Security hardening / United Kingdom
Email security
Review domain authentication and mailbox controls, then plan changes without disrupting legitimate business email.
Last reviewed . Fees in pounds sterling plus VAT.
Which services are allowed to send as your domain?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement.
Primary references
Microsoft: how email authentication worksInside the work
Which services are allowed to send as your domain?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Senders | Identify all legitimate services and sending domains. | Owners, authentication configuration and sample headers where safely available. |
| Policy | Assess alignment and the impact of stronger enforcement. | Evidence of legitimate streams and rollout decisions. |
| Operation | Agree changes, monitoring and response ownership. | Test results, reporting destination and rollback record. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Review domain authentication and mailbox controls, then plan changes without disrupting legitimate business email.
- Authorised sender and domain inventory
- SPF, DKIM and DMARC observations
- Agreed mailbox and impersonation-control review
- Prioritised change, monitoring and rollback plan
How the work moves forward
Assess first. Change with control.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Confirm the boundary
Agree systems, permissions, dependencies and exclusions.
Assess the evidence
Record observed settings and prioritise the agreed risks.
Control the change
Approve remediation, test the result and keep a handover record.
A practical starting point
Which services are allowed to send as your domain?
Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement.
Senders — Identify all legitimate services and sending domains. — Owners, authentication configuration and sample headers where safely available. Policy — Assess alignment and the impact of stronger enforcement. — Evidence of legitimate streams and rollout decisions. Operation — Agree changes, monitoring and response ownership. — Test results, reporting destination and rollback record.
Before you commission the work
Your questions.
Clear answers.
Which services are allowed to send as your domain?
Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement.
What is included in the engagement?
Authorised sender and domain inventory; SPF, DKIM and DMARC observations; Agreed mailbox and impersonation-control review; Prioritised change, monitoring and rollback plan. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
DNS changes, mailbox remediation and ongoing monitoring require explicit scope and authorisation. Authentication does not guarantee inbox placement or prevent every phishing message.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
Will SPF, DKIM and DMARC guarantee inbox delivery?
No. Authentication helps recipients evaluate sending identity, but delivery also depends on reputation, content and recipient systems. Inventory legitimate senders, test alignment and review reports before tightening enforcement so authorised services are not disrupted.
Does the assessment include mailbox compromise protection?
Domain authentication and mailbox protection are different areas. Agree whether the scope includes access controls, legacy authentication, suspicious forwarding, administrative roles, alerts and incident procedures as well as DNS records. A DMARC record alone does not secure a mailbox.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Let’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project