MailThreatZero: mail flow and onboarding a domain
For the technician who puts MailThreatZero in front of a customer's mail: how the MX gateway receives, scans and relays mail over SMTP (and what the Microsoft and Google APIs are and are not used for), the three changes on Microsoft 365 and on Google Workspace, the two settings most gateway deployments get wrong, the pre-cutover checks, and running a new domain in Monitor Mode before enforcing.
- Level
- Intermediate
- Length
- About 50 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- MailThreatZero
Skills you'll practise
- Describe the path of an inbound message from the sender's MX lookup to the customer's mailbox through MailThreatZero
- List the three changes a Microsoft 365 or Google Workspace domain needs and explain what each one prevents
- Diagnose SPF and DMARC failures caused by a gateway whose look-past setting (Enhanced Filtering or inbound gateway) is missing
- Interpret a pre-cutover check report, treating an untested check as not passed
- Explain what Monitor Mode does and does not do before choosing to enforce a domain's policy
Course outline
- 1.MailThreatZero: mail flow and onboarding a domainVideo · 2 min
- 2.How mail reaches the mailboxLesson · 16 min
- 3.Microsoft 365 and Google WorkspaceLesson · 17 min
- 4.Verify, cut over, then monitorLesson · 17 min
- 5.MailThreatZero: mail flow and onboarding a domain: knowledge checkKnowledge check · 16 questions
- 6.MailThreatZero: a cut-over that only half happenedScenario
- 7.Final exam9 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- MailThreatZero: How it works (mail path, stages, decision, onboarding, Monitor Mode)
- MailThreatZero: Technical architecture (mail flow, pipeline, decision model, data handling, integrations)
- MailThreatZero: How mail actually flows (where APIs are and are not used, deployment steps)
- MailThreatZero: Email security in front of Microsoft 365
- MailThreatZero: Email security in front of Google Workspace
- MailThreatZero: What a customer receives (onboarding week, alerts, console actions)
- MailThreatZero: How filtering health is validated (and Monitor Mode)
- MailThreatZero: Feature status (generally available, beta testing, requires setup, not available)
- MailThreatZero: Security and data handling (retention, transport, access, logging)
- MailThreatZero: Release notes
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.