Email security for marketing agencies: protect your clients and yourself

A marketing agency sits in the middle of many brands. You send email as your clients, log in to their email platforms and ad accounts, and often manage their DNS. That access is valuable to criminals: one stolen agency login can reach every client at once, and mail sent from an authorized platform passes every authentication check. This guide covers the email risks specific to agencies, how to authenticate client sending properly, and how to stop sharing passwords.

Why are marketing agencies a target?

Agencies are targeted because they concentrate access to many brands in a few accounts. An attacker who compromises one agency account manager can often reach:

• Email service provider (ESP) accounts for several clients, with their subscriber lists and approved sending domains.
• Ad accounts on Google and Meta, with saved payment methods.
• DNS and registrar logins, which control where every client email goes.
• Invoices and payments flowing between the agency, its clients and freelancers.

That's a supply-chain risk. When an attacker uses a real client's ESP account, the phishing is sent from authorized servers with valid DKIM, so SPF, DKIM and DMARC all pass. Authentication proves where mail came from, not that the person who sent it was supposed to.

What email threats do agencies face?

Fake platform notices

Agency staff get a constant stream of genuine notifications from ad platforms, social networks and ESPs, which makes fake ones easy to slip in. The usual lure is a policy violation, a suspended ad account or a failed payment, with a link to an "appeal" page that steals the password and MFA code. Our guide to fake Meta page violation emails covers the most common version, and file sharing notification phishing covers fake "brand assets" and "creative brief" share links.

The habit to teach: never sign in from a link in a notification. Open the platform from a bookmark and look for the same warning there.

Invoice fraud between agencies and clients

Retainers and media spend move on a predictable monthly schedule. A criminal who registers a lookalike of your domain, or takes over a mailbox, can send your client a "new bank details" notice just before payment is due. The FBI tells businesses to use "secondary channels and/or two-factor authentication to verify requests for changes in account information" (FBI IC3). Put a line on every invoice saying you'll never change bank details by email. See vendor invoice fraud for the full procedure.

How should an agency authenticate email it sends for clients?

Send each client's mail from the client's own domain, or a subdomain of it, with DKIM signed by that domain and a DMARC record the client controls. That keeps reputation with the client and lets receivers verify the mail. Gmail's sender guidelines require bulk senders to set up DMARC and to align the From domain "with either the SPF domain or the DKIM domain". Marketing messages must also support one-click unsubscribe. Google's sender FAQ defines a bulk sender as one sending "close to 5,000 messages or more to personal Gmail accounts" within 24 hours. Our guide to Gmail, Yahoo and Microsoft bulk sender requirements compares all three.

Step by step for a new client

1. Agree the sending domain. Many agencies use a marketing subdomain such as news.client.com, so campaign reputation is kept somewhat apart from the client's staff mail (Gmail still counts "all messages sent from the same primary domain", subdomains included, toward its bulk sender threshold). See separate subdomains for marketing email.
2. Add the ESP's DKIM records to the client's DNS. Most ESPs give you two CNAMEs. Exact names vary by platform; see the provider pages for Mailchimp, HubSpot and Klaviyo.
3. Merge any SPF include into the domain's single existing SPF record if the ESP asks for one. Never publish a second SPF record; see multiple SPF records.
4. Confirm DMARC exists on the client's domain, with reports going to an address the client controls.
5. Send a test and check the headers with the Email Header Analyzer. Look for dkim=pass with header.d= matching the From domain.
6. Record what you changed in the client file, so the next person knows which records belong to which service.

Here's what a typical set of records might look like for an example client (names and targets are placeholders; use the values your ESP shows):

s1._domainkey.news.example-client.com  CNAME  s1.dkim.esp-example.net
s2._domainkey.news.example-client.com  CNAME  s2.dkim.esp-example.net
_dmarc.example-client.com              TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example-client.com"

Our guide to authenticating third-party senders explains why SPF alone often fails DMARC for ESP mail, and why aligned DKIM is the fix.

Who is responsible for compliance?

The FTC's CAN-SPAM guide is direct: "you can't contract away your legal responsibility to comply with the law." Both the company whose product is promoted and the company that sends the message "may be held legally responsible", and each violating email can carry a penalty of up to $53,088 at the time of the guide's January 2024 update (FTC). Opt-outs must be honored within 10 business days. Agree in your contract who processes unsubscribes and keeps records. This is general information, not legal advice.

How do agencies stop sharing client passwords?

Use each platform's delegated access instead of a shared login. Delegation gives each person their own sign-in with their own MFA, leaves the client as owner, and lets the client remove you without changing a password.

Where a platform has no delegation, keep the credential in a business password manager with access limited to the people on that account. CISA recommends a password manager because it "generates, stores and even fills in all your passwords" and helps you "use a different strong password for each account" (CISA).

When someone leaves your agency, remove them from every client platform the same day. Our offboarding guide has a checklist you can extend with client platforms.

How do you protect your own agency domain?

Protect your domain the way you'd tell a client to. Publish SPF, DKIM and DMARC and move DMARC to p=reject, which CISA's joint phishing guidance recommends ("Ensure DMARC is set to 'reject' for sent emails", CISA and partners, October 2023). That stops exact-domain spoofing of your invoices. For lookalikes, run your name and your biggest clients' names through the Lookalike Domain Generator and read lookalike domain phishing for what to do with the results.

If you also manage client DNS, our page for web and digital agencies covers making MX and SPF changes without breaking a client's mail.

Marketing agency email security checklist

1. MFA everywhere: your mailboxes, every ESP, ad platform, social account, registrar and DNS host.
2. No shared logins. Move to manager accounts, partner access and individual ESP seats.
3. Password manager for anything that can't be delegated.
4. Client domains only: send each client's mail from its own authenticated domain or subdomain, with aligned DKIM.
5. DMARC on every client sending domain, with reports going to the client.
6. DMARC at reject on your own domain, and a "we never change bank details by email" line on invoices.
7. Call-back rule for any change to client, freelancer or vendor bank details.
8. Bookmark, don't click: staff open platforms from bookmarks, never from notification emails.
9. Same-day offboarding across every client platform.
10. Inbound filtering for phishing and malicious attachments, since agency inboxes receive many unsolicited files and links.

Next steps

• Check each client's sending domain with the DMARC Checker and DKIM Checker before the next campaign.
• List every client platform where your team still shares a password, and move the first three to delegated access this month.
• If you look after client domains and want to offer inbound filtering they own and pay for themselves, see iBlockSpam for web and digital agencies. Filtering protects inboxes; it doesn't replace MFA or delegated access.