Email Domain Protection: SPF, DKIM & DMARC
Stop scammers spoofing your company email address. Complete SPF, DKIM and DMARC enforcement across Google Workspace, Microsoft 365, and mail services.
Protect your brand identity, stop email spoofing and fake invoice scams
Email domain authentication tells receiving mail servers how to treat email that claims to come from your exact company address but was not sent by you. Setting up SPF, DKIM and DMARC records protects your business reputation and helps your real invoices reach client inboxes.
When a domain lacks DMARC enforcement, anyone on the internet can send email claiming to come from your address. Cybercriminals routinely abuse this to send fake invoices and payment redirection requests to your clients. Mailbox providers such as Gmail and Outlook also check these records, so a domain without them is more likely to see real messages go to spam.
We audit every service sending mail on your behalf (Google Workspace, Microsoft 365, SendGrid, Amazon SES, Xero, Mailchimp), configure aligned SPF and DKIM records, and deploy a DMARC policy. We start in monitoring mode (p=none) to ensure no legitimate traffic is blocked, and systematically step up to quarantine (p=quarantine) or reject (p=reject). Before we change anything, the domain owner gives written permission and access to wherever the DNS is hosted. NullGlitch is a sole trader and not GST-registered, so no GST is added.
What’s included in Email Domain Protection
Built around commercial clarity, faster delivery, and clean execution.
Comprehensive sender discovery
We identify every third-party service legitimately sending emails using your domain, including Xero, Mailchimp, CRM, and website forms.
SPF alignment and lookup optimisation
We construct a compliant Sender Policy Framework record that lists authorised senders while keeping DNS lookups within strict limits.
DKIM cryptographic key configuration
We generate and publish DomainKeys Identified Mail (DKIM) public keys so receiving mail servers can verify cryptographic message integrity.
DMARC enforcement policy deployment
We configure your DMARC record to instruct receiving mail providers to quarantine or reject unauthenticated messages pretending to be you.
DMARC aggregate report monitoring
We route DMARC XML reports to aggregate analysis tools to inspect sending sources and catch unauthorised spoofing attempts.
Form and transactional relay alignment
We verify that your website contact forms and transactional mailers use authenticated sender addresses matching your domain policies.
How the project runs
Clear phases, no mystery, and no padded process theatre.
Sender Audit
With the domain owner's written permission, we list every service sending mail as you.
DNS Alignment
We configure aligned SPF records and DKIM cryptographic signatures.
DMARC Monitoring
Deploy DMARC in monitoring mode to verify all legitimate mail flows pass.
Enforcement
Step up policy to quarantine or reject, blocking unauthorised impersonation.
Email Domain Protection Pricing
Transparent options for email domain protection work, scoped around delivery rather than fluff.
Complete Domain Protection
Full SPF, DKIM, and DMARC setup and policy enforcement
- Full audit of all sending services (365, Google, Xero, etc.)
- SPF record optimisation within DNS lookup limits
- DKIM key generation and DNS selector deployment
- DMARC policy deployed and stepped to quarantine/reject
- Website contact form and transactional mail alignment
- Written summary report and DNS handover documentation
- NullGlitch is a sole trader and not GST-registered, so no GST is added
Monthly DMARC Monitoring
Ongoing aggregate report monitoring and anomaly detection
- Continuous ingestion of DMARC aggregate XML reports
- Monthly summary of authentication pass rates
- Alert when an unknown sender shows up in the reports
- DNS adjustments when you add new email services
- Priority support for email deliverability issues
- Cancel anytime with no lock-in contract
All prices are estimates. Final quote based on project scope. Contact us for a custom quote.
Questions before you commit
Straight answers on timing, scope, support, and what happens after launch.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a security standard that tells receiving mail servers how to handle emails sent from your domain that fail SPF or DKIM checks. Without DMARC, anyone can forge your domain in the "From" line to send fake invoices or scams to your clients.
Ready to move this forward
If the goal is cleaner delivery, stronger proof, and a site or system that earns its keep, let’s scope the next step properly.