Email security and deliverability
Email is where most attacks start and where most business is still done. We filter out the phishing and fake invoices before staff see them, lock down your domain so nobody else can send as you, and fix the settings that send your own mail to clients' junk folders.
Email security & deliverability for small and medium businesses
Two email problems come up again and again. The first is incoming: a convincing message that looks like it came from a supplier, a courier or the managing director lands in someone's inbox and asks them to sign in, open a file or change bank details. The second is outgoing: your quotes and invoices go to clients' junk folders, or a criminal sends mail that appears to come from your own address.
Both have the same root. Email was designed long before anyone worried about forgery, so proving who sent a message depends on a handful of DNS records and filtering settings that most small businesses have never had set up properly. SPF lists the services allowed to send for you, DKIM signs your messages and DMARC tells other mail servers what to do with anything that fails. Big mail providers now expect all three from business senders.
We put those records in place carefully. Every service that sends as you, such as your accounting package, website forms and newsletter tool, is found and included first, so tightening the policy doesn't block your own invoices. Then we add filtering for incoming mail and show staff how to report anything odd. Finally we keep watching the DMARC reports, so a new service sending as you, or someone trying to forge your address, is spotted and dealt with rather than discovered when a client complains.
What's included
Phishing and malware filtering
Incoming mail scanned for malicious links, attachments and fake sign-in pages, with links checked again when they are clicked.
Impersonation protection
Rules that flag mail pretending to come from your directors, your domain or lookalike domains with a letter swapped.
SPF records
One correct SPF record listing every service that legitimately sends for you, kept within the lookup limits that break many records.
DKIM signing
Microsoft 365 and your other sending services set to sign outgoing mail with your domain, so receivers can verify it.
DMARC rollout
A reporting-only policy first, then a gradual move to quarantine and reject once reports show all your genuine mail passes.
Junk folder fixes
We trace why your mail is being filtered, from missing records to a listed address or a website form sending as you, and correct it.
External sender warnings
A clear banner on mail from outside the company, so a message using the boss's name from a free email account stands out.
Report-a-scam button
A simple way for staff to send a suspicious email to us for checking, so problems get reported rather than quietly deleted.
Who is email security work for?
Email security is worth a look if:
- Clients tell you your invoices or quotes end up in junk
- Someone received a fake invoice that appeared to come from your address
- Staff are getting convincing fake Microsoft sign-in emails
- You don't know whether your domain has SPF, DKIM or DMARC
- A large client or bank has asked you to set up DMARC
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkEmail security & deliverability questions
What are SPF, DKIM and DMARC in plain English?
SPF is a list of who can send email for your domain. DKIM is a digital signature on each message. DMARC ties them together and tells receiving servers whether to accept, quarantine or reject mail that fails, and sends you reports about it.
Will turning on DMARC stop our own emails?
It can if it is rushed. That is why we start in reporting mode, find every service sending as you and only tighten the policy when the reports show your genuine mail passing.
Isn't Microsoft 365's built-in filtering enough?
It catches a lot, but the default settings are not as strict as they could be. We review and tighten them, and on the Managed and Complete plans add extra email security and phishing filtering.
Why does our email go to junk?
Common causes are a missing or broken SPF record, no DKIM signing, a website or app sending as your domain without permission, or a shared sending address with a poor reputation. We check each one and fix the cause.
Can someone really send email as us?
Without DMARC at a strict policy, yes, it is surprisingly easy. Once the policy is enforced, most receiving mail systems will refuse those forged messages.
How long does it take to set up?
Filtering and records are usually set in a day or two. Moving DMARC to full enforcement normally takes a few weeks of watching reports, so nothing legitimate is caught.
What does it cost?
Email security is included from the Managed plan at $119 per user per month plus GST. A one-off domain records and deliverability fix outside a plan is quoted in writing first.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security