Email security for businesses with several domains or brands

If your business owns several domains, protect each one according to what it does. Domains that receive mail need filtering. Domains that send mail need SPF, DKIM and DMARC. Domains that do neither need locking down so nobody can forge them. iBlockSpam charges per filtered domain, so the bill follows the number of domains, not the number of people.

How is email security priced when you own several domains?

Each domain that receives mail and is filtered by iBlockSpam is its own subscription. Every subscription includes unlimited mailboxes and unlimited domain aliases, so adding staff or an alias name doesn't change the price. Different domains can be on different plans.

Here is what the published beta prices come to for one, three and five filtered domains. Prices are in USD, excluding tax.

Each domain costs the same; there's no multi-domain tier in the published prices. Monthly figures for annual plans are the annual price divided by 12, for comparison only, and month-to-month annual figures assume twelve months. Plan details and refund terms are on the pricing page. Our comparison of per-domain and per-user pricing shows when the per-domain model works out cheaper.

Which domains need a subscription and which don't?

Only domains that receive mail into their own mailboxes need filtering. Sort your domains first, because the answer decides your cost. Our guide to multi-domain email security explains how to build the full inventory.

An alias only works if the domain really does deliver to the same mailboxes. A brand with its own staff, its own mail platform or its own mailboxes is a separate domain.

What do you do with parked and unused domains?

Lock them down in DNS. A domain that never sends or receives mail should say so publicly, so receivers can reject forged messages that use it.

RFC 7505 defines the Null MX record (MX 0 .) for domains that accept no mail. Pair it with an SPF record of v=spf1 -all and a DMARC record at p=reject. CISA's guidance for US federal agencies makes the point that domains which don't send mail can still be spoofed (CISA BOD 18-01). Our guide to protecting parked domains from spoofing has the exact records, including wildcard records for subdomains.

These domains don't need a subscription, because there's no mail to filter. The trade-off: iBlockSpam's monitoring and DMARC reports cover domains that are verified and filtered on your account. To keep an eye on one unsubscribed domain's public records, Free Domain Watch checks one domain per email address every week.

How do you spot spoofing across every brand?

Use two kinds of watching: DMARC reports for your exact domains, and lookalike checks for names that only resemble them.

DMARC monitoring is included on both plans for each protected domain. Add rua=mailto:dmarc@iblockspam.com to the domain's DMARC record. We collect the daily aggregate reports receivers send, show who sends mail as that domain and whether it passes SPF, DKIM and DMARC, flag senders that need fixing and likely spoofing, and recommend when to move from p=none to quarantine and then reject. Counts come only from receivers that send reports, so they're lower than total mail sent. DMARC monitoring reports; it doesn't block mail by itself. DMARC itself is defined in RFC 9989. See DMARC monitoring.

Lookalike Domain Watch checks look-alike versions of each protected domain every day, through DNS and public certificate logs: typos, character swaps, look-alike characters and other endings. You get an alert when one is registered or gets a mail server. It detects; it can't take domains down. See Lookalike Domain Watch and our guide to lookalike domain phishing.

Domain monitoring alerts you when a protected domain's MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus. With several DNS hosts and several people able to edit them, drift is the common failure. See domain monitoring.

Can domains on different mail platforms share one filter?

Yes. Filtering happens at the MX level, so each domain's MX points to our filtering servers, and clean mail is delivered to wherever that domain's mailboxes live. One brand can be on Microsoft 365, another on Google Workspace and a third on a cPanel/WHM host. Each platform has its own setup steps, so treat each domain as its own cutover.

How do you roll out filtering across several domains?

One domain at a time. A staged rollout keeps any mistake to one domain and makes problems easier to trace.

1. List every domain you own and sort it into the four types in the table above.
2. Lock down the non-sending, non-receiving domains first. It's quick and needs no subscription.
3. Pick a low-risk receiving domain that still gets real mail, and add it first.
4. Lower the MX TTL a day ahead, then follow the guided setup for that domain's platform. The wizard shows a before/after DNS comparison and rollback steps.
5. Verify with real messages and the setup verifier before moving on.
6. Add the DMARC reporting address to each protected domain and review the first reports.
7. Repeat for the next domain, and set up aliases as you go.
8. Review monitoring alerts each week, and recheck the inventory when you buy or retire a domain.

If a domain moves from another filter, follow how to switch filters without losing email.

Honest limits

• Each domain includes 100,000 inbound messages a month, a 400 MB maximum inbound message size and 500 outbound relay messages a month. Unlimited mailboxes is a count, not message volume.
• DMARC monitoring, domain monitoring and Lookalike Domain Watch cover protected domains, not every domain you own.
• DMARC protects only your exact domains. Lookalike names can pass authentication for themselves, which is why lookalike checks and staff caution still matter.
• Mail is processed in the United States.

Start with the free Email Health Check on each domain, then create your account and add your first one.