In short: Sophos Email Plus includes everything in Sophos Email and adds contact trace and recall of forwarded threats, message replay, extended message history, and Sophos DMARC Manager with guided DMARC policy conformance. Sophos Email Plus also includes Phish Threat, while Portal Encryption remains an optional add-on for both tiers.
What is Sophos Email Plus?
Sophos describes Sophos Email Plus as Sophos Email with additional advanced protection and reporting. The core detection is the same in both tiers: the AI and natural language models, sandboxing, time-of-click URL protection, QR-code scanning, impersonation protection and DLP described on our Sophos Email page all apply to both.
What Email Plus adds is mostly about what happens after a threat is found and protecting your own domain from being spoofed. If your team investigates email incidents, or you are working towards DMARC enforcement, Plus is usually the better fit.
Sophos Email vs Sophos Email Plus
The table below shows only the differences we have verified against Sophos's published tech specs in October 2026. Every other listed feature is in both tiers.
| Feature | Sophos Email | Sophos Email Plus |
|---|---|---|
| Core protection (anti-spam, malware, sandbox, URL, QR-code, NLP phishing and BEC, DLP, encryption) | Included | Included |
| Sophos Phish Threat simulation and training | Included | Included |
| Contact trace and recall | Not included | Included |
| Message replay | Not included | Included |
| Extended message history | Not included | Included |
| Sophos DMARC Manager | Add-on | Included |
| Implementation and management of DMARC policy conformance | Add-on | Included |
| Portal Encryption (pull-based full portal encryption) | Add-on | Add-on |
| Sophos XDR and MDR integration and response actions | Included (needs XDR or MDR) | Included (needs XDR or MDR) |
What the extra features do
- Contact trace and recall: when a malicious message is found, trace who else received it, including copies forwarded on internally, and pull those back too, so one user forwarding a phishing email to colleagues does not spread the attack
- Message replay: re-deliver messages that Sophos Email has already processed, which helps when mail needs to be delivered again after a problem
- Extended message history: a longer record of message activity to search when investigating an incident or answering 'did we receive that email?' questions
- DMARC Manager: analyse DMARC reports, see every service sending as your domain, manage DNS records and move safely to an enforcing DMARC policy; see Sophos DMARC Manager
Who should choose Sophos Email Plus
- Organisations with an internal IT or security team that investigates email incidents and needs trace, recall and longer history
- Businesses that send invoices, payment requests or other high-value email and need to stop criminals spoofing their domain
- Anyone who has to meet the email authentication requirements of the major mailbox providers, or follow NCSC guidance on DMARC
- Customers who would otherwise buy Sophos Email plus the DMARC Manager add-on, where Plus may be simpler
Sophos Email on its own suits smaller organisations whose main need is strong inbound filtering and who already have DMARC in hand, or who rely on Sophos MDR for investigation.
A worked example
Imagine a convincing fake supplier invoice reaches one member of your finance team, who forwards it to two colleagues before anyone spots it. With Sophos Email, you can claw back the original message once it is identified. With Email Plus, contact trace and recall also finds and pulls back the forwarded copies, and extended message history lets you check whether similar messages arrived earlier. Meanwhile, DMARC Manager helps make sure criminals cannot send that same fake invoice to your customers from your own domain.
Licensing and upgrading
Both tiers are licensed per individual user and shared mailbox, counted over the last 30 days, with aliases, distribution lists and public folders not counted. Because Email Plus is the same service with extra features, moving up from Sophos Email is a change of licence rather than a new deployment, so mail flow and policies carry on as they are. Portal Encryption remains an add-on with either tier.
See Sophos licensing explained for how Sophos licences work across products. We will quote both tiers side by side so you can see the difference for your mailbox count.
How we help
We review your current email security and DMARC status, recommend a tier, and if you choose Plus, set up DMARC Manager and plan the route to enforcement with you. If you already run Sophos Email, we can arrange the upgrade at renewal or mid-term.
Contact us for a side-by-side quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Sophos Email Plus include?
Everything in Sophos Email, plus contact trace and recall, message replay, extended message history and Sophos DMARC Manager with DMARC policy conformance management.
Is DMARC Manager included in Sophos Email?
No. Sophos DMARC Manager is included with Sophos Email Plus, and available as an add-on for Sophos Email and Sophos Email Monitoring System customers.
Does Sophos Email Plus include encryption?
Both tiers include TLS, S/MIME and push-based message and attachment encryption. Pull-based full portal encryption is the Portal Encryption add-on for either tier.
Can I upgrade from Sophos Email to Sophos Email Plus?
Yes. It is a licence change rather than a redeployment, so your mail flow and policies stay as they are. We can arrange it at renewal or mid-term.