Email Security · Phishing and Fraud
Service group: CybersecurityMake email a harder way in, and your domain harder to fake
Email remains the most common starting point for fraud and compromise. We tune filtering, lock down your domain with SPF, DKIM and DMARC, protect key people from impersonation and watch for the mailbox changes attackers make after they get in.
At a glance
- Service
- Configuration and ongoing management of inbound filtering, sender authentication and mailbox protections
- Best suited to
- Organizations of roughly 5 to 200 employees on Microsoft 365 or Google Workspace that handle payments or client data by email
- Core inclusions
- Anti-phishing and anti-malware policy, SPF, DKIM and DMARC deployment, impersonation protection, quarantine management and forwarding rule monitoring
- Not included by default
- Third-party filtering licences, email archiving for legal hold, email encryption gateway projects and after-hours response
- Pricing basis
- Fixed-fee DMARC and hardening project, with ongoing management per user per month, confirmed in a written quotation
- Regions
- Delivered remotely to organizations across Canada
- How to start
- Book a consultation or begin with a Microsoft 365 Security Assessment
What email security covers
Email security has three jobs. First, stop malicious messages from reaching inboxes: phishing links, malware attachments and fraud attempts. Second, stop others from sending email that pretends to come from your domain, which protects your clients and suppliers as much as your staff. Third, detect when a mailbox has been taken over, because attackers who get in quietly create forwarding and inbox rules to hide their activity.
We configure and maintain the controls for all three, primarily using Microsoft Defender for Office 365 and Exchange Online Protection in Microsoft 365, or the equivalent Google Workspace settings. Where a third-party filtering gateway is already in place, we manage it alongside the native controls.
Sender authentication is often the most neglected part. SPF, DKIM and DMARC records tell receiving servers which systems may send for your domain and what to do with messages that fail. Moving DMARC to enforcement takes care because every legitimate sender, from your CRM to your accounting software, must be identified first.
Email risks we see most
Business email compromise
An attacker uses a compromised or look-alike mailbox to redirect a supplier payment or payroll deposit.
Domain spoofing
No DMARC policy, or one left at monitoring only, lets anyone send email that appears to come from your domain.
Hidden mailbox rules
After a takeover, rules forward mail externally or move replies to obscure folders so the real owner never sees them.
Default filtering
Filtering runs on out-of-the-box settings with no impersonation protection for executives or trusted suppliers.
Controls we manage
Inbound filtering policy
Anti-spam, anti-malware and anti-phishing policies, including Safe Links and Safe Attachments where licensed, tuned for your mail flow.
SPF, DKIM and DMARC
Inventory of legitimate senders, correct DNS records, DMARC aggregate report review and staged progress from monitoring to quarantine and reject.
Impersonation protection
User and domain impersonation protection for leaders, finance staff and key suppliers, plus external sender tagging.
Mailbox compromise detection
Alerts and periodic review for new external forwarding, suspicious inbox rules and unusual sign-ins linked to mailboxes.
Quarantine and release
Quarantine policies and a clear process for staff to request release of legitimate messages.
Outbound protections
Blocking automatic external forwarding by default and outbound spam limits that flag a compromised account sending in bulk.
Scope
Typically included
- Anti-phishing, anti-malware and anti-spam policy configuration
- SPF, DKIM and DMARC deployment for domains listed in your scope
- DMARC report review and staged enforcement
- Impersonation protection for nominated people and domains
- Monitoring for suspicious forwarding and inbox rules
- Quarantine management and release process
- Review of user-reported suspicious messages during agreed hours
Requires separate scope or quotation
- Third-party email filtering or archiving licences
- Email migration between platforms
- Legal hold, eDiscovery or litigation support
- After-hours handling of reported messages unless written into your plan
- Changes to third-party sending platforms you do not give us access to
Technologies
- Exchange Online Protection and Microsoft Defender for Office 365
- Google Workspace Gmail security settings
- SPF, DKIM, DMARC and MTA-STS standards
- DMARC aggregate report analysis tools
- Third-party secure email gateways where already in place
- Microsoft Purview message encryption where licensed
Who should prioritize this
Businesses that pay suppliers by email instruction
Construction, real estate, manufacturing and professional firms where invoices and banking changes arrive by email.
Organizations with a public-facing brand
Businesses whose clients would trust an email that appears to come from your domain.
Teams recovering from a mailbox takeover
Organizations that want to close gaps after a compromise and detect the next one sooner.
Benefits
- Fewer phishing and malware messages reaching staff
- Your domain harder to spoof against clients and suppliers
- Earlier detection of a compromised mailbox
- Clear process for releasing legitimate quarantined mail
- Improved delivery of your own legitimate email
How we work
Mail flow review
We review filtering policies, DNS records, forwarding rules and recent threats in your tenant.
Sender inventory
We identify every service that sends email as your domain using DMARC reports and your input.
Hardening
Filtering and impersonation policies are strengthened and external forwarding is restricted.
DMARC enforcement
We move DMARC from monitoring to quarantine and then reject once legitimate senders pass.
Ongoing management
We review reports, adjust policies and watch for compromise indicators under your scope.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Email hardening and DMARC project
A fixed-fee project to tune filtering and take DMARC to enforcement.
Ongoing email security management
Per-user monthly policy management, report review and compromise monitoring.
Pair with training
Combine with Security Awareness Training so staff catch what filters miss.
Frequently asked questions
Will DMARC stop our own emails from being delivered?
Not if it is introduced carefully. We start in monitoring mode, identify every legitimate sender, fix their SPF and DKIM alignment, and only then move to enforcement.
Do we need a third-party email filter on top of Microsoft 365?
Many organizations do well with Defender for Office 365 properly configured. We assess your threats and licences before recommending an additional product.
Can you stop all phishing emails?
No filter catches everything. We reduce what reaches inboxes, add warnings, and pair filtering with staff training and quick reporting.
What should we do if a supplier's banking details change by email?
Verify using a phone number you already have on file, never one from the email itself. We can help set up a written verification procedure as part of the engagement.
Related services
Products and packages
Industries we support
Service areas
Check whether your domain can be spoofed today
We will review your filtering, DMARC status and mailbox rules and propose a written plan.