Strategic domain name partner with legal responsibility
Since the beginning of the 1990s, Oatly’s strong growth and international expansion has required a partner with proactivity and skills in strategic issues regarding trademarks and domain names. For over 10 years, Oatly has therefore hired Ports Group for the secure management of domain names and DNS.
Oatly’s domain name portfolio is managed in Ports Group’s Corporate Trademark Management service with dedicated contact, complete overview of domain names, trademarks and hosting services with our customer portal Ports Management, and – most importantly – a complete outsourcing of both administration and legal responsibility for the portfolio.
Ports Group also monitors ongoing registrations of new domain names that could potentially be a threat to Oatly’s brand. We also assist Oatly’s legal representative to take control of domain names registered in bad faith.
Protection against email fraud with Email Compromise Protection
Email fraud is all types of fraud where someone fakes an email address to claim to be someone else in order to get their hands on money, sensitive information and/or spread malicious code. Previously, email fraud has usually been about registering a confusingly similar domain name in order to fool a company’s customers and/or employees.
Oatly has long been at the forefront of creating a secure IT presence. Therefore, it is no wonder that they realized early on the importance of securing their email management, thus minimizing the risk of someone being able to use their identity to commit fraud.
In order to ensure that Oatly has as an email management that is as secure as possible, Ports Group’s Email Compromise Protection service was implemented. The process began with a preliminary study during which we monitored and analyzed Oatly’s email flow from all domain names for a period of time. The purpose was to check the current situation and identify legitimate and non-legitimate senders. When the preliminary study was completed, the results was presented to Oatly, where we also presented recommended implementing a policy for authenticating sending mail servers. Unlike the usual use of the word “policy”, which usually involves a management document on an intranet, a “policy” in this context means a technical security mechanism at the DNS level that determines what happens when a “non-legitimate” mail reaches its recipient.
After presenting the preliminary study and its results, we agreed on the implementation of a number of authentication and monitoring mechanisms. This was carried out in two steps:
- Step 1
On the primary domain, which is the only sending domain, we started identifying which servers should be able to send email from the domain. Then, a quarantine policy was put in place for all non-legitimate servers. Any mail that did not follow the policy ended up in the recipient’s trash.
- Step 2
When it is ensured that all servers that should be approved were actually approved, a “reject policy” was implemented. This means that email that now does not follow the policy does not reach the recipient at all.
The result of this is a secure email management with a hundred percent “reject” of any attempt to send non-legitimate email via which appears to come from oatly.com.
Protection against confusing domain names is used for fraudulent purposes
Implementing Email Compromise Protection service counteracts attempts to send email with the exact primary domain as a sender. However, it does not prevent anyone from registering a confusingly similar domain name and with bad intent using it against for example employees and/or people in other companies.
Therefore, in addition to Email Compromise Protection, domain name monitoring is used in order to identify threats in the form of third party registrations and being able to take legal actions like cease-and-desist letters and potential domain name disputes.
The result is that Oatly has taken responsibility for protecting themselves, but also their customers and partners, from fraudulent behaviour.