DMARC Reveals the Benefit of Consolidating Email Marketing Providers

DMARC provides organisations visibility into all the environments sending email “as them” (or using their domains). Often surprising to Messaging and Security Teams, upon seeing the contents of their DMARC reports for the first time, is the “sprawl” of 3^rd party SaaS applications (and IaaS) with which the wider organisation has contracted over the years. By way of example, Proofpoint Email Fraud Defense (EFD) customers have, on average, fifteen SaaS / IaaS providers using their domains accounting for 52% of total email volume.

Not surprisingly, SaaS email marketing providers (Salesforce Marketing Cloud, Marketo, etc.) commonly receive permission to use an organisation’s domains in order to optimise campaign effectiveness. What may come as a surprise, however, is the redundancy of these providers a typical organisation uses: on average, EFD customers use six!

While recognising that not all email marketing providers are created equal and likely using more than one is warranted, six is excessive in light of the potential savings available through consolidation (to say nothing of providing a more cohesive customer experience). Consider the hypothetical scenario below:

• Monthly marketing email sent by an organisation = 12M*
• Normalised price schedule across email marketing providers**:

• Monthly spend by organisation if six providers are used: $6,000

• Monthly spend by organisation if two providers are used: $3,600 (40% savings)

• Monthly spend by organisation if one provider is used: $2,400 (60% savings)

In addition to savings, consolidating email marketing providers allows security teams to reduce the organisation’s “supply chain” risk footprint. In this case, the organisation’s email identity has its own ecosystem of “suppliers” that must be protected in order to prevent Business Email Compromise (BEC) and other attacks involving its identity. And compared to other areas of the “supply chain,” email marketing providers (and other SaaS / IaaS using the organisation’s domains, for that matter) represent an area where Security can exert direct control and influence.  

Check here to see if your organisation has a DMARC record on its primary domain and thus, visibility into the supply chain of its email identity. Then start the conversation internally around how to consolidate environments to save money and reduce risk!