Your email either authenticates or it stops arriving

Why this is harder than it looks

The failure mode is quiet. Nothing bounces dramatically. Your mail just starts landing in spam, or vanishing. And the fix has a trap: turn on enforcement before you have found every tool that sends as your domain, and you black-hole your own invoices.

What we do

What we need from you

We ask for these up front so nothing stalls halfway through. Items marked required have to be in hand before we can start.

Every domain you ownRequired

Including parked ones and defensive misspellings, because those are what spoofers use.

Who hosts your DNSRequired

We verify this ourselves, since owners are often wrong about where DNS actually lives.

Your sending toolsRequired

We give you a checklist rather than a blank box, because everyone forgets two or three.

Admin access to your mail platformRequired

Google Workspace or Microsoft 365. We need it to generate DKIM keys.

The steps only you can take

A few things genuinely cannot be delegated, because the platform requires the business owner personally. We schedule these, prepare you for them, and stay on the call.

• Click the delegated access invites. Some registrars expire them within 48 hours.
• Create our admin user in Google Workspace or Microsoft 365.
• Approve each enforcement step in writing before we tighten the policy.

Common questions

More on the full FAQ page.

Everything we have written about this

We publish what we know, in full, for free. If you would rather do this yourself, start here.

• ArticleWhat Happens to Your Business Email If You Keep Ignoring DMARCIgnoring DMARC does not produce a loud error. It produces invoices that land in spam and password resets that never arrive. Here is what the major providers now enforce, and why rushing the fix blocks your own mail.
• ArticleEmail Authentication Explained in Plain EnglishSPF, DKIM, DMARC and BIMI sound like four unrelated acronyms. They are really one chain, and the order matters more than anything else. Here is what each one does, in language that assumes nothing.
• ArticleHow Impersonation Scams Target Small Businesses, and Which Verifications Actually Stop ThemA verified badge does not stop someone registering a domain that looks like yours. DMARC at enforcement does stop mail sent as your exact domain. Here is the honest map of which protection blocks which attack.
• ArticleDIY Verification or Hire Someone: An Honest Cost ComparisonSome verification work is a twenty-minute form you should never pay for. Some of it fails in ways that cost you a mail flow, a month, or a listing you cannot get back. Here is where the line sits.
• ArticleApple Branded Mail vs BIMI: What Each One Actually DoesApple Branded Mail and BIMI both put your logo in the inbox, but they are separate systems and neither one delivers the other. Here is what each requires, which Apple surfaces show which logo, what it costs, and the order to build them in.
• ArticleApple Branded Mail Setup: Requirements, Logo Rules and StepsApple Branded Mail shows your logo and brand name beside your emails in Apple Mail. It costs nothing and needs no certificate, which makes it the cheapest email trust signal available. The catch is the prerequisites. Here is what Apple actually checks, the exact logo specs, and the traps that stall applications.
• ArticleApple Branded Mail Not Showing: Work Through It In This OrderYou set up Branded Mail, Apple said yes, and the logo still is not there. Most of the time the setup is fine and the test is wrong. Here is the order to check things in, with Apple's actual requirements rather than a summary of them.
• ArticleCustomers Are Getting Fake Invoices From My Company: What to Do FirstSomeone is sending invoices in your company's name and your customers are paying them. Money moving comes before email fixes. Here is the order to work in: the bank, then the FBI's IC3, then working out whether the mail is coming from your real domain, a lookalike domain, or a mailbox someone has broken into. Only one of those three is a DMARC problem.
• ArticleSomeone Is Sending Emails Pretending to Be My Company: What to Do NowFake emails going out in your company's name have three different causes, and they have three completely different fixes. This page shows you how to tell which one you have in the next hour, and what to do about it in priority order.
• ArticleHow to Stop Someone Impersonating Your Business OnlineSomeone is using your business name to take money from your customers. This is a triage guide: find every surface being impersonated, then handle them in order of financial damage. It gives the actual reporting routes, the exact forms, and an honest account of what each one can and cannot achieve.
• Setup guideDMARC setup for GoDaddyAdd a DMARC record in GoDaddy DNS, avoid the doubled-domain Name field trap, enable DKIM, and verify with a real DNS lookup instead of trusting the panel.
• Setup guideDMARC setup for Microsoft 365 / Outlook (Exchange Online)Set up DMARC and DKIM on Microsoft 365. The Defender portal steps, the two CNAMEs you cannot copy from a template, and how to verify it worked.
• Setup guideDMARC setup for Google WorkspaceGoogle Workspace signs your mail with gappssmtp.com by default, so DMARC quietly rests on SPF alone. Here is the exact Admin console and DNS fix.
• Setup guideDMARC setup for Cloudflare DNSAdd SPF, DKIM and DMARC in Cloudflare's DNS Records tab. Covers the Name field trap, TXT quoting errors, CNAME flattening, and how to verify with dig.
• Setup guideDMARC setup for NamecheapStep-by-step DMARC, SPF and DKIM setup in Namecheap Advanced DNS, including the Host field trap that silently breaks records and how to delegate access safely.
• Setup guideDMARC setup for Shopify-managed domainsSet up SPF, DKIM and DMARC on a domain bought through Shopify. Exact admin path, the Name field trap, sender email authentication, and how to verify it.
• Setup guideDMARC setup for SquarespaceEmail authentication setup for Squarespace domains, including those migrated from Google Domains. Exact field names, the Name field trap, and how to verify.