# Email security for nonprofits

URL: https://iblockspam.com/solutions/nonprofits
Last updated: 2026-10-19

> Email filtering for nonprofits: stop donation, grant and payment-redirection scams before they reach staff and volunteers, priced per domain, not per user.

Filter phishing, spoofed directors and fake payment requests before they reach your staff and volunteers. One price covers the whole domain, however many volunteer mailboxes you run.

Nonprofits need email filtering that stops phishing, impersonation of their own leaders and fake payment requests before they reach staff and volunteers, plus a habit of confirming any change to where money goes. iBlockSpam filters inbound mail at the MX level, in front of the Microsoft 365 or Google Workspace account you already have, and charges one price per domain.

For the wider picture, including volunteer accounts, board members' personal addresses and the Microsoft and Google nonprofit programs, read our guide to [email security for nonprofits](https://iblockspam.com/blog/email-security-for-nonprofits). This page covers what iBlockSpam does for a nonprofit and what it costs.

## What email fraud hits nonprofits?

Mostly fraud that moves money: fake requests to pay, to change bank details or to buy gift cards, and impostors who collect donations in your name. The FBI defines business email compromise as a scam that "targets both businesses and individuals who perform legitimate transfer-of-funds requests," and puts exposed losses between October 2013 and December 2023 at more than $55 billion ([FBI IC3 PSA I-091124-PSA](https://www.ic3.gov/PSA/2024/PSA240911)). Nonprofits make those transfers every week: grants out, vendor payments, payroll.

| Scam | What it looks like | What stops it |
|---|---|---|
| Executive impersonation | "It's the director. I'm in a meeting, please buy gift cards for the volunteers" | Spoofing protection, and a rule that nobody buys gift cards because of an email |
| Vendor or grantee bank change | A supplier or grant recipient "updates" its account details by email | A call-back to a number you already have, before any payment |
| Fake funder | For example, a "foundation" offers a grant if you pay a processing fee or sign in to a portal | Filtering, and never signing in from an email link |
| Donation impostor | A lookalike site or email collects gifts in your name | DMARC enforcement on your domain and watching for lookalike domains |

These rows are typical examples, not a complete list. On grant offers, the FTC's advice is blunt: "don't pay any up-front fees" ([FTC: Government Grant Scams](https://consumer.ftc.gov/articles/government-grant-scams)). Its page is about government grants, but the same rule is a sound test for any funder.

The FBI's first recommendation for these scams is to "use secondary channels or two-factor authentication to verify requests for changes in account information" ([IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC)). That habit works even when the message comes from a real, compromised mailbox that no filter would flag.

Donors are targets too. The FTC warns that "some scammers use names that sound a lot like real charities" and that if the only way to pay is by cryptocurrency, wire, a payment app or a gift card, "it's likely a scam" ([FTC: Before Giving to a Charity](https://consumer.ftc.gov/articles/giving-charity)). Our guide to [charity and disaster relief scam emails](https://iblockspam.com/blog/charity-disaster-relief-scam-emails) covers what donors see.

Some nonprofits face more than fraud. CISA and international partners published guidance in May 2024 for civil society organizations, including nonprofit, advocacy and faith-based groups, which they describe as high-risk communities often targeted by state-sponsored actors ([CISA: Mitigating Cyber Threats with Limited Resources](https://www.cisa.gov/resources-tools/resources/mitigating-cyber-threats-limited-resources-guidance-civil-society)).

## What does iBlockSpam do for a nonprofit?

It checks every inbound message before it reaches anyone, and gives each person a simple way to find mail that was held.

### Filtering in front of your existing platform

Your MX records point to our filtering servers. Mail is checked for spam, viruses, malware, phishing and spoofing, and clean mail goes on to [Microsoft 365](https://iblockspam.com/platforms/microsoft-365), [Google Workspace](https://iblockspam.com/platforms/google-workspace) or your hosted server. You keep your nonprofit licenses, mailboxes and sign-ins. [Approved and blocked sender lists](https://iblockspam.com/features/allow-block-lists) can require sender verification, so a forged message claiming to be from your director or a trusted funder still gets checked. Advanced settings add attachment-type filters, a Microsoft Office macro filter, geographic filters and custom domain rules.

### A quarantine volunteers can manage

Every user gets a personal quarantine and a digest email, hourly, daily, on a chosen weekday or on a custom schedule, so a volunteer can release a held message without calling anyone. A staff admin can review everything in the shared quarantine. See [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests).

### Protecting your name with donors

DMARC tells receivers to reject mail that forges your exact domain. DMARC monitoring is included: add `rua=mailto:dmarc@iblockspam.com` to your DMARC record and we show who sends mail as your domain, which of your own senders (your donation platform, your newsletter tool) need fixing, and when it's safe to move to `quarantine` and then `reject`. It reports; it doesn't block mail by itself. Lookalike Domain Watch checks look-alike versions of your domain every day and alerts you when one is registered or gets a mail server. It can't take domains down. See [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring) and [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch).

### Resilience for a small team

If your mail server is down, mail is held for up to 5 days and then delivered. You can search 30 days of message history. Domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus. That matters when a volunteer or web designer edits DNS.

## What does it cost a nonprofit?

The same as anyone else. iBlockSpam has no nonprofit discount at the time of writing. Pricing is per domain, so it doesn't grow with your volunteer list.

| | Protect | Protect Plus |
|---|---|---|
| Billed annually | $12 per domain/month ($144/year) | $19 per domain/month ($228/year) |
| Month-to-month | $15 per domain/month | $24 per domain/month |
| Mailboxes | Unlimited (count, not volume) | Unlimited (count, not volume) |
| Inbound messages included | 100,000 per domain/month | 100,000 per domain/month |
| Domain monitoring | Weekly | Daily |
| Monthly owner report, human setup session | No | Yes |

Prices are beta pricing in USD, excluding tax. A first annual subscription for a domain has a 30-day money-back guarantee. There's no free trial. Domain aliases are unlimited, so an old name that delivers to the same mailboxes doesn't need its own plan. See [pricing](https://iblockspam.com/pricing).

Microsoft and Google both run nonprofit programs. Microsoft says it provides eligible nonprofits up to 300 granted licenses of Microsoft 365 Business Basic, plus discounts on many other offers ([Microsoft Learn: Microsoft for Nonprofits updates](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/updates)). Google offers a no-cost Google Workspace for Nonprofits edition to eligible organizations ([Google for Nonprofits](https://www.google.com/nonprofits/offerings/workspace/)). Both check eligibility first. Those programs cover your mailboxes; iBlockSpam is a separate layer in front of them. Before deciding, read whether [Microsoft 365's built-in filtering](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) or [Google Workspace's built-in protection](https://iblockspam.com/compare/google-workspace-built-in-vs-gateway) is enough for you.

## How do you set it up?

Most nonprofits need one administrator and access to their DNS host.

1. **Check your domain** with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to see your current MX, SPF and DMARC records.
2. **Confirm admin access** to your Microsoft 365 or Google Workspace account and your DNS host. Volunteers who set things up years ago may hold the logins.
3. **Create your account** and add your domain. The guided setup shows a before/after DNS comparison and rollback steps.
4. **Do the platform step**, such as the Microsoft 365 connector or the Google Workspace inbound gateway, then change MX.
5. **Send test messages** and check the setup verifier.
6. **Add the DMARC reporting address**, then fix the senders the reports show.
7. **Write down your payment rule**: any new or changed bank details, and any gift card request, is confirmed by phone on a number you already have. Our guide to [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) sets out a call-back process.
8. **Tell donors** you'll never ask for gift cards or change bank details by email.

## Honest limits

- No filter catches every phishing message, and sometimes a real message is held. Digests help people find it quickly.
- A message from a real, compromised mailbox can pass authentication. The call-back rule is the defense for payments.
- iBlockSpam filters inbound mail. It doesn't secure your donation platform or payment processor logins, or replace volunteer training.
- Mail is processed in the United States. iBlockSpam holds no SOC 2 or ISO certification.

Start with the free [Email Health Check](https://iblockspam.com/tools/email-health-check), then [create your account](https://iblockspam.com/signup).

## Sources

- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, the $55 billion scam](https://www.ic3.gov/PSA/2024/PSA240911)
- [FBI IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC)
- [FTC: Before Giving to a Charity](https://consumer.ftc.gov/articles/giving-charity)
- [FTC: Government Grant Scams](https://consumer.ftc.gov/articles/government-grant-scams)
- [CISA and partners: Mitigating Cyber Threats with Limited Resources, Guidance for Civil Society](https://www.cisa.gov/resources-tools/resources/mitigating-cyber-threats-limited-resources-guidance-civil-society)
- [Microsoft Learn: Microsoft for Nonprofits updates](https://learn.microsoft.com/en-us/industry/nonprofit/microsoft-for-nonprofits/updates)
- [Google for Nonprofits: Google Workspace for Nonprofits](https://www.google.com/nonprofits/offerings/workspace/)

## Frequently asked questions

### Does iBlockSpam offer a nonprofit discount?

No. At the time of writing, nonprofits pay the same published beta prices as everyone else: Protect is $12 per domain per month billed annually ($144 a year), or $15 month-to-month. Pricing is per domain, so unlimited mailboxes are included, which often matters more to a volunteer-heavy organization than a discount would.

### Do volunteer mailboxes cost extra to filter?

No. iBlockSpam charges per domain, not per mailbox, so adding volunteers, board members or seasonal helpers doesn't change the price. Unlimited mailboxes means mailbox count, not message volume. Each domain includes 100,000 inbound messages per month, shared across all of its mailboxes.

### Can we use iBlockSpam with a free or discounted nonprofit Microsoft 365 or Google Workspace plan?

Yes. iBlockSpam sits in front of your mail platform at the MX level, whatever plan you're on. Microsoft 365 needs an inbound Partner connector and Google Workspace needs the inbound gateway setting. Check that your edition and admin role give you access to those settings before you change MX records.

### What should a nonprofit do if someone already paid a fake invoice?

Call your bank straight away and ask it to recall or stop the payment; speed matters. Then file a complaint with the FBI's IC3 at ic3.gov, as the FBI advises regardless of the amount. Reset the password of any account that may have been compromised, and check its mail forwarding rules.

---

Source: iBlockSpam, https://iblockspam.com/solutions/nonprofits (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt