Email security & DMARC for Ontario businessesStop scammers sending email as you.
Anyone can send an email that claims to be from your domain unless your email security records say otherwise. We set up SPF, DKIM and DMARC for Microsoft 365, Google Workspace and anything else that sends as you, move you to a reject policy without breaking your real mail, and keep an eye on the reports.
or call +1 (289) 796-8900| Record | Before | After |
|---|---|---|
| SPF | Softfail (~all) | Hardfail (-all) |
| DKIM | Missing for newsletters | All senders signed |
| DMARC | p=none, no reports | p=reject, reports on |
| MTA-STS | Not set | Enforced |
When it's worth fixing
- Customers got invoices that weren't from you
Or a supplier was asked to change your banking details.
- Your email lands in spam
Google, Yahoo and Microsoft now require SPF, DKIM and DMARC from bulk senders, and mail without them is easier to filter.
- An insurer or client asked about DMARC
It's a common question on cyber insurance and security forms.
- You're not sure what sends as you
Website forms, invoicing, newsletters and booking systems all count.
What we set up
The records that prove your email is yours, and a safe path to enforcing them.
Everything that sends as you, found
Your mailboxes, website forms, invoicing, newsletters and booking systems.
SPF and DKIM, set properly
Every real sender listed and signing, so your mail passes the checks.
DMARC moved to p=reject
Monitor first, fix what fails, then tell receiving servers to refuse fakes.
MTA-STS where it helps
So mail to you is only delivered over an encrypted connection.
The reports, read for you
A monthly summary of who sent as you and what was blocked.
How it works
- 1
Free check
A BadgerScan of your domain shows what's missing today.
- 2
Find every sender
We list what sends as you, so nothing real gets blocked.
- 3
Set and monitor
Records go in at p=none with reports on, and we fix what fails.
- 4
Enforce
Once your real mail passes, we move to p=reject and keep watching.
Start with a free check
What changes the price
Each one needs its own SPF and DKIM setup.
Microsoft 365, Google Workspace or another provider.
Optional, after you reach p=reject.
- A BadgerScan grade for your domain
- What's missing, in plain language
- A written quote for the setup, before any work starts
Setup and monitoring are quoted in writing after the free check.
From the team that built BadgerScan
BadgerScan grades email security for free
It checks SPF, DKIM, DMARC and more for any domain, with passive checks and no login. It’s the same check we start every email project with.
Check your domain“Nathan from Cyberbadger is very knowledgeable and provides great cybersecurity service! He is very straightforward and…”
Questions
The ones we hear most. Anything else, ask the people who’ll do the work.
Will this stop my own emails being delivered?
No. We monitor before enforcing, and fix anything that fails, so your real mail keeps flowing.
We use Microsoft 365 or Google Workspace.
Both are covered, along with the other services that send email as you.
What's p=reject?
The DMARC setting that tells receiving servers to refuse email that fails the checks, so fakes never reach the inbox.
How long does it take?
The records go in quickly. Moving safely to p=reject usually takes a few weeks of monitoring, depending on how many services send as you.
Does this stop phishing completely?
It stops people sending email from your exact domain. Lookalike domains are a separate problem, and we'll tell you if we see them in the reports.
Find out who can send email as you
Book a free check. We'll show you what's missing and quote the setup in writing.