We lock down your identity
SPF, DKIM and DMARC configured and moved to enforcement with alignment, so spoofing of your domain is stopped.
Email Security
Email Security That Protects Your Business Identity
Email is the number-one way small businesses get attacked, and most setups are configured for convenience, not defence. We harden your email end-to-end against spoofing, phishing and business email compromise — then keep it defended — so your domain becomes a hard target and you stop lying awake about a breach.
- SPF, DKIM, DMARC at enforcement
- MFA and access hardened
- Spoofing of your domain stopped
- Honest risk reduction, no false promises
Why this matters
Most email is configured for convenience, not defence.
Attackers go after email because it works — and a setup that has never been hardened is wide open in ways the business cannot see. Business email compromise (BEC), where a criminal impersonates a trusted sender to redirect a payment, is the most expensive of all.
-
Your domain can be spoofed
Without SPF, DKIM and DMARC at enforcement, anyone can send mail that looks like it came from you.
-
Phishing and BEC get through
Impersonation and payment-redirection fraud target your staff and your clients — the most expensive class of incident.
-
Accounts get taken over
Without MFA, a single stolen password hands an attacker your mailbox, your contacts and your trust.
-
Legacy doors stay open
Old authentication protocols, hidden forwarders and over-broad permissions quietly bypass your defences.
-
Security quietly lapses
Controls drift out of enforcement over time, so a setup that was fine last year is exposed today.
-
You cannot prove you are safe
Clients and insurers ask "are you secure?" and you have no evidence of the controls you actually have.
We name the real risks plainly, then bring authentication, access and mailbox security to enforcement — making your email a hard target and giving you a documented posture you can show a client or insurer.
The Mailoza approach
A hardened email environment, defended honestly.
Email Security is end-to-end hardening against the attacks that actually hit small businesses — then, optionally, keeping it defended as a managed service. We promise dramatically reduced risk, never the impossible "100% secure".
We enforce strong access
MFA enforced as the highest-impact control, with conditional access where the platform supports it, rolled out with care for users.
We close the legacy doors
Legacy authentication disabled, malicious or abandoned forwarders and rules removed, and least-privilege access applied.
We defend against phishing
Anti-impersonation, filtering and attachment/link protection against current threats — including AI-generated phishing and BEC.
We secure transport
TLS enforced for mail in transit, with MTA-STS and TLS-RPT to require and report on secure delivery, and certificate validity watched.
We document and stay honest
A plain-English posture report stating the controls in place and the residual risk truthfully — never a "100% secure" claim.
What's included
The full hardening layer, done correctly.
A security engagement covers the controls that turn an open setup into a hard target. Scope is set from a security baseline so the work fits your platform and your risk.
-
SPF, DKIM & DMARC at enforcement
Every legitimate sender authorised and nothing else, per-sender DKIM signing, and DMARC staged safely to enforcement with alignment and aggregate-report monitoring.
Outcome Spoofing is blocked and your legitimate mail keeps landing.
-
Email-DNS review
A review of the full email-DNS layer — MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI readiness — where most authentication weaknesses live.
Outcome The foundation under your security is correct, not guessed.
-
MFA & conditional access
Multi-factor authentication enforced as the baseline against account takeover, with conditional access (location, device, risk) where the platform supports it, rolled out with attention to user experience.
Outcome A stolen password alone no longer opens your mailbox.
-
Mailbox security hardening
Malicious and abandoned forwarders and rules removed, delegation and permissions reviewed, legacy authentication disabled, and least-privilege access applied.
Outcome The quiet bypasses around your defences are closed.
-
Secure transport (TLS)
TLS enforced for mail in transit, MTA-STS and TLS-RPT deployed to require and report on secure transport, and certificate validity monitored.
Outcome Mail moves over encrypted, verified connections.
-
Spoof & phishing protection
Anti-impersonation controls against look-alike and display-name spoofing, plus filtering and attachment/link protection built for current threats.
Outcome Impersonation and phishing become far harder to land.
-
Audit logging & posture report
Audit logging enabled and reviewed, with a security-posture report documenting the controls in place and the residual risk, stated honestly.
Outcome You can prove your security to clients and insurers.
-
Prioritised recommendations
A plain-English roadmap of what is done, what is outstanding, what you must own, and what ongoing managed security would cover.
Outcome You always know your next, highest-value step.
Every platform you run
Hardened across cloud and self-hosted email.
We secure your email wherever it lives, applying the controls each platform supports to one business-grade standard.
-
Microsoft 365
-
Google Workspace
-
Mailcow
-
Stalwart
-
Linux Mail Servers
-
Postfix
How we deliver
A measured path to a hardened environment.
We harden email in a disciplined order, staging changes so legitimate mail is never broken and users are never blindsided.
-
Security baseline
We assess your current posture — authentication, access, mailbox rules, transport and DNS — so we know exactly what is exposed.
-
Authentication first
We get SPF, DKIM and DMARC correct and aligned, then stage DMARC to enforcement safely so spoofing stops without breaking real mail.
-
Access & mailbox hardening
We enforce MFA and conditional access, disable legacy authentication, and clean up forwarders, rules and permissions.
-
Transport & anti-phishing
We enforce TLS with MTA-STS and TLS-RPT, and apply anti-impersonation, filtering and link protection against current threats.
-
Document & report
We enable audit logging and deliver a plain-English posture report stating the controls in place and the residual risk honestly.
-
Recommend & maintain
We hand over a prioritised roadmap, and — as managed security — keep your defences enforced instead of letting them lapse.
What you receive
A hardened environment and the proof of it.
Security work leaves you with both a defended setup and the documentation to demonstrate it to anyone who asks.
- SPF, DKIM and DMARC implemented and moved to enforcement with alignment
- DMARC aggregate-report monitoring in place
- MFA and conditional access enforced
- Legacy authentication disabled and mailbox rules and forwarders reviewed
- TLS enforced with MTA-STS and TLS-RPT deployed
- Anti-spoofing and anti-impersonation controls applied
- Audit logging enabled and reviewed
- A plain-English security-posture report with residual risk stated honestly
- A prioritised recommendations roadmap
- A brief post-hardening support window (ongoing cover with managed security)
Priced on outcome and expertise — never per mailbox. A clear project cost, framed against the cost of a single BEC incident or breach, with fair terms.
Is this the right service?
When Email Security is the right call.
Security hardening fits when email carries real risk of impersonation, phishing or account takeover. Here is how to tell.
Start here when…
- You have had a near-miss, a scare or a phishing incident
- A bigger client or partner is demanding evidence that your email is secure
- An insurer or audit requires MFA, DMARC or documented controls
- You handle payments, client funds, privileged or patient data
- Your domain has been spoofed or impersonated
- You want every managed plan to sit on a hardened foundation
A different service fits better when…
- Your real symptom is mail landing in spam, not a security threat — start with Email Deliverability (the two overlap, so an audit can disambiguate)
- An account is actively compromised or fraud is in progress right now — start with Emergency Email Support
- You are moving platform — fold hardening into Email Migration, which secures the destination
- The threat is ongoing and needs continuous defence — choose managed security rather than a one-off
Questions
Answers, in plain English.
Can you stop people spoofing our domain?
Yes — that is the core of this work. We configure SPF, DKIM and DMARC correctly and move DMARC to enforcement with alignment, which stops mail that pretends to come from your domain, and we add anti-impersonation controls for look-alike and display-name spoofing.
What is DMARC, in plain English?
DMARC is the policy that tells receiving mail systems what to do with messages that fail the checks proving an email genuinely came from you. Moved to enforcement, it instructs them to quarantine or reject impersonations — so spoofed mail in your name stops being delivered.
Will turning on enforcement break our real email?
Not when it is staged properly. We authorise every legitimate sender first — including third-party tools — and verify alignment with aggregate-report monitoring before moving DMARC to enforcement, so genuine mail keeps flowing while impersonations are blocked.
Do you guarantee we will never be breached?
No, and we will never claim "100% secure" — anyone who does is not being honest. What we promise is a hard target: specific, enforced controls that dramatically reduce your risk, with the residual risk stated plainly in your posture report.
Is MFA really necessary? Our staff find it annoying.
MFA is the single highest-impact control against account takeover, so it is a baseline of any hardening. We roll it out with attention to user experience and exception handling, so it protects accounts without becoming a daily obstacle.
What is business email compromise (BEC)?
BEC is when an attacker impersonates a trusted sender — a director, a supplier, a colleague — to trick someone into redirecting a payment or sharing sensitive data. It is the most expensive class of email incident, and our anti-spoofing and anti-impersonation controls are built to defend against it.
Which platforms can you secure?
Microsoft 365, Google Workspace, and self-hosted mail (Mailcow, Stalwart, Linux/Postfix). We apply the controls each platform supports to one business-grade standard.
Can you prove our security to a client or insurer?
Yes. You receive a plain-English security-posture report documenting the controls in place and the residual risk honestly — the evidence to answer "are you secure?" without overstating.
How is email security priced?
On outcome and expertise, as a clear project cost — never per mailbox. The cost is framed against the cost of a single BEC incident or breach, with fair terms.
Do we need ongoing security management, or is hardening enough?
A one-off hardening fixes today, but controls drift out of enforcement over time. Managed security keeps MFA enforced, DMARC at enforcement and access clean — so your defences stay up instead of quietly lapsing. We also coordinate with your existing IT provider and never replace or bad-mouth them; we simply own the email security layer.