DMARC Reveals the Benefit of Consolidating Email Marketing Providers

DMARC provides organizations visibility into all the environments sending email “as them” (or using their domains). Often surprising to Messaging and Security Teams, upon seeing the contents of their DMARC reports for the first time, is the “sprawl” of 3^rd party SaaS applications (and IaaS) with which the wider organization has contracted over the years. By way of example, Proofpoint Email Fraud Defense (EFD) customers have, on average, fifteen SaaS / IaaS providers using their domains accounting for 52% of total email volume.

Not surprisingly, SaaS email marketing providers (Salesforce Marketing Cloud, Marketo, etc.) commonly receive permission to use an organization’s domains in order to optimize campaign effectiveness. What may come as a surprise, however, is the redundancy of these providers a typical organization uses: on average, EFD customers use six!

While recognizing that not all email marketing providers are created equal and likely using more than one is warranted, six is excessive in light of the potential savings available through consolidation (to say nothing of providing a more cohesive customer experience). Consider the hypothetical scenario below:

• Monthly marketing email sent by an organization = 12M*
• Normalized price schedule across email marketing providers**:

• Monthly spend by organization if six providers are used: $6,000

• Monthly spend by organization if two providers are used: $3,600 (40% savings)

• Monthly spend by organization if one provider is used: $2,400 (60% savings)

In addition to savings, consolidating email marketing providers allows security teams to reduce the organization’s “supply chain” risk footprint. In this case, the organization’s email identity has its own ecosystem of “suppliers” that must be protected in order to prevent Business Email Compromise (BEC) and other attacks involving its identity. And compared to other areas of the “supply chain,” email marketing providers (and other SaaS / IaaS using the organization’s domains, for that matter) represent an area where Security can exert direct control and influence.  

Check here to see if your organization has a DMARC record on its primary domain and thus, visibility into the supply chain of its email identity. Then start the conversation internally around how to consolidate environments to save money and reduce risk!