Right now, anyone can send email as your business.
Not by breaking into your mailbox — by forging your domain. That's how fake invoices reach your customers and how phishing reaches your staff. DMARC is the record that stops it, and this is the service that gets it done properly and keeps it that way.
You usually find out from a customer
Domain spoofing leaves no trace in your own systems. These are the three ways it normally surfaces.
Customers get invoices you never sent
Business email compromise usually starts with a spoofed domain, not a hacked mailbox. Nothing in your account looks wrong because nothing in your account was touched.
Your real email lands in spam
Gmail and Outlook now demand sender authentication from bulk senders. Domains without it get filtered — quotes, invoices and booking confirmations quietly stop arriving.
You were told you "have DMARC"
Most domains sit on p=none forever — a record that reports on spoofing and blocks none of it. It ticks the box on a questionnaire and stops nothing.
Check your own domain first
Run an instant check of your SPF, DKIM and DMARC records. No signup, no credit card — it runs on DMARC Busta, the platform we built and the same one this service monitors you with.
What's included
Set up properly, then actually watched
DMARC is not a one-off DNS change. Your senders change every time you add a CRM, a booking system or a new invoicing tool — and every one of those changes can quietly break authentication. This is the ongoing part.
- We decide what counts as legitimate. Automation approves senders that pass; a human has to look at the one nobody recognises and work out whether it is your new booking system or somebody warming up to impersonate you. Waving through a stranger is how a domain gets handed to an attacker with a tick next to it.
- Someone is accountable when mail stops. Automatic rollback is a feature. A person who rings your biggest customer to explain why the invoice bounced is a service.
- It actually gets done. Self-serve DMARC dies in the "I'll sort the DNS this weekend" pile — we have seen it a hundred times. We take DNS access on day one, records go in that week, and we drive it to enforcement over the following month.
- Your stack changes and we re-align it. A new CRM, a new mail platform, a new invoicing tool — each one can quietly break authentication, and none of them tell you they have.
- A monthly read, not another dashboard to ignore: what changed, what it means, and whether you need to do anything.
Email Security Management
$99 /month + GST
Per domain. No setup fee, no lock-in contract — cancel any time.
Get Protected →Secure checkout in our client portal
Not sure whether your domain is already covered? We'll check it and tell you straight — no charge, no obligation.
Request a free checkWe built the tool. This is us running it.
The platform behind this service is DMARC Busta — ours. We wrote it, and other IT providers pay to use it. The security side of our business trades as HCSE, so the same people handle this whether you came to us for a website or not.
You could licence it yourself
And we'd rather tell you that than have you find out afterwards. DMARC Busta starts at $19/month, and a single domain is free. If you're comfortable in DNS, you understand what an aggregate report is telling you, and you'll genuinely make time for it — take the free tier. We mean that.
The $99 isn't the software. It's the judgement calls about which senders are really yours, someone carrying the responsibility when something breaks, and the job getting finished instead of sitting at 80% forever. Most people who start with the free tier end up here — not because the tool fell short, but because nobody had the hour a month to sit with it.
Already on a Protection Plan or with us for hosting? Mention it and we'll fold the onboarding in with your existing service.
Common Questions
What actually is DMARC?
It's a DNS record that tells Gmail, Outlook and every other mail provider what to do with email that claims to be from your domain but isn't. Set up properly, it makes forged email from your domain bounce instead of land. SPF and DKIM are the two records it depends on — all three have to agree, which is where most setups fall over.
Isn't this included in Microsoft 365 or Google Workspace?
No. They give you the ingredients — you still have to publish the records, align every third-party sender, and move to enforcement without breaking anything. That configuration work, and keeping it correct as your tools change, is what this service is.
Your own tool is $19 a month and has a free tier. Why is this $99?
Because they're different things, and we'd rather say so plainly. DMARC Busta is the software — it collects the reports, and it can advance your policy automatically once senders are passing. The $99 is a person: deciding whether an unrecognised sender is your new booking system or someone impersonating you, carrying the responsibility if legitimate mail stops, and making sure the job reaches enforcement instead of stalling at 80%. If you're comfortable in DNS and you'll genuinely make the time, use the free tier — we mean it.
Will this break our email?
Not if it's staged. That's the whole reason this is a managed service and not a one-off job. We publish in monitoring mode first, watch the reports until every legitimate sender is accounted for, then tighten to enforcement. Rushing straight to p=reject is exactly how people lose mail.
Do you need to host our website or email to do this?
No. This works on any domain, wherever your site and mailboxes live. We need access to your DNS records, or someone who can make the changes we send through.
How long until we are protected?
Records go in within a few days of getting DNS access. Reaching full enforcement typically takes four to six weeks — that window is us watching real mail flow so nothing legitimate gets caught.
Is the price per domain?
Yes — $99/month + GST covers one domain. Extra domains and parked domains you never send from are quoted together; ask and we will price the set.
Other services
WEB DESIGN
Web Design
Mobile-first sites built around what your business actually needs. Fixed prices, fast load times, and you own everything.
HOSTING
Website Hosting
Fast Australian servers, email, auto-renewing SSL, and real support from the team that built your site. One call, no finger-pointing.
PROTECTION
Protection Plans
Monthly plans that keep your website updated, monitored, hardened and backed up — so it never ends up in our emergency queue.
SEO
Search Engine Optimisation
Honest, measurable SEO built around how Google works in 2026. Core Web Vitals, E-E-A-T, local rankings, and reports in plain English.
Find out if your domain is exposed
We'll check your SPF, DKIM and DMARC records and tell you plainly what's missing — whether or not you buy anything.