Email security
Anyone can send email as your business. Here’s how to stop them.
A spoofed email looks like it came from your domain - because, right now, technically it can. That’s exactly how fake-invoice scams land on your customers.
Updated bank details for payment
Accounts Payable
9:14 AMHi,
Quick heads up - we’ve changed banks. Please update our details for the next invoice so payment isn’t delayed:
BSB 000-000 · Acct 0000 0000
Cheers
This is what your customers see. No hacking required - just an unprotected domain.
The problem, in plain English
Your customers trust email from your domain. So do scammers. If your domain isn’t locked down, anyone can send an email that lookslike it’s from you - to your clients, your suppliers, your staff - asking them to pay a “new” bank account or click a dodgy link. When it works, it’s your name and your reputation on the line.
The three settings that decide it
It’s called the DMARC ladder. Most domains are stuck on the bottom rung.
p=noneWatching, doing nothing.
Where most domains are stuck - feels safe, isn't.
p=quarantineSpoofed mail gets sent to junk.
Better - but the spoof still lands somewhere.
p=rejectSpoofed mail is blocked outright.
This is the protection.
It’s a single DNS record, walked up the ladder carefully so you don’t bounce your own legitimate mail. About 20 minutes done properly.
Ever wondered how the big brands get their logo next to their emails?
It’s called BIMI, and it’s not reserved for the big end of town. Once your domain enforces DMARC, Gmail and Yahoo will show your logo next to every email you send. Your customers see proof it’s really you before they even open it - and a scammer pretending to be you can’t fake it.
Some Supplier
8:47 AMInvoice attached - please find our latest...
EwanMeIt
9:02 AMYour monthly report is ready - one thing worth a look...
Same inbox. One sender proved who they are.
Getting there takes two things: the lockdown work below, and a mark certificate on top. I’m walking the same path on my own domain, and I’ll tell you plainly whether the certificate is worth it for your business, because for some it isn’t. Sing out if you want a hand.
Fixed-price pack
Domain Lockdown
Stop anyone sending email as your business.
1 - 2 hours · fixed scope
Secure checkout · GST added at checkout · full scope →
What I’ll do - free
I’ll run a free health check on your domain and send you a one-page action list: exactly what’s exposed, in priority order, written so you (or whoever looks after your IT) can knock it over. If you’d rather I just fix it, we start with a free 15-minute triage call so you know the cost before anything is billed ($150/hr).
Why me
I’m Ewan Milroy - a Brisbane-based IT consultant. 15+ years, no outsourcing, no overseas helpdesk. You deal with me.
“Ewan is a tech wizard! He's saved us more times than I can count - quick, calm, and always one step ahead.”
Free, actionable, no spam. Yours to keep - hand it to your IT person if you’ve got one. No lock-in, no obligation.