Google, Yahoo and Microsoft now check SPF, DKIM and DMARC on the mail you send. As part of our managed IT services, we set them up properly, watch the reports, and add the filtering that stops fake invoices and payroll scams before they reach your people.
Email is where most attacks on small companies start, and it is also where most delivery problems come from. We handle both sides.
The order matters. The result is a domain that attackers cannot send from, and mail that reaches inboxes at Gmail and Outlook.
Every service that sends email as your domain: your mail platform, CRM, invoicing, marketing, help desk, website forms.
For each sender, and keep SPF under the ten-lookup limit.
With reporting switched on, and collect reports for a few weeks.
We review the reports with you, fix the stragglers, and tighten the policy.
When the reports are clean, and keep watching for new senders.
Your DNS, your mail platform, your settings. We make every change inside your own Microsoft 365 or Google Workspace through dedicated admin accounts in your company's name, protected by MFA and used only on your instruction, and nothing moves to SF3 Technologies' systems.
If you ever move on, we hand the records, the filtering and the documentation over to your new team, help during the changeover, and then remove our accounts, so you keep everything.
Business email compromise does not need malware. It needs one convincing message asking finance to change a bank account. We reduce that risk in layers: a domain that cannot be spoofed, filtering that flags lookalike senders and first-time contacts, mailbox rules monitored for the tricks attackers use, and short training so your team recognises the pattern.
Talk to us about your domainUsually one of the services sending as your domain is missing from SPF or DKIM, the SPF record has passed its lookup limit, or spoofing has hurt your domain's reputation. We check every sender, fix the records and watch the reports until delivery recovers.
This applies equally to Microsoft 365 and Google Workspace, and to mixed environments.
Microsoft 365 managementIf yours is not here, ask and a real person will answer.
Ask us something elseYes, because Google, Yahoo and Microsoft now check SPF, DKIM and DMARC on inbound mail, and a missing or failing record hurts delivery and lets attackers spoof your domain. It also appears on most cyber insurance and vendor questionnaires now.
Usually because SPF, DKIM or DMARC is missing or misconfigured for one of the services sending as your domain, or because your domain's reputation has been hurt by spoofing. We check every sender, fix the records and watch the reports until delivery recovers.
Not if it is set up in the right order, which is why we start at policy none, collect reports and fix each sender before moving to quarantine and reject. Problems come from switching to reject before every legitimate sender is covered.
SPF allows at most ten DNS lookups, and each service you add to the record uses some of them, so the eleventh service silently invalidates the whole record. We flatten or restructure the record and verify it against every sending system.
Yes, the DNS records are the same and we configure DKIM and filtering on both platforms. Mixed environments are common and we handle them.
A correctly enforced DMARC policy stops attackers from sending mail that looks like it came from your domain, and filtering flags lookalike domains and unusual payment requests. Training then gives your finance team a simple habit: verify any bank change by phone.
Mail landing in spam, or someone sending as you?
Talk to us