In short: Sophos Email is cloud email security for Microsoft 365, Google Workspace and other hosted email, deployed as a gateway or through API integration. It comes as Sophos Email and Sophos Email Plus, which adds advanced protection and reporting and includes DMARC Manager. It is licensed per individual and shared mailbox, with Portal Encryption as an add-on.
What Sophos Email is
Sophos Email filters email for phishing, malware, impersonation, business email compromise and malicious links. It uses several AI and machine learning models, sandboxes attachments, rewrites links for time-of-click checking, detects threats hidden in QR codes and images, checks SPF, DKIM and DMARC, applies data loss prevention rules and can claw back malicious messages after delivery. It is managed in the same Sophos console as your endpoints and shares telemetry with Sophos XDR and MDR.
It works with Microsoft 365, Google Workspace and other hosted email services where you manage the domain. Sophos Email can be deployed as a gateway, which means changing mail routing so mail passes through Sophos first, or through API integration with Microsoft 365, which needs no change to mail flow.
Email and Email Plus compared
| Feature | Sophos Email | Sophos Email Plus |
|---|---|---|
| Core email security: anti-phishing, impersonation and BEC protection, sandboxing, time-of-click URL protection, QR code detection, DLP | Yes | Yes |
| Additional advanced protection and reporting | No | Yes |
| DMARC Manager | Add-on | Included |
| Portal Encryption | Add-on | Add-on |
DMARC Manager shows how your domains are used in outbound email and guides you towards DMARC enforcement without blocking legitimate mail. Portal Encryption lets recipients sign in to a web portal to read and reply to encrypted messages, and only customers with the add-on can apply custom branding to it. Sophos's Email product page also presents Sophos Phish Threat as part of Sophos Email; we confirm on your quote whether your licence includes it.
How Sophos Email is licensed
Sophos Email is licensed per individual user and shared mailbox that needs protection. Aliases, distribution lists and public folders do not need a licence. Usage is calculated on mailboxes processed in the past 30 days and updated every four hours, and deleting a mailbox removes it from the count immediately. Sophos Email is available only to business customers, including commercial, education and government organisations.
- Monthly through Forever Systems, following your mailbox count.
- Fixed term with a set renewal date.
- Portal Encryption cannot exceed your Sophos Email licence count.
Ask us for a quote with your mailbox numbers and current email security renewal date.
Requirements and deployment
For gateway mode you need control of your domain's DNS to change mail routing, and we lock down Microsoft 365 or Google Workspace so that mail can only arrive through Sophos. API integration needs admin consent in your tenant. Sophos Email also feeds detections into Sophos XDR and MDR. If you already have email security and only want extra visibility, the Email Monitoring System in Workspace Protection works alongside your existing product without changing delivery.
Moving to Sophos Email
We set up Sophos Email in your existing Sophos account, import allow and block lists from your current product, run it alongside your current filter to compare, then switch mail routing at a quiet time. Because licences follow mailboxes, we check shared mailboxes and leavers' mailboxes first so you only license what needs protecting.
Who it suits and how we help
Sophos Email suits organisations that want email security managed in the same console as their endpoints, or that need encryption and DMARC from one supplier. We plan the cutover, set policies, publish SPF, DKIM and DMARC records and handle licences and renewals. See Sophos Email on our specialist site for product depth, and compare vendors on our email security page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos Email licensed per user or per mailbox?
Per mailbox: each individual and shared mailbox that needs protection uses a licence. Aliases, distribution lists and public folders do not.
What is the difference between Sophos Email and Email Plus?
Email Plus includes everything in Sophos Email plus additional advanced protection and reporting, and it includes DMARC Manager, which is an add-on for Sophos Email.
Does Sophos Email need MX record changes?
Only in gateway mode. With API integration Sophos Email connects to Microsoft 365 directly, so mail flow does not change, and malicious messages can still be clawed back after delivery.
Is Phish Threat included with Sophos Email?
Sophos's Email product page lists Phish Threat among Sophos Email's features, and Sophos reports Email and Phish Threat usage together. We confirm on your quote whether your licence includes it or needs a separate Phish Threat subscription.