Email Authentication: SPF, DKIM & DMARC
If your domain doesn't have SPF, DKIM, and DMARC set up correctly, anyone on earth can send email that looks exactly like it came from you — to your clients, your bank, your staff. We lock that down, and we fix the deliverability problems that come from getting it wrong.
Make Your Domain Impossible to Impersonate
We've done this for law firms, aircraft brokers, HVAC contractors, and travel agencies across Tampa Bay. The process is the same; the DNS is always different.
SPF Done Right
One SPF record, under the 10-lookup limit, covering every service that legitimately sends as you — Microsoft 365, your CRM, invoicing, marketing platform, website forms, printers. Most domains we review have a broken or incomplete record.
DKIM Signing
Cryptographic signing enabled for Microsoft 365, Google Workspace, and every third-party sender, with correct selectors and key rotation. This is the piece most IT providers skip.
DMARC Policy & Enforcement
We start at monitor-only, review the reports, fix every legitimate sender that fails, then ramp to quarantine and finally reject — so spoofed mail is dropped and your real mail still arrives.
Report Monitoring
DMARC aggregate reports show who is sending as your domain and from where. We read them weekly during rollout and monthly after, and we tell you when something new shows up.
Deliverability Repair
Email landing in spam, bouncing from Gmail or Yahoo, or being rejected by a client's filter? Nine times out of ten it's authentication. We diagnose and fix it, including MX, PTR, and reputation issues.
Spoofing Incident Response
If someone is already impersonating your domain — a fake invoice to a client, a wire-change request to your bookkeeper — we investigate the headers, identify the path, and close it, then set up enforcement so it can't recur.
BIMI & Brand Logo
Once DMARC is at enforcement, we can set up BIMI so your logo appears next to your email in Gmail and Apple Mail — a visible trust signal that spoofers can't copy.
Multi-Domain & Parked Domains
Own more than one domain? Parked and unused domains need a null-SPF and reject-DMARC too, or they become the easy way in. We cover every domain you hold.
Mailbox Providers Are Enforcing It
Since 2024, Google and Yahoo have required bulk senders to have SPF, DKIM, and DMARC, and Microsoft followed for Outlook.com in 2025. Unauthenticated email increasingly goes to spam or is rejected outright — on top of the fraud risk of a domain anyone can spoof.
- Wire-transfer fraud almost always starts with a spoofed or look-alike email
- Cyber-insurance applications now ask specifically about DMARC enforcement
- Most of the damage from a spoofing incident is reputational — and preventable
- Fixed-price project with a written summary of every DNS record we changed and why
- Monitoring available monthly for businesses that add senders often
Common Questions
Find Out If Your Domain Can Be Spoofed
Send us your domain name and we'll tell you — free — whether SPF, DKIM, and DMARC are in place and whether your email can currently be forged.