All services Email Security & Protection

Stop anyone from sending email as your company.

Right now, someone could send your clients an invoice that looks exactly like it came from you. We set up the records that make mail servers reject it, without blocking your real email.

Protect Your Email
AttackerUnknown server, not yours · 203.0.113.58

Sends an email “from” your billing address:

Accounts <[email protected]>

Updated banking details for invoice 4471

Your client’s mail server checks your domain’s rules
Today Delivered. Your client pays the fraudster.
With our setup Rejected. It never reaches your client.p=reject

Three records, in plain words

  • SPFThe guest listWhich servers are allowed to send email for your domain.v=spf1 include:spf.protection.outlook.com -all
  • DKIMThe tamper sealA signature proving the message really came from you and wasn’t changed.selector1._domainkey → public key
  • DMARCThe bouncerTells the world what to do with email that fails: report it, quarantine it or reject it.v=DMARC1; p=reject; rua=mailto:dmarc@…

From wide open to locked, without breaking real email

Jumping straight to “reject” blocks your own newsletters and invoices. We move in stages and fix each legitimate sender along the way.

  1. p=noneWatchCollect reports, find every service sending as you.
  2. p=quarantineQuarantineImpostor mail goes to spam while we fix the last senders.
  3. p=rejectRejectImpostor mail is refused. Your real mail flows normally.

We map the services that send as you

Microsoft 365, your newsletter tool, the invoicing app, the old scanner, and the impostors.

DMARC report · last 7 daysSample · synthetic data

Published DNS record · step 1, monitoring

_dmarc.example-company.ca TXT

"v=DMARC1; p=none; rua=mailto:[email protected]"

messages sent as example-company.ca, last 7 days
6,427
passed DMARC
93.6%
  • Microsoft 365*.outbound.protection.outlook.com
    4,812

    SPF passDKIM passLegitimate

    Your team’s mailboxes. Nothing to fix.

  • Newsletter servicebounce.newsletter-service.example
    1,206

    SPF not alignedDKIM passLegitimate

    SPF checks the provider’s domain, but the DKIM signature in your name is enough to pass DMARC.

  • Invoicing appsmtp.invoicing-app.example
    312

    SPF failDKIM noneFix first

    These are your real invoices. Switch to p=reject today and they get blocked, so DKIM has to be turned on with this provider first.

  • Unknown sender203.0.113.58 · no reverse DNS
    97

    SPF failDKIM noneSpoofing

    Someone else is sending mail that looks like it comes from you. Once the policy is p=reject, receiving servers refuse it.

Target record, once invoicing is fixed

"v=DMARC1; p=reject; rua=mailto:[email protected]"

And the finishing touches

  1. MTA-STSForces encryption when other servers deliver mail to you.
  2. BIMIYour logo next to your emails in supporting inboxes, once DMARC is enforced.
  3. Your team, trainedSo the setup stays correct when you add a new tool.
Now deal with the phishing that still comes inPhishing simulations train your team to spot what still gets through.Phishing simulation

Examples on this page are illustrative.

Protect Your Email

Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.

Book a Free Consultation