LevelBlue MailMarshal and Conbool compared.
MailMarshal is a secure email gateway with a long history and four owners. Conbool is a suite of nine modules under one contract. This page compares what is publicly documented.
Provenance
The road this product travelled.
The history is not an accusation, it is a procurement topic. Anyone signing today should know how often vendor and account team have changed, and who will hold the contract tomorrow.
- 1
NetIQ
MailMarshal is created and becomes known as Mail Marshal.
- 2
M86 Security
The product moves to M86 Security and is developed there.
- 3
Trustwave
Trustwave acquires M86 and renames the product Trustwave Secure Email Gateway. The MailMarshal name later returns at customer request.
- 4
LevelBlue, since 2025
LevelBlue acquires Trustwave. The product is now called LevelBlue MailMarshal and its knowledge base lives at support.levelblue.com.
In fairness: the product is still maintained. The knowledge base lists version 12.0 dated 11 August 2026.
Sources: levelblue.com, MailMarshal Secure Email Gateway product brief, the MailMarshal knowledge base at support.levelblue.com and the Trustwave blog post on the renaming. Retrieved in September 2026.
Useful in the conversation
Three questions worth asking any vendor.
Including us. The answers say more about the next five years than any feature list.
Who is my contracting party, and in which country?
With us it is Conbool GmbH in Germany. With an international group it is worth asking which entity signs and which law applies.
What happens when I need more than filtering in three years?
Archiving, backup, awareness and continuity are modules of the same platform here. Otherwise the next procurement follows, with its own console and its own audit log.
How do I get out again?
Ask about export, retention and the way back before you go in. With us, decommissioning is documented.
Scope
Gateway or platform.
MailMarshal is described as a secure email gateway: filtering, rules, TLS. That maps onto our MailGuard module. Everything beyond is a question of scope.
LevelBlue MailMarshal
According to the vendor a secure email gateway against spam, ransomware and phishing, combining machine learning with rules curated over decades, deployable on premises, in the cloud or hybrid, connecting to Microsoft 365, Google Workspace and other systems. The family includes MailMarshal SEG, MailMarshal Exchange, MailMarshal Secure Email Server and MailMarshal Cloud. TLS and certificate management are documented.
S/MIME, OpenPGP, a recipient portal, archiving, Microsoft 365 backup, awareness training and continuity are not stated in the public material. Whether your contract includes more is a question for the vendor.
Conbool
MailGuard filters inbound mail with an attachment filter, CDR and a retroactive threat scan. Alongside it sit eight further modules in the same console: SecureMail with S/MIME, OpenPGP, message portal and PDF password, SecureFiles, Disclaimer, DMARC Reports, Archive with WORM, 365 Backup, Awareness and Continuity.
One admin portal, one audit log, one contract, a German contracting party. Operated either in EU data centres or in your own data centre.
Migration
If you switch, in five steps.
- 1
Preserve the rule set
Export your rules, exceptions and word lists. A rule set grown over years is the real value of your installation, not the software beneath it.
- 2
Run in parallel
A pilot domain or selected mailboxes additionally route through Conbool. Nothing is switched off while nothing is proven.
- 3
Measure in audit mode
MailGuard starts in audit mode and scores without blocking. You see the difference on your own traffic instead of on test messages.
- 4
Cut over and close direct send
After the switch, gateway bypass is rejected, otherwise mail slips past the new protection.
- 5
Decommission the old installation
Only after a defined parallel period. Windows servers and the maintenance contract fall away, the rule set stays documented.
Fits you
When Conbool is the better choice.
- You want filtering and encryption from one source instead of procuring a second product for S/MIME and a recipient portal.
- Evidence obligations are coming: a WORM archive, four-eyes approval for access to other people's mailboxes and an event log going to Splunk or Sentinel.
- You want a German contracting party and the data location named in the processing agreement.
- Mail has to keep flowing even when the mailbox system is down.
- Cloud or your own data centre should stay your decision, with the same software.
Fairness
When MailMarshal remains the right choice.
- You run a rule set grown over years that your team knows, and you want to keep exactly that rule language.
- You are a service provider and need the Service Provider Edition with its tenant separation.
- Filtering is enough because encryption, archiving and backup are solved elsewhere.
- Your environment is built around Windows Server and operations there run smoothly.
Frequently asked questions
Sources and fairness note
Statements about MailMarshal are taken from publicly available vendor sources: levelblue.com, the MailMarshal Secure Email Gateway product brief, the knowledge base at support.levelblue.com and the Trustwave blog post on the renaming, retrieved in September 2026. MailMarshal, Trustwave and LevelBlue are trademarks of their respective owners and we are not affiliated with them. Products change; have the terms that apply to your contract confirmed in writing. Statements about Conbool are described in our documentation and verifiable in a demo.
Measure it on your own traffic.
One pilot domain, MailGuard in audit mode, two weeks. After that you see the difference in numbers rather than in datasheets.