Initial finding
Your business has not published a policy asking email providers to reject messages impersonating you. We will check which services legitimately send your email before putting that protection in place.
What is going on
Tell email providers which messages to reject.
Email was built so that any server can put any address in the From line. A domain owner can publish a policy that tells receiving providers to reject messages that fail authentication in its name. Most small-business domains have never published one.
Google, Yahoo and Microsoft now require authentication from the senders they receive from, with the strictest rules for bulk senders. A domain without these records is easier to impersonate, and its own mail is harder for providers to trust.
Roughly a third of the small-business domains we check have the gap. The fix is a small set of DNS records and mailbox settings, set carefully and switched on in stages.
What we do
We guide the setup and handle the testing and monitoring.
- We check your setup and identify your sending services
Public DNS first, then your answers to two plain questions: what sends email as your domain, and where its DNS is managed.
Us, with one reply from you - You or your administrator apply the guided changes
DNS records from the exact values we send, pasted at your host or applied by us with a scoped Cloudflare token. If your mailbox is Google Workspace or Microsoft 365, an administrator switches signing on from our steps.
You, usually under half an hour in total - We verify, monitor, and complete the protective rollout
One test email from each service, checked against the receiving server's own headers. Then monitoring, quarantine and reject in stages, each after two clean weeks of reports, with a short note every week and your written sign-off before the final stage.
Us, about six weeks
The full sequence, step by step
- We read your domain
Public DNS only. We see your mailbox host and whatever is already published, and tell you what a receiving server can and cannot verify about you today.
Us - You answer two plain questions
Which services send email as your company (your mailbox, maybe invoicing, a newsletter tool, a website form) and where your domain's DNS is managed.
You, one reply - We write the records
Exact values, with the field names your DNS host uses. You paste them in, or give us a scoped Cloudflare token and we apply them with a full backup of the zone first. Where a mailbox platform has to switch signing on, we send the exact clicks for your administrator.
Us, then you - You send one test email per service
We check the real headers the receiving server wrote, and tell you which services pass and what to change for any that do not.
You, one email each - We switch enforcement on in stages
First monitoring, then quarantine, then reject, each after two clean weeks of reports. You get a short note every week. Nothing moves forward while a report shows legitimate mail failing.
Us, about six weeks - You sign off on the final stage
Reject only goes on when you say so, in writing. After that, providers that honour your policy refuse mail that fails authentication in your name.
You
$299once
What it costs
One price. No software, no subscription, no access to your mailbox.
- One domain: your mailbox platform plus up to four other services that send as it. More than that is quoted in writing first.
- Every one of those services verified with a real message
- The records written for your DNS host, applied for you on Cloudflare if you prefer
- Enforcement switched on in stages over about six weeks, with a weekly note
- Reports from Google, Microsoft and Yahoo read for you, so you never open an XML file
- A status page for your order, and a written summary of everything changed and how to undo it
Payment is processed by SimpleApps Studio, the company behind MailSigned; the payment page and your receipt say so. If your domain turns out to be one we cannot set up, you get a full refund. The page before payment spells out the rest.
Example customer updates
Plain words at every step, and a record of everything changed.
Three of the messages you receive during an order. Short, because the work is ours.
Progress update
Your business email and newsletter service passed our checks. We are monitoring for any other legitimate senders before moving to the next stage.
Completion
Your protection is now enabled. We tested your confirmed sending services and have included a record of the changes, along with instructions for reversing them.
Questions
Asked before ordering.
Will this block any of our real email?
The staged rollout exists to prevent exactly that. Every service you tell us about, and any that turns up in the providers' reports, sends a test message that we check against the receiving server's own headers. Enforcement moves forward only after two weeks of reports show nothing legitimate failing, and the final stage waits for your written go-ahead. If a service cannot be made to pass, we stop at the last safe stage and tell you exactly what is left.
What access do you need?
None to your mailbox contents. Two things happen outside it. DNS records are added at your domain's host: you paste them from the exact values we send, or on Cloudflare you give us a token limited to DNS edits on that one zone, revocable the moment we are done. And if your mailbox is Google Workspace or Microsoft 365, an administrator switches signing on and adds one record; we send the exact steps. Other services, such as invoicing or newsletter tools, usually have a "verify your domain" page that gives the same kind of record.
How long does it take?
The records are usually in place the same day you reply. The protective policy is switched on in stages so nothing of yours gets caught by it, which takes about six weeks from start to reject.
We use Google Workspace or Microsoft 365. Is this not already handled?
Both can sign your mail, but neither publishes the policy that tells other providers to refuse forgeries, and signing is often not switched on. The free check shows what your domain publishes today, in plain words, before you decide anything.
What is actually being set up?
A small set of public DNS records and, where needed, a setting inside your mailbox platform. SPF lists the servers allowed to send for your domain. DKIM is a signature your sending service adds so the receiver can confirm the message was not altered and came from you. DMARC is the policy that tells receivers what to do when a message fails both, and where to send the reports. The records are the easy part. Knowing every service that sends as you, and proving each one passes before you enforce, is the work.
Do you use this yourselves?
Yes. mailsigned.com publishes a reject policy, a strict sender list and a signing key, and every email we send you passes the checks we are asking you to pass. Any DMARC checker shows it; ours does too.
What if it cannot be finished?
If a service cannot authenticate at all, we stop at the last safe stage, leave every record in place, and give you a written account of what remains and why. If your domain turns out to be one we cannot set up at all, you get a full refund. The terms say the same in full.