Right now, anyone can send email as your business.
Not by breaking into your mailbox — by forging your domain. That's how fake invoices reach your customers and how phishing reaches your staff. DMARC is the record that stops it, and this is the service that gets it done properly and keeps it that way.
You usually find out from a customer
Domain spoofing leaves no trace in your own systems. These are the three ways it normally surfaces.
Customers get invoices you never sent
Business email compromise usually starts with a spoofed domain, not a hacked mailbox. Nothing in your account looks wrong because nothing in your account was touched.
Your real email lands in spam
Gmail and Outlook now demand sender authentication from bulk senders. Domains without it get filtered — quotes, invoices and booking confirmations quietly stop arriving.
You were told you "have DMARC"
Most domains sit on p=none forever — a record that reports on spoofing and blocks none of it. It ticks the box on a questionnaire and stops nothing.
Check your own domain first
Run an instant check of your SPF, DKIM and DMARC records. No signup, no credit card — it runs on DMARC Busta, the platform we built and the same one this service monitors you with.
What's included
Set up properly, then actually watched
DMARC is not a one-off DNS change. Your senders change every time you add a CRM, a booking system or a new invoicing tool — and every one of those changes can quietly break authentication. This is the ongoing part.
- SPF, DKIM and DMARC records built and published correctly the first time — aligned across every legitimate sender you actually use
- A staged move to p=reject, the setting that actually blocks spoofed mail, without cutting off your real email on the way
- Continuous monitoring, so a new sender or a broken record surfaces as an alert rather than as a customer complaint
- Monthly plain-English report: who tried to send as you, what we blocked, and what changed
- Record changes handled for you — new CRM, new mail platform, new invoicing tool, we re-align it
Email Security Management
$99 /month + GST
Per domain. No setup fee, no lock-in contract — cancel any time.
Get Protected →Secure checkout in our client portal
Not sure whether your domain is already covered? We'll check it and tell you straight — no charge, no obligation.
Request a free checkWe didn't just learn this — we built the tool
The monitoring behind this service runs on DMARC Busta, our own platform. Other IT providers pay to use it; you get it as part of the service, along with the people who wrote it. The security side of our business trades as HCSE, so the same team handles this whether you came to us for a website or not.
Already on a Protection Plan or with us for hosting? Mention it and we'll fold the onboarding in with your existing service.
Common Questions
What actually is DMARC?
It's a DNS record that tells Gmail, Outlook and every other mail provider what to do with email that claims to be from your domain but isn't. Set up properly, it makes forged email from your domain bounce instead of land. SPF and DKIM are the two records it depends on — all three have to agree, which is where most setups fall over.
Isn't this included in Microsoft 365 or Google Workspace?
No. They give you the ingredients — you still have to publish the records, align every third-party sender, and move to enforcement without breaking anything. That configuration work, and keeping it correct as your tools change, is what this service is.
Will this break our email?
Not if it's staged. That's the whole reason this is a managed service and not a one-off job. We publish in monitoring mode first, watch the reports until every legitimate sender is accounted for, then tighten to enforcement. Rushing straight to p=reject is exactly how people lose mail.
Do you need to host our website or email to do this?
No. This works on any domain, wherever your site and mailboxes live. We need access to your DNS records, or someone who can make the changes we send through.
How long until we are protected?
Records go in within a few days of getting DNS access. Reaching full enforcement typically takes four to six weeks — that window is us watching real mail flow so nothing legitimate gets caught.
Is the price per domain?
Yes — $99/month + GST covers one domain. Extra domains and parked domains you never send from are quoted together; ask and we will price the set.
Other services
WEB DESIGN
Web Design
Mobile-first sites built around what your business actually needs. Fixed prices, fast load times, and you own everything.
HOSTING
Website Hosting
Fast Australian servers, email, auto-renewing SSL, and real support from the team that built your site. One call, no finger-pointing.
PROTECTION
Protection Plans
Monthly plans that keep your website updated, monitored, hardened and backed up — so it never ends up in our emergency queue.
SEO
Search Engine Optimisation
Honest, measurable SEO built around how Google works in 2026. Core Web Vitals, E-E-A-T, local rankings, and reports in plain English.
Find out if your domain is exposed
We'll check your SPF, DKIM and DMARC records and tell you plainly what's missing — whether or not you buy anything.