Crypto & Web3

Challenges

• ›Filter posture treats the vertical with suspicion regardless of the sender's actual reputation
• ›Phishing lookalikes target the vertical heavily — DMARC enforcement is defensive infrastructure
• ›Transactional volume peaks around market events; capacity must be provisioned in advance
• ›Regulatory ambiguity across jurisdictions affects domain and sending strategy

Our approach

• ›Aggressive DMARC posture — p=reject on all transactional domains within 90 days of onboarding
• ›Separate IP pools for security notifications, transactional confirmations, and marketing communications
• ›BIMI submission with VMC coordination where the brand qualifies
• ›Capacity headroom sized for 5× peak throughput

Deliverability recommendations

1. Publish DMARC records with rua/ruf and ingest reports — most crypto brands are heavily phished
2. Never send security-critical notifications from the same subdomain as marketing
3. Enforce SPF strictly (-all) once the sending inventory is mapped

Example engagements

• Regulated crypto exchange: migrated 30M/month transactional volume from a shared ESP to dedicated infrastructure, cut password-reset median delivery time from 47s to 9s at Gmail.
• Web3 wallet: DMARC at p=reject shut down a phishing campaign that had been targeting users for six months.

Examples are anonymised. Named references available under mutual NDA.

Questions