# Email security for businesses with several domains or brands

URL: https://iblockspam.com/solutions/multiple-domains
Last updated: 2026-10-19

> Protect every domain and brand your business owns: per-domain email filtering, unlimited aliases, DMARC monitoring and lookalike alerts, with clear costs.

Filter every domain that receives mail, lock down the ones that don't, and watch all of them for spoofing. Each filtered domain is its own subscription, with unlimited mailboxes and unlimited domain aliases.

If your business owns several domains, protect each one according to what it does. Domains that receive mail need filtering. Domains that send mail need SPF, DKIM and DMARC. Domains that do neither need locking down so nobody can forge them. iBlockSpam charges per filtered domain, so the bill follows the number of domains, not the number of people.

## How is email security priced when you own several domains?

Each domain that receives mail and is filtered by iBlockSpam is its own subscription. Every subscription includes unlimited mailboxes and unlimited domain aliases, so adding staff or an alias name doesn't change the price. Different domains can be on different plans.

Here is what the published beta prices come to for one, three and five filtered domains. Prices are in USD, excluding tax.

| Filtered domains | Protect, billed annually | Protect, month-to-month | Protect Plus, billed annually | Protect Plus, month-to-month |
|---|---|---|---|---|
| 1 | $144/year ($12/month) | $15/month ($180/year) | $228/year ($19/month) | $24/month ($288/year) |
| 3 | $432/year ($36/month) | $45/month ($540/year) | $684/year ($57/month) | $72/month ($864/year) |
| 5 | $720/year ($60/month) | $75/month ($900/year) | $1,140/year ($95/month) | $120/month ($1,440/year) |

Each domain costs the same; there's no multi-domain tier in the published prices. Monthly figures for annual plans are the annual price divided by 12, for comparison only, and month-to-month annual figures assume twelve months. Plan details and refund terms are on the [pricing page](https://iblockspam.com/pricing). Our comparison of [per-domain and per-user pricing](https://iblockspam.com/compare/per-domain-vs-per-user-pricing) shows when the per-domain model works out cheaper.

## Which domains need a subscription and which don't?

Only domains that receive mail into their own mailboxes need filtering. Sort your domains first, because the answer decides your cost. Our guide to [multi-domain email security](https://iblockspam.com/blog/multi-domain-email-security-guide) explains how to build the full inventory.

| What the domain does | Example | What it needs |
|---|---|---|
| Receives mail into its own mailboxes | Main company domain, a separately staffed brand | Filtering (one subscription), plus SPF, DKIM and DMARC |
| Delivers to the same mailboxes as a protected domain | An old company name, a spelling variant you own | Set up as a domain alias: included, unlimited |
| Sends mail but receives none | A newsletter or receipts domain | SPF, DKIM and DMARC; a Null MX if nothing should arrive |
| Neither sends nor receives | Parked, defensive or campaign domains | Null MX, `v=spf1 -all` and DMARC `p=reject` |

An alias only works if the domain really does deliver to the same mailboxes. A brand with its own staff, its own mail platform or its own mailboxes is a separate domain.

## What do you do with parked and unused domains?

Lock them down in DNS. A domain that never sends or receives mail should say so publicly, so receivers can reject forged messages that use it.

[RFC 7505](https://www.rfc-editor.org/rfc/rfc7505.html) defines the Null MX record (`MX 0 .`) for domains that accept no mail. Pair it with an SPF record of `v=spf1 -all` and a DMARC record at `p=reject`. CISA's guidance for US federal agencies makes the point that domains which don't send mail can still be spoofed ([CISA BOD 18-01](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security)). Our guide to [protecting parked domains from spoofing](https://iblockspam.com/blog/protect-parked-domains-from-spoofing) has the exact records, including wildcard records for subdomains.

These domains don't need a subscription, because there's no mail to filter. The trade-off: iBlockSpam's monitoring and DMARC reports cover domains that are verified and filtered on your account. To keep an eye on one unsubscribed domain's public records, [Free Domain Watch](https://iblockspam.com/free-monitoring) checks one domain per email address every week.

## How do you spot spoofing across every brand?

Use two kinds of watching: DMARC reports for your exact domains, and lookalike checks for names that only resemble them.

**DMARC monitoring** is included on both plans for each protected domain. Add `rua=mailto:dmarc@iblockspam.com` to the domain's DMARC record. We collect the daily aggregate reports receivers send, show who sends mail as that domain and whether it passes SPF, DKIM and DMARC, flag senders that need fixing and likely spoofing, and recommend when to move from `p=none` to `quarantine` and then `reject`. Counts come only from receivers that send reports, so they're lower than total mail sent. DMARC monitoring reports; it doesn't block mail by itself. DMARC itself is defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html). See [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring).

**Lookalike Domain Watch** checks look-alike versions of each protected domain every day, through DNS and public certificate logs: typos, character swaps, look-alike characters and other endings. You get an alert when one is registered or gets a mail server. It detects; it can't take domains down. See [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) and our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

**Domain monitoring** alerts you when a protected domain's MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus. With several DNS hosts and several people able to edit them, drift is the common failure. See [domain monitoring](https://iblockspam.com/features/domain-monitoring).

## Can domains on different mail platforms share one filter?

Yes. Filtering happens at the MX level, so each domain's MX points to our filtering servers, and clean mail is delivered to wherever that domain's mailboxes live. One brand can be on [Microsoft 365](https://iblockspam.com/platforms/microsoft-365), another on [Google Workspace](https://iblockspam.com/platforms/google-workspace) and a third on a [cPanel/WHM](https://iblockspam.com/platforms/cpanel-whm) host. Each platform has its own setup steps, so treat each domain as its own cutover.

## How do you roll out filtering across several domains?

One domain at a time. A staged rollout keeps any mistake to one domain and makes problems easier to trace.

1. **List every domain** you own and sort it into the four types in the table above.
2. **Lock down the non-sending, non-receiving domains** first. It's quick and needs no subscription.
3. **Pick a low-risk receiving domain** that still gets real mail, and add it first.
4. **Lower the MX TTL** a day ahead, then follow the guided setup for that domain's platform. The wizard shows a before/after DNS comparison and rollback steps.
5. **Verify with real messages** and the setup verifier before moving on.
6. **Add the DMARC reporting address** to each protected domain and review the first reports.
7. **Repeat for the next domain**, and set up aliases as you go.
8. **Review monitoring alerts** each week, and recheck the inventory when you buy or retire a domain.

If a domain moves from another filter, follow [how to switch filters without losing email](https://iblockspam.com/migrate).

## Honest limits

- Each domain includes 100,000 inbound messages a month, a 400 MB maximum inbound message size and 500 outbound relay messages a month. Unlimited mailboxes is a count, not message volume.
- DMARC monitoring, domain monitoring and Lookalike Domain Watch cover protected domains, not every domain you own.
- DMARC protects only your exact domains. Lookalike names can pass authentication for themselves, which is why lookalike checks and staff caution still matter.
- Mail is processed in the United States.

Start with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on each domain, then [create your account](https://iblockspam.com/signup) and add your first one.

## Frequently asked questions

### Does each of my brands need its own iBlockSpam subscription?

Only brands that are separate domains with their own mailboxes. Each of those is one subscription. A domain alias, meaning an extra domain that delivers to the same mailboxes as a protected domain, is included, and aliases are unlimited. Unlimited mailboxes means mailbox count, not message volume: each domain includes 100,000 inbound messages a month.

### Can different domains use different plans?

Yes. Billing is one subscription per domain, so you can put your main trading domain on Protect Plus for daily monitoring and a human setup session, and a smaller brand on Protect. Each subscription renews on its own, and you can cancel one in the billing portal without touching the others.

### Do I need to filter a domain that never receives email?

No. A domain with no mailboxes has nothing to filter. Lock it down in DNS instead: a Null MX, an SPF record of v=spf1 -all and a DMARC record at p=reject tell receivers that any mail using it is forged. Those records cost nothing beyond your DNS hosting.

### Can one dashboard show every domain we own?

Every domain you add to your iBlockSpam account appears in the same portal, each with its own setup checks, monitoring alerts, DMARC reports and lookalike results. Domains you lock down but don't subscribe are not filtered or monitored there; Free Domain Watch can check one domain per email address.

---

Source: iBlockSpam, https://iblockspam.com/solutions/multiple-domains (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt