How do you manage email security across multiple domains?

Businesses collect domains. A new brand, a regional site, an acquisition, a campaign, an old name kept to protect a trademark. Each one can receive mail, be used to send mail, or be forged by someone else. This guide shows how to get every domain under control: what to record, how to classify each one, and how to roll out and keep protection across the whole estate.

If you have one domain, how to stop spam for your whole domain is the place to start. This guide is about doing that consistently across many.

Why is managing several domains harder than one?

• Different platforms. One brand is on Microsoft 365, another on Google Workspace, a third on a cPanel host.
• Different DNS hosts. Domains bought at different times sit at different registrars, with different people able to change them.
• Different owners. Marketing bought the campaign domain; nobody remembers who has the login.
• Forgotten domains. Old and parked domains don't receive attention, which makes them attractive to people who want to send forged mail.

Most problems come from the domains nobody is looking at. The inventory fixes that.

It also helps when something goes wrong. If a customer forwards a phishing message that appears to come from one of your brands, you need to know at once whether that domain is yours, who runs it, and whether its DMARC policy should have stopped the message.

What should your domain inventory record?

List every domain you own, not just the ones with mailboxes. Pull names from your registrar accounts, invoices, acquisition paperwork, website and marketing teams. A DNS scan can't find domains you don't know about.

Run the Email Health Check on each domain and save the result next to its row.

How do you classify each domain?

Give every domain one role, then apply the matching controls.

Two cautions:

• Null MX (MX 0 .) tells senders the domain accepts no mail (RFC 7505). The RFC says mail systems should not publish it for domains they use as the sender address, because replies and bounces would fail. Use it only for domains that neither receive nor send.
• Don't switch off a domain that still gets real mail. Check your platform's logs for recent mail to an old domain before you retire it.

Our guide to protecting parked domains from spoofing has the exact records.

Why should non-sending domains get DMARC too?

A forger doesn't need your main domain. Any domain you own will do, especially one nobody watches. US federal agencies were told to publish DMARC p=reject on all second-level domains, including ones that don't send mail, under CISA's Binding Operational Directive 18-01. That directive doesn't apply to private businesses, but it's a clear example of treating the whole estate as one surface.

M3AAWG recommends v=spf1 -all for domains that never send. For sending domains, move from p=none to p=reject as RFC 9989 DMARC reports show your real senders passing. See moving DMARC from none to reject. Our own scan of the top 1,000 domains found that 38.3% don't enforce DMARC, so this is a common gap even for large organizations.

How do you roll out filtering across many domains?

Treat each receiving domain as its own cutover. A working setup for one brand doesn't prove the next one works, especially on a different platform.

1. Pick a low-risk first domain that still receives real mail, so you learn on something that matters but won't stop the business.
2. Save the current DNS and write the rollback steps.
3. Lower the MX TTL a day ahead.
4. Configure the platform side. On Microsoft 365 that's a partner connector with Enhanced Filtering for Connectors; on Google Workspace, an inbound gateway. Our Microsoft 365 and Google Workspace setup pages cover both.
5. Change MX, following how to change MX records without losing email.
6. Run the acceptance tests in how to test that a spam filter is working, including the bypass check.
7. Get the business owner's sign-off, then mark the domain as done in the inventory.
8. Move to the next domain. Group domains on the same platform once the first of each type has gone smoothly.

If you're replacing an existing filter, our guide to switching spam filter providers covers running both during the overlap.

What should be standard, and what can vary?

Set a minimum standard for every domain, and allow written exceptions where a business unit has a real reason.

Standard for all domains:

• A named business owner and technical owner.
• MFA on every registrar, DNS and mail admin account.
• SPF and DMARC published; p=reject for non-sending domains.
• Inbound mail filtered before it reaches the mailbox, with the direct path closed.
• Held mail reviewed on a schedule, with named reviewers for shared addresses.
• DNS changes logged and monitored.

May vary, with a written reason: attachment rules for a design team that exchanges large files, digest frequency for a sales team, country filters for a unit that trades abroad.

Platform limits can force your hand. Google says "You can't directly set different policies or configuration settings for different domains" in one Google Workspace account; you group users into organizational units instead (Google Workspace Admin Help). Plan your exceptions around how each platform applies policy.

How do you keep the estate under control?

• Monitor DNS. A web designer or registrar change can quietly move MX or break SPF. Alerts on MX, SPF and DMARC changes catch it before customers do.
• Watch for lookalikes. Every brand you own is a name someone can imitate with a near-identical domain. See lookalike domain phishing.
• Read DMARC reports for every sending domain, not just the main one. Our guide to how to read DMARC reports shows what to look for.
• Review the inventory each quarter. Add new domains, retire old ones on purpose, and confirm renewals.
• Update owners when things change. Acquisitions, closures and departures are when domains get lost.

How do you estimate filtering cost for several domains?

Count domains, not people, and check how each vendor treats aliases. With per-domain pricing, each separate domain is its own subscription. For example, 10 domains on iBlockSpam Protect at $144 per domain per year (beta pricing, USD, excluding tax) would be $1,440 a year before tax.

Then check volume by domain, not on average. Each iBlockSpam domain includes 100,000 inbound messages a month; mailboxes are unlimited by count, not by message volume. A busy brand and a quiet one don't share an allowance. Domain aliases, meaning extra domains that deliver to the same mailboxes, are unlimited, so an old brand that only forwards to current staff may not need its own plan. See per-domain vs per-user pricing and our pricing page.

Next steps

1. Build the inventory from registrar accounts and invoices, then classify every domain.
2. Run the Email Health Check on each one and fix missing SPF and DMARC first, starting with parked domains.
3. Plan a staged filtering rollout, one domain at a time, with sign-off per domain.
4. For ongoing checks, iBlockSpam's domain monitoring alerts on MX, SPF and DMARC changes for each protected domain (weekly on Protect, daily on Protect Plus), and the free Domain Watch covers one domain's public DNS at no cost. If an IT partner runs your estate, they can apply for our partner program; otherwise contact us with your domain list.

See more operations guides.