Protect
Email security and fraud protection
Make your domain harder to spoof and payment fraud harder to pull off.
We set up SPF, DKIM and DMARC properly for your domains, tighten your email platform protections, close off risky forwarding and help you put a payment verification process in place that staff actually follow. DMARC only moves to enforcement after every legitimate sender has been found and validated, so your own email keeps arriving.
Request a quote- Price
- Quoted on scope
- How you can engage us
- One-off project · Ongoing service · Project, then ongoing
- Delivered by
- Cyber Guys
- Review cadence
- DMARC reports and settings reviewed on the schedule agreed in the scope when continued as an ongoing service
Who it is for
Businesses that send invoices, receive payments or handle client money by email and want to reduce the risk of spoofing and business email compromise.
Scope
Your sending domains and their DNS, your Microsoft 365 or Google Workspace email settings, and the payment and bank-detail change process agreed in the scope.
What is included
- Discovery of every service that sends email as your domains, such as accounting, CRM and marketing platforms
- SPF records corrected and kept within lookup limits
- DKIM signing set up for your email platform and each legitimate sender that supports it
- DMARC published in monitoring mode, then moved to enforcement in stages once every legitimate sender is validated
- Sender and domain configuration, including parked domains that should not send email
- Email platform protections for phishing, spoofing and malicious attachments, within your licence
- Review of external forwarding and inbox rules that could expose email to an attacker
- Business email compromise risk review
- A documented payment verification process, including how bank-detail changes are confirmed
- A short staff awareness briefing on payment fraud and spoofed email
- Monitoring of DMARC reports and settings, where supported, when continued as an ongoing service
What is not included
- Work outside the agreed scope, which is quoted separately
- Recovering funds lost to fraud, or dealing with banks on your behalf
- Legal advice
- Purchasing third-party email security or DMARC reporting products
- Changes inside third-party sending platforms you control, beyond telling you what to change
- Incident response to an active compromise
How delivery works
- 01
Find every sender
We identify every service that sends email as your domains, using your input, DNS and DMARC reports.
- 02
Plan
We agree the order of changes, the forwarding and protection settings, and the payment verification process.
- 03
Implement in stages
We correct SPF and DKIM, publish DMARC in monitoring mode, tighten platform protections and forwarding, and document the payment process.
- 04
Validate, then enforce
We check that every legitimate sender passes before DMARC moves to enforcement, one step at a time.
- 05
Monitor
Optional: an ongoing service reviews DMARC reports and settings and flags new or failing senders.
Who does what
You
- Tell us about every service that sends email on your behalf
- Provide or arrange DNS access through your domain registrar or DNS host
- Approve each DNS and email platform change
- Adopt the payment verification process and make sure staff follow it
Cyber Guys
- Find and validate legitimate senders before any enforcement step
- Plan each change with its business impact and rollback
- Make or coordinate the agreed changes and verify them
- Document the payment verification process with you
- Report what was done, what was verified and what remains
Your IT provider or partner
- Your IT provider, where they manage DNS or email, makes or approves changes and confirms the result
- Third-party sending platforms may need settings changed by whoever administers them
Access we need
- DNS change access for each in-scope domain, or a contact who can make changes
- Administrator access to your email platform security settings
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Some email protections depend on your Microsoft 365 or Google Workspace licence
- Ongoing DMARC report monitoring may need a reporting tool
- Third-party senders must support SPF or DKIM alignment for DMARC enforcement
What you receive
- Sender inventory for each domain
- DNS change log with verification results
- Email platform protection settings record
- Payment verification process
- Staff briefing material
- Handover report
How we know it is finished
- SPF and DKIM pass for every validated sender
- DMARC is at the agreed policy level, with any remaining step recorded and scheduled
- The payment verification process is adopted by an authorised person
- The handover report is delivered
Related services
Microsoft 365 security
Secure your Microsoft 365 tenant without breaking how your business works.
Quoted on scopeRequest a quoteGoogle Workspace security
Configure Google Workspace securely, around how your team works.
Quoted on scopeRequest a quoteStaff awareness and phishing simulation
Short, relevant training and realistic practice for your team.
Quoted on scopeRequest a quoteIncident preparedness
Know who does what before something goes wrong.
Quoted on scopeRequest a quote
Request a quote for Email security and fraud protection
Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.