Email security for nonprofits

Nonprofits need email filtering that stops phishing, impersonation of their own leaders and fake payment requests before they reach staff and volunteers, plus a habit of confirming any change to where money goes. iBlockSpam filters inbound mail at the MX level, in front of the Microsoft 365 or Google Workspace account you already have, and charges one price per domain.

For the wider picture, including volunteer accounts, board members' personal addresses and the Microsoft and Google nonprofit programs, read our guide to email security for nonprofits. This page covers what iBlockSpam does for a nonprofit and what it costs.

What email fraud hits nonprofits?

Mostly fraud that moves money: fake requests to pay, to change bank details or to buy gift cards, and impostors who collect donations in your name. The FBI defines business email compromise as a scam that "targets both businesses and individuals who perform legitimate transfer-of-funds requests," and puts exposed losses between October 2013 and December 2023 at more than $55 billion (FBI IC3 PSA I-091124-PSA). Nonprofits make those transfers every week: grants out, vendor payments, payroll.

These rows are typical examples, not a complete list. On grant offers, the FTC's advice is blunt: "don't pay any up-front fees" (FTC: Government Grant Scams). Its page is about government grants, but the same rule is a sound test for any funder.

The FBI's first recommendation for these scams is to "use secondary channels or two-factor authentication to verify requests for changes in account information" (IC3: Business Email Compromise). That habit works even when the message comes from a real, compromised mailbox that no filter would flag.

Donors are targets too. The FTC warns that "some scammers use names that sound a lot like real charities" and that if the only way to pay is by cryptocurrency, wire, a payment app or a gift card, "it's likely a scam" (FTC: Before Giving to a Charity). Our guide to charity and disaster relief scam emails covers what donors see.

Some nonprofits face more than fraud. CISA and international partners published guidance in May 2024 for civil society organizations, including nonprofit, advocacy and faith-based groups, which they describe as high-risk communities often targeted by state-sponsored actors (CISA: Mitigating Cyber Threats with Limited Resources).

What does iBlockSpam do for a nonprofit?

It checks every inbound message before it reaches anyone, and gives each person a simple way to find mail that was held.

Filtering in front of your existing platform

Your MX records point to our filtering servers. Mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to Microsoft 365, Google Workspace or your hosted server. You keep your nonprofit licenses, mailboxes and sign-ins. Approved and blocked sender lists can require sender verification, so a forged message claiming to be from your director or a trusted funder still gets checked. Advanced settings add attachment-type filters, a Microsoft Office macro filter, geographic filters and custom domain rules.

A quarantine volunteers can manage

Every user gets a personal quarantine and a digest email, hourly, daily, on a chosen weekday or on a custom schedule, so a volunteer can release a held message without calling anyone. A staff admin can review everything in the shared quarantine. See quarantine and digests.

Protecting your name with donors

DMARC tells receivers to reject mail that forges your exact domain. DMARC monitoring is included: add rua=mailto:dmarc@iblockspam.com to your DMARC record and we show who sends mail as your domain, which of your own senders (your donation platform, your newsletter tool) need fixing, and when it's safe to move to quarantine and then reject. It reports; it doesn't block mail by itself. Lookalike Domain Watch checks look-alike versions of your domain every day and alerts you when one is registered or gets a mail server. It can't take domains down. See DMARC monitoring and Lookalike Domain Watch.

Resilience for a small team

If your mail server is down, mail is held for up to 5 days and then delivered. You can search 30 days of message history. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus. That matters when a volunteer or web designer edits DNS.

What does it cost a nonprofit?

The same as anyone else. iBlockSpam has no nonprofit discount at the time of writing. Pricing is per domain, so it doesn't grow with your volunteer list.

Prices are beta pricing in USD, excluding tax. A first annual subscription for a domain has a 30-day money-back guarantee. There's no free trial. Domain aliases are unlimited, so an old name that delivers to the same mailboxes doesn't need its own plan. See pricing.

Microsoft and Google both run nonprofit programs. Microsoft says it provides eligible nonprofits up to 300 granted licenses of Microsoft 365 Business Basic, plus discounts on many other offers (Microsoft Learn: Microsoft for Nonprofits updates). Google offers a no-cost Google Workspace for Nonprofits edition to eligible organizations (Google for Nonprofits). Both check eligibility first. Those programs cover your mailboxes; iBlockSpam is a separate layer in front of them. Before deciding, read whether Microsoft 365's built-in filtering or Google Workspace's built-in protection is enough for you.

How do you set it up?

Most nonprofits need one administrator and access to their DNS host.

1. Check your domain with the free Email Health Check to see your current MX, SPF and DMARC records.
2. Confirm admin access to your Microsoft 365 or Google Workspace account and your DNS host. Volunteers who set things up years ago may hold the logins.
3. Create your account and add your domain. The guided setup shows a before/after DNS comparison and rollback steps.
4. Do the platform step, such as the Microsoft 365 connector or the Google Workspace inbound gateway, then change MX.
5. Send test messages and check the setup verifier.
6. Add the DMARC reporting address, then fix the senders the reports show.
7. Write down your payment rule: any new or changed bank details, and any gift card request, is confirmed by phone on a number you already have. Our guide to vendor invoice fraud sets out a call-back process.
8. Tell donors you'll never ask for gift cards or change bank details by email.

Honest limits

• No filter catches every phishing message, and sometimes a real message is held. Digests help people find it quickly.
• A message from a real, compromised mailbox can pass authentication. The call-back rule is the defense for payments.
• iBlockSpam filters inbound mail. It doesn't secure your donation platform or payment processor logins, or replace volunteer training.
• Mail is processed in the United States. iBlockSpam holds no SOC 2 or ISO certification.

Start with the free Email Health Check, then create your account.

Sources

• FBI IC3 PSA I-091124-PSA: Business Email Compromise, the $55 billion scam
• FBI IC3: Business Email Compromise
• FTC: Before Giving to a Charity
• FTC: Government Grant Scams
• CISA and partners: Mitigating Cyber Threats with Limited Resources, Guidance for Civil Society
• Microsoft Learn: Microsoft for Nonprofits updates
• Google for Nonprofits: Google Workspace for Nonprofits