Protecting your brand with DMARC

Let’s envision a potential nightmare for your brand:  Your database gets hacked and all of your customers’ private information is now on the dark web, potentially available to exploit.  Now, you need to notify all of your customers to the potential threat.  Instead of sending it out through your typical email channels, you decide to setup a special domain specifically for this purpose.  Sounds logical, right?  What could go wrong?

How about the rejection of this highly important email and a serious erosion of trust for your brand?

If this sounds far-fetched, it shouldn’t.  It really happened to a Fortune 500 brand in 2018 – Marriott.

The Full Story

Following a harmful data breach involving personal information of up to 500 million guests in late November of 2018, the hotel giant decided to send notifications to its customers using a new domain email-marriott.com, instead of marriott.com or starwood.com, the affected brands.  Traditionally, Marriott properties had used the domain of the brand for customer communications around reservations, for example courtyard.com for Courtyard by Marriott properties.

From a technology standpoint, this was a completely logical decision. Marriott had been transitioning email communications to the email-marriott.com domain for sometime.  However,  customers reacted with confusion for several reasons:

  1. The message sender name appeared to be email-marriott, not Marriott, or an identifiable brand.
  2. email-marriott.com looks strange to customers of other Marriott brands that may not use the Marriott name: Starwood, Westin and Ritz-Carlton for example.
  3. It is a common technique for spoofers to use a domain that uses similar names to the intended target.
  4. The topic of the message is about security, which automatically heightens customer attention to small details relating to security.

Missteps by Marriott

Not only did it backfire in terms of reaching the inboxes of their client base, it also created a major backlash and critically damaged their email reputation.  Particularly troubling is item #3, the email-marriott.com domain mimics a fraudster’s spoofing/phishing efforts, some receivers were undoubtedly leery of opening the message. Appending common words to a known brand name is a scammer’s go-to move. The following phishing domains have been used in recent cybercrime attempts:

  • support-appleinc.com
  • service-capitalone-com.tk
  • support-verificationaccount.com

Marriott’s failed to recognize the potential pitfalls of their notification strategy and ended up compounding a customer relations problem.

What’s in a Domain?

Your company’s email reputation, as well as your customers’ security and trust in your brand, rely on which domain you utilize. Selecting an identifiable sender domain name is a best practice for businesses that rely on email to regularly communicate with clients. Domain name reputation plays a vital role in email deliverability. Unfortunately, Marriott discovered the hard way that using a nonspecific domain to suddenly send hundreds of millions of emails isn’t a good idea.

Building your company’s domain reputation can be achieved in several ways, including the length of time the domain has been registered and using it to send messages to engaged recipients. Having legitimate contact information listed on your website also helps increase overall reputation and deliverability.

Protect Your Brand

Because online security is a legitimate concern for your customers, making sure all outgoing emails are safeguarded and delivered as intended should be a top priority for your business. At MxToolbox, we specialize in helping you achieve high message delivery rates. By improving your company’s domain reputation, situations such as the aforementioned Marriott fiasco will be of no concern. To discuss your brand’s options and learn about MxToolbox’s DMARC products to solidify domain reputation, please contact our team of experts. We look forward to helping you achieve future email success.