Strategic domain name partner with legal responsibility
Since the beginning of the 1990s, Oatly’s strong growth and international expansion has required a partner with proactivity and skills in strategic issues regarding trademarks and domain names. For over 10 years, Oatly has therefore hired Ports Group for the secure management of domain names and DNS.
Oatly’s domain name portfolio is managed in Ports Group’s Corporate Management service with dedicated contact, complete overview of domain names, trademarks and hosting services, and – most importantly – a complete outsourcing of both administration and legal responsibility for the portfolio.
Ports Group also monitors ongoing registrations of new domain names that could potentially be a threat to Oatly’s brand. We also assist Oatly’s legal representative to take control of domain names registered in bad faith.
Protection against email fraud with Email Compromise Protection
Email fraud is all types of fraud where someone fakes an email address to claim to be someone else in order to get their hands on money, sensitive information and/or spread malicious code. Previously, email fraud has usually been about registering a confusingly similar domain name in order to fool a company’s customers and/or employees.
Recently however, so-called “spoofing” has become a major problem. Spoofing is sending emails to recipients to whom the email will look exactly like one coming from the actual person, including that person’s exact email address as a sender. Email fraud is not only aimed at your own organization, but also against the company’s customers and/or suppliers.
The reason spoofing exists is that the email system basically has no mechanisms to prevent anyone from sending an email with someone else’s email address as the sender.
A common misconception is that the problem with spoofing lies with the recipient of the counterfeit e-mail (i.e. the victim) to resolve/prevent. However, in order to actually stop an illegitimate email, it requires action from the owner of the domain name used as the sender. Therefore, responsibility for preventing spoofing is always the primary responsibility of the domain name owner, not the potential recipient of the spoofed email. Thus, it is primarily a sending and not receiving problem.
Domain name owners can stop illegitimate emails, and thereby the most malicious type of email frauds, by implementing DMARC, SPF and DKIM. This helps the receiving SPAM filter/server determine if the email is legitimate or not, and dictates for the recipient’s system what will happen with any illegitimate email messages (usually not reaching the recipient at all).
Oatly has long been at the forefront of creating a secure IT presence. Therefore, it is no wonder that they realized early on the importance of securing their email management, thus minimizing the risk of someone being able to use their identity to commit fraud.
In order to ensure that Oatly has as an email management that is as secure as possible, Ports Group’s Email Compromise Protection service was implemented. The process began with a preliminary study during which we monitored and analysed Oatly’s email flow from all domain names for a period of time. The purpose was to check the current situation and identify legitimate and non-legitimate senders. When the preliminary study was completed, the results was presented to Oatly, where we also presented recommended implementing a policy for authenticating sending mail servers. Unlike the usual use of the word “policy”, which usually involves a management document on an intranet, a “policy” in this context means a technical security mechanism at the DNS level that determines what happens when a “non-legitimate” mail reaches its recipient.
After presenting the preliminary study and its results, we agreed on the implementation of a number of authentication and monitoring mechanisms. This was carried out in two steps:
- Step 1
On the primary domain, which is the only sending domain, we started identifying which servers should be able to send email from the domain. Then, a quarantine policy was put in place for all non-legitimate servers. Any mail that did not follow the policy ended up in the recipient’s trash.
- Step 2
When it is ensured that all servers that should be approved were actually approved, a “reject policy” was implemented. This means that email that now does not follow the policy does not reach the recipient at all.
The result of this is a secure email management with a hundred percent “reject” of any attempt to send non-legitimate email via which appears to come from oatly.com.
Protection against confusing domain names is used for fraudulent purposes
Implementing Email Compromise Protection service counteracts attempts to send email with the exact primary domain as a sender. However, it does not prevent anyone from registering a confusingly similar domain name and with bad intent using it against for example employees and/or people in other companies.
Therefore, in addition to Email Compromise Protection, domain name monitoring is used in order to identify threats in the form of third party registrations and being able to take legal actions like cease-and-desist letters and potential domain name disputes.
The result is that Oatly has taken responsibility for protecting themselves, but also their customers and partners, from fraudulent behaviour.