If your domain’s email records aren’t locked down, anyone can send an email that looks as if it came from your managing partner or accounts team. We set up SPF, DKIM and enforced DMARC properly — without blocking your legitimate emails.
Why “Monitor only” DMARC (`p=none`) isn’t enough
When we run our free security snapshots for Cardiff law firms, accountants and property practices, we frequently find that either DMARC is missing altogether, or someone set it to p=none years ago and left it there.
A p=none policy tells receiving mail servers to let fake emails straight into your clients’ inboxes anyway. Real protection means moving safely to p=quarantine or p=reject after checking every system that legitimately sends mail on your behalf (such as Microsoft 365, Xero, Sage, Mailchimp or your case management software).
What we do
- Free external check: We inspect your live SPF, DKIM and DMARC records and tell you in plain English whether your domain can be spoofed today.
- Sender audit: We identify every legitimate service sending email from your domain so nothing breaks when protection is turned on.
- Clean SPF & DKIM signing: We cryptographic-sign your outbound mail and keep your SPF record within the strict 10-lookup limit.
- Enforced DMARC: We step your policy up to quarantine/reject so impersonation attempts are blocked automatically.
Common questions
Will setting up DMARC break our normal emails or Xero invoices?
Not when done properly. We audit yourDMARC aggregate reports first so every legitimate sender (Microsoft 365, Xero, CRM, website forms) is authorised before enforcement is switched on.
How can I check if our domain is protected right now?
Email ross@alphabyte.it with your domain name and we will send you a free one-page security snapshot showing your exact SPF, DKIM and DMARC status.