Email Security Solutions

We look at how your mail is set up today, how many people send externally, and whether your domain is already authenticated. Most of what matters is not a product decision, it is whether SPF, DKIM and DMARC are done properly and whether internal mail is being inspected at all. We tell you what is missing before we quote anything.

Almost always because the receiving server cannot prove the mail really came from you. If SPF, DKIM and DMARC are missing, incomplete, or contradict each other, Google and Microsoft treat your mail as suspicious no matter how legitimate it is. It is also common after someone adds a new tool that sends on your behalf, a newsletter platform or a CRM, without adding it to your records. Our free email health check tells you which of these is happening to you.

DMARC is the DNS record that tells the world what to do with mail that claims to be from your domain but cannot prove it. Set to reject, that mail gets thrown away before anyone sees it. Insurers and larger clients ask for it because domain impersonation is how invoice fraud starts, and it is one of the few controls they can verify from the outside in ten seconds. Getting there safely takes a few weeks, because you have to find every legitimate sender first or you will block your own mail.

Yes, and this is the part most people get wrong. Your filtering protects the mail coming in to your staff. It does nothing about someone sending mail to your customers with your domain on it, because that message never touches your server. The only thing that stops it is authenticating your domain and enforcing it. That is why we start there.

The filtering those platforms include catches the obvious volume. Where it is weaker is the targeted message: no attachment, no link, just a plausible request to change bank details from a name you recognise. The layer we add inspects internal mail too, opens unknown files somewhere disposable first, and watches the mailbox for changes made after someone gets in. We are not tied to one product here, so what goes in front of your mail is what fits the way you work.

No. It connects to Microsoft 365 or Google Workspace through their own API, so there is nothing on the laptops and no change to your MX record. That also means it can be turned off as cleanly as it was turned on, which is a fair thing to ask before you sign anything.

It lands in a quarantine the user can see, and they release it themselves. We would rather tune the rules during the first weeks against your real mail than start so strict that people learn to distrust the filter. Everything held is logged, so a pattern of false positives is visible instead of anecdotal.

Two ways of dealing with a file nobody has seen before. Sandboxing opens the attachment or the link in a throwaway environment first, so if it is ransomware it detonates there and not on your computer. Sanitization takes documents like PDFs, Word and Excel and strips the active content out, handing you a clean copy that still opens and still prints. Together they cover the threat that is too new for any blocklist to know about yet.

It is the invoice that looks right and is not: no malware, no link, just a plausible request to change bank details. The FBI's IC3 recorded 24,768 complaints and $3.05 billion in losses to it in 2025, second only to investment fraud. Filtering helps, but what stops the loss is authenticating your domain so nobody can send as you, watching for mailbox rules an attacker adds, and one rule inside your company: a change of bank details is confirmed by phone, to a number you already had.

Two things. Somebody signing in from an odd place and quietly adding a forwarding rule, which is how an attacker reads your mail for weeks without anyone noticing. And sensitive data leaving: card numbers, patient records or payroll files going out as an attachment. Both are reported to you, not just blocked in silence.

Yes, and it should be done deliberately. Devices and applications that send mail are the most common reason a domain fails authentication: someone points the scanner at the mail server, it works for a week, and then the invoices start landing in spam. We give those systems an authenticated relay of their own and add them to your records, so they keep working without weakening the domain.

It can be. Phishing simulations and short training modules work well alongside filtering, because the messages that get through are the ones designed to fool a person rather than a filter. Whether it makes sense for you depends on how many people handle payments or customer data, and we will tell you if we think you do not need it.

We adjust as you grow. Adding people, adding a domain, or turning on training later is a configuration change, not a migration, because everything runs through the same API connection to Microsoft 365 or Google Workspace.

Nothing in your mail filter, because the call never touches it. In Mandiant’s M-Trends 2026, voice phishing reached 11% of confirmed initial infection vectors and passed email phishing, which fell to 6%. The usual goal is to talk someone into approving a remote support session, which hands over more than a stolen password would.

What works is an expectation set well before the call. Every email we send states that we will never ask for passwords, payment details or remote access by email, and gives you a number to verify against. We set the same thing up on your outgoing mail, applied centrally so it is on every mailbox without anyone having to remember.

It does not replace multi-factor authentication, and it does not replace verifying callers on your own help desk. It costs nothing and it works at the one moment when no technical control is present.