Email security and DMARCFor businesses and MSPs
Stop criminals from sending email in your name.
We set up SPF, DKIM, and DMARC, enforce DMARC in stages, and switch on the protections Microsoft 365 already includes. Forged mail gets rejected, and yours passes the checks Gmail and Outlook run.
- Free scoping
- Fixed-fee proposal within two business days
- Labor warranty
Have the technical details? Skip the discovery call with our project information form.
Spoofing works when DMARC is missing or never enforced.
The usual gaps are an SPF record over its 10-lookup limit, DKIM that was never turned on, or a DMARC policy left at monitoring for years. Any one of them leaves your domain open to spoofing or sends your own invoices to spam. We find every service that sends mail as you, fix the records, and move DMARC to enforcement in stages so legitimate mail keeps flowing.
When to consider starting this project
- Customers have received fake invoices that appear to come from you
- Your quotes or invoices land in spam
- An insurer, auditor, or customer asked whether you use DMARC
Every sender found. Every record fixed. Enforcement in stages.
- An audit of your SPF, DKIM, DMARC, and MX records
- An inventory of every service that sends mail as you
- DKIM signing and SPF cleanup
- A staged DMARC rollout from monitoring to enforcement
- Anti-phishing and impersonation protection settings
- A simple way for staff to report suspicious mail
From first call to documented handoff.
Scoping is free, and the price is agreed before any work begins. Most projects are quoted at a fixed fee.
Before the work
-
Discover
We start with a free call. You tell us what you want, what you use now, and when you need it done.
-
Plan
We send you a free written plan. It lists the work and any equipment, with a price for each.
-
Sign
You sign the plan, and we put your project on our calendar. Nothing starts until you say yes.
The work
-
Implement
We do the work, mostly over the internet. If a job needs us in person, we come to you.
-
Adjust
Testing and real-life use show what needs work. We fix those things and fine-tune the setup.
-
QA
We check every item in your plan, one at a time. We don’t move on until everything works.
After the work
-
Document
We write down what we built, how it’s set up, and why. Our diagrams help whoever works on it next.
-
Handoff
We show you and your team how it all works. Then we hand over the passwords and the documents.
-
Follow-up
After we hand it over, we check back with you. We make sure everything still works.
We take on a limited number of projects at a time, so the sooner you’re scoped, the sooner you’re on the calendar.
Straight answers
Something else on your mind? Ask us directly.
Will DMARC block our legitimate email?
Not when it’s rolled out in stages. We start in monitoring mode, find every service that sends as you, from billing and marketing tools to scanners and CRMs, and fix each one before moving to enforcement.
Doesn’t Microsoft 365 handle this already?
Microsoft 365 filters the mail you receive, but SPF, DKIM, and DMARC for your own domain live in your DNS and have to be set up for it. Several impersonation protections also stay at default settings until someone configures them.
Do Gmail and Outlook require DMARC now?
For bulk senders, yes. Since February 2024, Gmail has required SPF, DKIM, and DMARC from anyone sending 5,000 or more messages a day to Gmail accounts, and since May 2025, Outlook.com has rejected high-volume mail that fails those checks. Every sender needs at least SPF or DKIM to reach Gmail.
Does DMARC stop all email fraud?
No. It stops criminals from using your exact domain. Lookalike domains and hacked mailboxes need other defenses, which is why we also turn on impersonation protection and give staff an easy way to report suspicious mail.
For MSPs
SPF, DKIM, and DMARC moved to enforcement across your client domains, with every sending service accounted for.
We deliver it white-label or co-branded, work in your PSA, RMM, and documentation platform, and never sell managed services to your clients.
Related projects
-
Microsoft 365 security hardening
Close the common gaps in Microsoft 365, including MFA for everyone, Conditional Access, managed devices, safer sharing, and locked-down admin accounts.
-
Cyber-insurance readiness
Answer your cyber-insurance questionnaire accurately and close the gaps underwriters ask about, such as MFA, backups, and endpoint protection.
-
Backup and recovery
Backups for servers, PCs, and Microsoft 365 that are set up correctly, kept off-site, and proven with a test restore.
Find out who’s sending email as you.
Book a free scoping call. We’ll check your SPF, DKIM, and DMARC records before we talk, and you’ll get a fixed-fee proposal within two business days.
Planning around year-end? A fixed-fee proposal lets you commit this year’s budget before it closes, or put your project first on next year’s calendar.
Have the technical details? Skip the discovery call with our project information form.