Email protection for law firms, priced per domain

A law firm needs email filtering that stops phishing, spoofed senders and malicious attachments before they reach lawyers and staff. It also needs clear quarantine controls and a payment-verification process that email can't override. iBlockSpam filters mail at the MX level, in front of the platform you already use, for one price per domain.

Why law firms are targeted

Law firms hold client confidences, run client money through trust accounts and send payment instructions by email. That makes them useful to criminals in two ways: as a source of information and as a route to money.

Business email compromise (BEC) is the main financial threat. The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and $3,046,598,558 in reported losses in 2025 (IC3 2025 Internet Crime Report). The same report describes a 2025 case in which home buyers received an email impersonating their attorneys and wired more than $449,000 to a criminal's account. An earlier IC3 alert lists real estate attorneys among the targets of BEC in property transactions and explains the method: criminals get into one participant's email, watch the deal and time a request to change payment details (IC3 PSA I-060923-PSA).

Common attacks on firms

• Changed payment instructions. A message that appears to come from a client, a lender or opposing counsel says the receiving account has changed. Our guide to vendor invoice fraud and payment redirection shows how these requests are built.
• Impersonation of clients and opposing counsel. Criminals register lookalike domains one character away from the real one, or spoof the display name.
• Credential phishing. Fake document-sharing or e-filing notices lead to sign-in pages that steal passwords. Some put the link in a QR code, which is harder to inspect.
• Malicious attachments. Invoices, "engagement letters" and court documents that carry macros or malware.

What the professional guidance says

The ABA Standing Committee on Ethics and Professional Responsibility has addressed email security in two formal opinions (ABA formal ethics opinions):

• Formal Opinion 477R (2017) says a lawyer generally may send client information over the internet after making reasonable efforts to prevent unauthorized access. What counts as reasonable depends on factors such as the sensitivity of the information and the cost and difficulty of safeguards. It also says lawyers must train staff in reasonably secure electronic communication.
• Formal Opinion 483 (2018) says lawyers must make reasonable efforts to monitor their technology for breaches, and must notify clients when a breach involves, or is substantially likely to involve, material client information.

These opinions are advisory. Your own jurisdiction's rules control. This page isn't legal advice, and iBlockSpam doesn't make any firm compliant with any rule. Filtering is one safeguard among several you might choose.

What iBlockSpam does for a firm

Filtering before mail reaches anyone

Your MX records point to our filtering servers. Inbound mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace, Exchange Server or your hosted server. Advanced settings add attachment-type filters, a Microsoft Office macro filter, geographic filters and custom domain rules. If you're deciding whether you need a gateway at all, compare it with Defender for Office 365 or Google Workspace's built-in protection.

Quarantine for each lawyer, oversight for the office

• A personal quarantine for every user, with digests hourly, daily, on a chosen weekday or on a custom schedule. A lawyer waiting for a filing receipt can find and release it without calling IT.
• A shared quarantine so an administrator can review held mail for the whole domain.
• Approved and blocked sender lists that can require sender verification, so a spoofed message claiming to be from an approved client doesn't skip the checks. See allow and block lists.

Learn more about quarantine and digests.

Records and resilience

You can search 30 days of message history to answer "did that email arrive?" If your mail server is down, mail is held for up to 5 days and then delivered. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect and daily on Protect Plus.

A verification process filtering can't replace

Filtering lowers the volume of fraud that reaches inboxes. The control that stops a fraudulent payment is a process. These steps follow FBI guidance to verify account changes through a secondary channel:

1. Tell clients at intake that your firm will never change payment instructions by email.
2. Call to confirm any new or changed instructions using a phone number from the file, never one in the message. The CFPB gives home buyers the same advice: confirm closing details only by phone, with numbers saved in advance (CFPB: Beware of mortgage closing scams).
3. Require a second person to approve outgoing trust account wires.
4. Check the sender's full address, not just the display name, especially on a phone.
5. If money has gone, act at once. Ask your bank to recall the wire and file a complaint at ic3.gov. The IC3's Recovery Asset Team can ask the receiving bank to freeze funds.

Our BEC prevention guide goes into more detail.

Getting set up

Setup is an MX change plus a few platform-specific steps, guided by our setup wizard. It shows a before/after DNS comparison and the rollback steps for your domain.

1. Check your domain with the free Email Health Check. It reads public DNS only.
2. Add each firm domain and point it at the mail platform you use today.
3. Follow the platform steps, for example a locked-down inbound connector in Microsoft 365 or a scoped Receive connector on Exchange Server.
4. Send test messages and watch the first digests arrive before you tell the whole firm.

Most domains are set up in one session. That's our aim, not a promise, because DNS and platform settings vary. On Protect Plus, a person from our team runs the setup session with you. If your firm handles closings, our page for real estate and title teams covers the client side of wire fraud, and firms that share clients with accountants can point them to our page for accounting firms.

Priced per domain, not per lawyer

Prices are beta pricing in USD, excluding tax. Hiring an associate doesn't change your bill. A firm with a second brand or a separate practice domain pays per domain, and domain aliases are unlimited. Compare the models in per-domain vs per-user pricing.

Honest limits

• No filter catches every malicious message, and sometimes a legitimate one is held. Digests exist so people can find and release it quickly.
• Mail sent from a client's real, compromised mailbox can pass every authentication check. Payment verification is the defense.
• iBlockSpam filters inbound mail. It doesn't encrypt your outgoing client messages, replace multi-factor authentication or train your staff.
• iBlockSpam holds no SOC 2 or ISO certification. Mail is processed in the United States.

To start, run the free Email Health Check on your firm's domain, then create your account.

Sources

• FBI IC3: 2025 Internet Crime Report
• FBI IC3: Business Email Compromise: The $50 Billion Scam (I-060923-PSA)
• FBI IC3: Business Email Compromise: The $55 Billion Scam (I-091124-PSA)
• CFPB: Buying a home? Beware of mortgage closing scams
• ABA Standing Committee on Ethics and Professional Responsibility: formal opinions, including 477R (2017) and 483 (2018)