providers other than MXGate, data is processed abroad, which means a separate transfer assessment is required under KVKK.
The six providers at a glance
Every fact in this table comes from the providers’ own publications. Ownership matters: in an acquired company the product roadmap, the pricing and the support model can change with the new owner’s priorities.
| Provider | Headquarters | Founded and ownership | Focus |
|---|---|---|---|
| MXGate | Turkey | Independent | Inbound and outbound email security; hosting companies and organisations |
| N-able SpamExperts detailed comparison |
Amsterdam, Netherlands | Founded 2005; SolarWinds MSP in 2017, part of N-able since 2021 | Inbound and outbound filtering for the web hosting, ISP and telecom channel |
| Proofpoint detailed comparison |
Sunnyvale, USA | Founded 2002; acquired by Thoma Bravo in 2021 | A broad security platform for large enterprises: email, DLP, identity, training |
| Mimecast | London, United Kingdom | Founded 2003; acquired by Permira in 2022 | Enterprise email security, archiving and continuity |
| Barracuda | Campbell, USA | Founded 2003; acquired by KKR in 2022 | A broad security range for SMB and mid-market, mainly through the partner channel |
| MailChannels | Vancouver, Canada | Founded 2004; independent | Outbound-only SMTP relay and filtering for web hosting companies |
The eight points that decide it
Not a feature list; these are about scale, law and the way you buy. They do not change with a release note, they are set by contract.
| Point | MXGate | SpamExperts | Proofpoint | Mimecast | Barracuda | MailChannels |
|---|---|---|---|---|---|---|
| Where data is processed | Turkey | Abroad | Abroad | Abroad | Abroad | Abroad |
| KVKK transfer abroad | Not applicable | Assessment needed | Assessment needed | Assessment needed | Assessment needed | Assessment needed |
| Support language | Turkish | English | English | English | English | English |
| How you buy | Direct | Hosting provider | Sales team / partner | Sales team / partner | Partner / MSP | Direct |
| Price visible up front | Published on site | Depends on provider | Quote process | Quote process | Quote process | Published on site |
| Scope: inbound | ✓ | ✓ | ✓ | ✓ | ✓ | No |
| Scope: outbound | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Panel under your brand | ✓ | Partly | Not stated | Not stated | Not stated | Partly |
The “price visible up front” row describes the standard purchase path in enterprise buying; although some providers publish list prices for certain plans, a quote is usually produced through a sales team or a partner. Where a cell says “Not stated”, no assumption was made because the provider does not publish clear information on the point. Performance figures such as catch rate and false positives are not compared in any column, because those values are not independently verifiable.
Whichever provider you look at, ask these six questions
Presentations look alike and the numbers are always high. The six questions below take the answer from the contract and from technical facts; each is verifiable and each gives a different result depending on your situation.
-
In which country is my data processed, and for how long is it kept?Any service that scans content sees your messages. Ask in writing for the processing country, the retention period and the sub-processors before signing. If it is abroad, you have to run a transfer assessment under KVKK.
-
Who am I signing with, and in which language?If you buy through an intermediary, the SLA and the liability relationship are with that intermediary too. Check up front which law and which court apply in a dispute.
-
When a message goes missing, how many steps away is the answer?This is the point most felt day to day. Deliberately test the support channel, its language and how many layers you go through to reach the technical team during the trial.
-
Can I see the budget up front?If no price list is published you learn the cost only at the end of a quote process. If there is an annual commitment, count the cost of walking away too, and add the staff time for setup and administration on top of the licence.
-
Whose brand does the panel carry, and can I open it to my customer?If you are a hosting company or a software firm this directly sets your support load. If you can grant per-domain access, a large share of “my mail never arrived” tickets never reaches you.
-
If I change my mind, how long does it take to reverse?If inbound is redirected with the MX record and outbound with a server setting, reversing is just as easy. In setups that require mailbox migration or agent installation, the cost of leaving is higher than the cost of joining.
Two providers we cover separately
These are the two comparisons we come across most often in Turkey. For each of them a separate page examines scope, the way you buy, KVKK and the panel in detail.
Questions from teams running an evaluation
What should I look at when choosing an email security provider?
Not the catch rate. Every provider publishes a high figure and none of them is independently verifiable. Four things decide it: which country your data is processed in, who you sign with and in which language, how many steps away the answer is when something goes wrong, and whether you can see the budget up front. All of these are set by contract and do not change with a release note.
Why do you not compare catch rates?
Because the comparison would not be honest. Every provider measures with its own sample, and the result changes with the method, the period and the type of traffic. There is no independent referee. Instead we suggest running a trial of a few days on your own domain and looking at your own records; that is the only verifiable data.
Why does it matter so much that data is processed in Turkey?
An email security service sees the content of every message coming into and leaving your organisation. If that data is processed abroad, it counts as a transfer abroad under KVKK and requires a separate legal assessment. When traffic stays in the country the question never arises. In the public sector, finance and healthcare this is usually a tender or audit requirement rather than a preference.
Why do some cells in the table say “Not stated”?
We only write what we can verify. Rather than assume something a provider does not state clearly in its own publications, we prefer to leave the cell empty. On the same principle we do not invent competitors’ performance figures or prices, and the organisational facts come from the companies’ own announcements.
Can I use more than one provider together?
Yes. Because inbound is redirected with the MX record and outbound with the server’s outgoing mail setting, services can be split per domain or per server. Some organisations run a broad platform at head office while preferring to send outbound mail from their in-country servers through a separate gateway.
Test the table on your own traffic
No comparison table replaces a few days of trial on your own domain. Redirect your MX record and see from your own records what is quarantined and what reaches the inbox.