I have a client that is a small organization (<30 users) with an Exchange 2010 server that is looking for a new spam filtering solution. They have an ancient Barracuda spam filter that they didn't continue the subscription for so obviously it is WAY behind the curve on firmware updates and isn't as effective as an appliance that was current on updates. Via fiddling with various custom blacklists I was able to block ~90% of the spam without blocking any legit email, but they don't think that is good enough. Since the unit is so many years out of date I'm legitimately concerned about it eventually failing even if I could figure out how to get the spam block rate high enough to placate them without blocking a bunch of legit email. I have gotten pricing on both the Barracuda hardware appliance and the virtual appliance, but they balked at the pricing. I've known a few people that disliked the cost of Barracuda that used Spam Hero and while they didn't think it as effective the pricing is much cheaper for smaller clients. The only concern I have is that charging per 100K could eventually become nearly as expensive as what a similar subscription for Barracuda. I briefly used Mailcleaner's community edition at one company, but I found it too much work. I know that some of Sonicwall's firewalls offer the option of spam filtering that on their TZ series is pretty cheap, but with Sonicwall's history I am skeptical of its' effectiveness. I used GFI years ago, but wasn't very impressed at the time. Perhaps they have improved?

Ideally I would shift them to a hosted solution that had included spam filtering and retire their on prem Exchange server as for their size it would be rather expensive to effectively maintain properly. For larger organizations with 100s of mailboxes on premises can be cheaper particularly if most use relatively little amount of storage, but for small organizations the math seems absurd. They aren't in a regulated industry like healthcare or finance so that type of rationalization for on premises mail doesn't seem relevant and even if they were a many hosted providers offer compliant data centers to meet many regulatory requirements. I've already tried showing them the numbers for hosted mailboxes vs the cost of replacing a server every 5 years plus hardware support and they didn't seem interested in shifting. If the dollars and sense don't phase them I'm not sure what else will.

Does anybody have any other angles I haven't tried to convince them to retire on premises mail? Does anybody have any other spam filtering solutions that they would recommend in case they stick to on premises?