Stop criminals sending email as your company.
We configure and monitor SPF, DKIM and DMARC for your domain, take the policy all the way to enforcement, and keep it there as your business adds new email services.
Why this matters
Email was designed without any way to prove who sent a message. Anyone can put your domain in the From line of an email and send it to your clients, your suppliers or your own finance team. The most expensive version is a fake invoice or a "new bank details" message that looks like it came from you.
SPF, DKIM and DMARC are the three DNS records that let receiving mail systems check whether a message really came from you, and tell them what to do when it did not. Without an enforced DMARC policy, a spoofed message is usually delivered just like a real one.
Large mailbox providers now expect these records. Google and Yahoo require SPF, DKIM and DMARC from bulk senders since 2024, and Microsoft has applied similar rules to high-volume senders to Outlook.com since May 2025. Domains without them see more of their real email land in spam.
What we do
- Inventory every sender. We find every system that sends email as your domain: Microsoft 365 or Google Workspace, CRM, invoicing, helpdesk, marketing and website forms.
- Fix SPF. One clean record, within the 10 DNS-lookup limit, covering only the services you actually use.
- Sign with DKIM. 2048-bit keys for each service that supports it, so messages carry a signature tied to your domain.
- Publish DMARC with reporting. We start in monitoring mode and read the aggregate reports to see who is sending as you.
- Move to enforcement. Step by step from
p=nonetop=quarantinetop=reject, only once every legitimate sender passes. - Protect unused domains. Parked and secondary domains get a reject policy so they cannot be used for spoofing either.
- Keep monitoring. New services, expired keys and unexpected senders are caught in the reports and fixed before they cause problems.
How it works
- Free check. Run the domain check or send us your domain. We reply with what is in place and what is missing.
- Discovery, week 1. DMARC in monitoring mode with reporting, plus a review of your mail-sending services.
- Alignment, weeks 2 to 4. SPF and DKIM fixed for every legitimate sender until the reports show them passing.
- Enforcement, weeks 4 to 8. Policy raised in stages to quarantine and then reject, with a check at each stage.
- Monitoring, ongoing. Monthly report on authentication results, new senders and spoofing attempts blocked.
Timelines depend on how many services send email for you. A small business with Microsoft 365 and one or two other services usually reaches enforcement within a month.
What you receive
- A list of every service authorised to send as your domain, with its SPF and DKIM status
- Corrected DNS records, with the exact values and the reason for each change
- A DMARC policy at enforcement on your main domain and your unused domains
- A short monthly report you can share with management or auditors
This control also supports ISO/IEC 27001 and SOC 2 work. See our compliance coverage.
Common questions
Will this stop any of our real email?
Not if it is done in order. Nothing is enforced until the reports show every legitimate sender passing. That is the reason for the monitoring stage.
Do we need to change our email provider?
No. The work happens in your DNS and in the admin settings of the services you already use.
Who needs access to what?
Access to your DNS provider, or someone who can apply the records we give you, plus admin access to the services that send email for you.
Is the domain check really free?
Yes. It reads your public DNS records and shows what is configured. There is no obligation.
Read more
Find out who is sending email as you.
Send us your domain. We will reply with what is configured, what is missing and what it would take to reach enforcement.
Email contact@kullatech.com