Make sure your email arrives, and that nobody else can send as you

Because those records only help a sender that is actually listed in them, and your mailboxes are rarely the only sender. SPF and DKIM are two records in your domain's settings that tell other mail servers which systems may send as you and let them check each message's signature. Your website's contact form, booking page, invoicing tool, CRM, helpdesk and copier all send as your company too, and each one missing from the records goes to junk or is rejected. A second common cause is a sender record that has grown past its technical limit, which makes the whole record invalid even when every sender is in it. The fix starts with an inventory of every sender for exactly this reason.

It covers one domain with up to six sending systems, assuming you or we can change the domain's settings within a business day. We list every sender, rewrite the records so each one passes, switch on the reports that receiving servers send back, and hand you a written list of senders. Each sender beyond six, an extra domain, an unused domain to lock, and an old system that cannot sign its own mail and needs a sending service are the priced variations above; a shared mailbox that fails the checks and an oversized sender record are included.

It is the point where receiving servers are told to throw away any message claiming to be from your company that fails the checks, which is what stops someone sending as you. It takes four to eight weeks because the reports have to be read first: they reveal the senders nobody remembered, and switching on blocking before those are fixed would block your own mail. We tighten in stages and switch on full blocking only after no legitimate sender has failed for fourteen days. The job is $695 per domain with 3 months of monitoring included, then $35 a month, because new senders keep appearing and someone has to notice.

Not on a date, and anyone who tells you otherwise is selling urgency. Microsoft's change switches off password-only sign-in for device email by default on existing accounts at the end of December 2026, an administrator can turn it back on, and the final removal date is to be announced in the second half of 2027. New Microsoft 365 accounts created after the change get modern sign-in only. What it does mean is that the copier's current setup is on borrowed time, and the right response is to fix it once, properly: a sending route the device can use, your sender record updated so the scans pass, and the setup written down.

$175 for the first device and $75 for each extra one in the same office, so three devices is the first price plus two extras. The first device carries the one-time work: choosing and setting up the sending route and updating your sender record. Each extra device is then about half an hour of configuration and a test. It assumes the device supports modern encryption, that we can reach its settings page remotely or through someone on site, and that you are on Microsoft 365 or Google Workspace. A device software update, scanning to a shared folder instead, and other systems found using the same old sign-in each have a published price; a device too old to send securely gets a written recommendation to replace it, not a fix we cannot stand behind.

It is payment fraud done through email. Someone gets into a mailbox, usually with a stolen password and no second sign-in step, and reads quietly for weeks. They learn who pays whom, when, and how the emails are worded. Then, just before a real payment, they send a change of bank details, either from the mailbox they broke into or from a web address that looks like yours or your vendor's. The money is wired to the new account and is gone within hours. FBI figures put the losses at 2.77 billion dollars in 2024 and 3.05 billion in 2025, with 86 percent of it moved by wire or bank transfer. It is the most expensive crime against small businesses and it needs no technical skill.

It is for any business that moves money on instructions received by email: title and real estate, law firms, accountants, property managers, lenders, yacht brokers, importers, agencies of every kind. For $1,295 up to ten users and $29 per user after that, we put a second sign-in step on every mailbox and admin account with old password-only sign-in switched off, take your domain to full protection, set alerts on new forwarding rules and suspicious sign-ins, write a call-back rule for any change of bank details and train and test your staff on it, start watching for lookalike web addresses, and leave you the first-hour playbook. Monitoring continues at $19 per user a month with a $95 minimum, and it is available as an add-on to any plan.

Yes, it works, and it is one sentence your staff follow without exception: any change to a vendor's or client's bank details is confirmed by phone, to a number you already had on file, before any payment is sent. Not the number in the email asking for the change. It works because the attacker controls the mailbox but not the telephone, and because it is a rule rather than a judgment call, so a convincing email does not get an exception. We write it with you, your staff practise it with a test, and the signed copy is one of the documents you receive.

If money has moved, call your bank's fraud line and then the receiving bank before anything else, with the wire reference and the time; a recall has a chance in the first hours and almost none after a day. Then change the account's password, sign it out everywhere, remove any forwarding or inbox rule you did not create, set up the second sign-in step again, and do not delete anything. Call us: incident response without a retainer is $295 an hour with a 2-hour minimum and a written cap you approve first, and the first-hour sequence on this page is what we run. Clients with the incident retainer get a one-hour response at any hour.

Not if they are on the list, and finding them is what the two months of monitoring are for. Marketing platforms and CRMs can almost always be set up to sign mail as your company once a few records are published; a few old tools cannot, and those are routed through a sending service for a published price rather than left to fail. We switch on full blocking only when no legitimate sender has failed for fourteen days, so a sender that is still unlisted at that point is one nobody at your company recognises, which is itself worth knowing.

Yes, and you should. A domain that sends no mail can still be used to send mail as you unless its settings say it never sends. Each unused domain gets records that say so, plus full blocking, for a published per-domain price, so an old brand name or a misspelling you bought defensively cannot be turned into a phishing sender. Lookalike web addresses you do not own are a different problem, and that is what the watch in the Payment Fraud Shield is for.

Yes. The call-back rule, the training session and the test are run in English or Spanish, or both for a mixed office. The printed playbook and the signed rule are written in the language your accounts staff actually work in, because a rule nobody can read quickly under pressure is not a control.