Title: Email security > Email security for UK organisations: review domain authentication, SPF, DKIM, DMARC and mailbox controls, then plan changes without disrupting legitimate email. Source: https://aegentra.co.uk/services/harden/email-security Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Security hardening / United Kingdom # Email security Review domain authentication and mailbox controls, then plan changes without disrupting legitimate business email. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=Email%20security) [See a working example](https://aegentra.co.uk/services/harden/email-security#working-example) Which services are allowed to send as your domain? Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - Scope, complexity and existing evidence - Required specialist work and access arrangements - Depth of reporting and any separately agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=Email%20security) The requirement in context ## Define the requirement before selecting the work. Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement. Primary references [Microsoft: how email authentication works](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about) Inside the work ## Which services are allowed to send as your domain? Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation. | Work area | Decision to make | Evidence to retain | | --- | --- | --- | | Senders | Identify all legitimate services and sending domains. | Owners, authentication configuration and sample headers where safely available. | | Policy | Assess alignment and the impact of stronger enforcement. | Evidence of legitimate streams and rollout decisions. | | Operation | Agree changes, monitoring and response ownership. | Test results, reporting destination and rollback record. | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/harden-email-security-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Review domain authentication and mailbox controls, then plan changes without disrupting legitimate business email. - Authorised sender and domain inventory - SPF, DKIM and DMARC observations - Agreed mailbox and impersonation-control review - Prioritised change, monitoring and rollback plan ### Separate responsibilities DNS changes, mailbox remediation and ongoing monitoring require explicit scope and authorisation. Authentication does not guarantee inbox placement or prevent every phishing message. How the work moves forward ## Assess first. Change with control. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. - ### Confirm the boundary Agree systems, permissions, dependencies and exclusions. - ### Assess the evidence Record observed settings and prioritise the agreed risks. - ### Control the change Approve remediation, test the result and keep a handover record. A practical starting point ## Which services are allowed to send as your domain? Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement. Fictional working exampleSenders — Identify all legitimate services and sending domains. — Owners, authentication configuration and sample headers where safely available. Policy — Assess alignment and the impact of stronger enforcement. — Evidence of legitimate streams and rollout decisions. Operation — Agree changes, monitoring and response ownership. — Test results, reporting destination and rollback record. Before you commission the work ## Your questions. Clear answers. **Which services are allowed to send as your domain?** Map Microsoft 365, marketing systems, invoices and application senders before changing authentication policy. Validate legitimate mail flows and evidence before tightening enforcement. **What is included in the engagement?** Authorised sender and domain inventory; SPF, DKIM and DMARC observations; Agreed mailbox and impersonation-control review; Prioritised change, monitoring and rollback plan. The proposal defines the exact outputs and acceptance criteria. **What is not automatically included?** DNS changes, mailbox remediation and ongoing monitoring require explicit scope and authorisation. Authentication does not guarantee inbox placement or prevent every phishing message. **What does the service cost?** UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables. **How should we share evidence?** Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form. **Will SPF, DKIM and DMARC guarantee inbox delivery?** No. Authentication helps recipients evaluate sending identity, but delivery also depends on reputation, content and recipient systems. Inventory legitimate senders, test alignment and review reports before tightening enforcement so authorised services are not disrupted. **Does the assessment include mailbox compromise protection?** Domain authentication and mailbox protection are different areas. Agree whether the scope includes access controls, legacy authentication, suspicious forwarding, administrative roles, alerts and incident procedures as well as DNS records. A DMARC record alone does not secure a mailbox. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [Microsoft 365 security assessment](https://aegentra.co.uk/services/harden/microsoft-365-security-assessment) [On-demand IT support](https://aegentra.co.uk/services/on-demand-it) ### Clarify your requirement [Read the decision guide](https://aegentra.co.uk/knowledge/course-or-consultancy) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)