StreamEdgeSolutions

Cybersecurity & Digital Protection · Hardening

Email Security Setup

SPF, DKIM and DMARC published, monitored, then moved to enforcement safely

Buy now

$399USD one-off

One payment. Work starts once we have confirmed your requirements.

The four questions this page answers

  1. 1

    What you buy

    A one-off remote job that publishes the DNS records mail providers use to tell your genuine email from a forgery, then watches the reports for a month and tightens the policy once it is safe to do so.

  2. 2

    What you get

    5 deliverables, listed in full below

    • SPF, DKIM and DMARC records published and aligned for your domain
    • A written inventory of every service authorised to send as you
    • A summary of 30 days of aggregate reports, showing what was sending and whether it passed
    + 2 more
  3. 3

    How it is delivered

    Remote Setup

    Carried out remotely by our team. Nothing is posted and no one visits.

    REMOTE SERVICE

  4. 4

    How long it takes

    Records published within 2–3 business days; the enforcement step follows 30 days of monitoring

    Measured from the point everything under “what we need from you” is with us, not from the moment you pay.

Mail authentication: every message checked at SPF, DKIM and DMARC before delivery — illustrative concept, not a screenshot of a client system
Mail authentication: every message checked at SPF, DKIM and DMARC before delivery. Illustrative interface concept — not a screenshot of a client deployment.

What is this, in plain English?

A one-off remote job that publishes the DNS records mail providers use to tell your genuine email from a forgery, then watches the reports for a month and tightens the policy once it is safe to do so.

Records published in a hurry usually miss a sending service, or sit forever on a policy that blocks nothing. This engagement inventories everything that sends mail in your name, publishes aligned records, monitors the aggregate reports for 30 days to catch what the inventory missed, and only then moves to enforcement. The Cloud Setup Package publishes basic records as part of building hosting; this is the deeper version done on its own.

The problem it solves

Someone is sending invoices in your company’s name to your customers, your own newsletters land in spam, and nobody can say which systems are supposed to be sending as your domain.

If that does not describe you, this is probably the wrong product. Tell us and we will point you at a better fit rather than sell you the nearest one.

What you get

The concrete things that exist at the end and that you own.

5 deliverables

  • SPF, DKIM and DMARC records published and aligned for your domain
  • A written inventory of every service authorised to send as you
  • A summary of 30 days of aggregate reports, showing what was sending and whether it passed
  • An enforcement policy applied at the level agreed with you
  • A written DNS record sheet listing every entry, its value and why it exists

What's included

The work covered by the figure in the buy box, at no extra cost.

  • One primary domain and up to two additional sending domains
  • Sender inventory across your platforms
  • SPF, DKIM and DMARC publication
  • 30 days of aggregate report monitoring
  • Alignment correction for the services in the inventory
  • The move to enforcement and a written record sheet

Not seeing something you expected? Check what you are not buying before you order.

What does it do?

Everything listed here is delivered as part of this product. Nothing on this list is aspirational.

  • An inventory of every service sending mail as your domain, from the mail platform to the invoicing tool
  • SPF built to stay inside the ten-lookup limit rather than silently breaking past it
  • DKIM signing enabled and keys published for each sending service that supports it
  • DMARC published at monitoring policy first, then moved to quarantine or reject
  • 30 days of aggregate report monitoring, with alignment failures traced to the service causing them
  • TLS reporting configured where your provider supports it
  • A written record of every DNS entry added, with its purpose

How it works

The delivery sequence from order to handover.

  1. 1

    Inventory the senders

    We work through your mail platform, marketing tools, website, invoicing and any other system that sends in your name.

  2. 2

    Publish records

    SPF, DKIM and a monitoring-mode DMARC record are published, aligned to the senders we found.

  3. 3

    Monitor for 30 days

    Aggregate reports are collected and read. Anything sending legitimately that we missed shows up here, before it can be blocked.

  4. 4

    Fix alignment

    Services failing alignment are corrected, or deliberately excluded with your agreement.

  5. 5

    Move to enforcement

    With the reports clean, the policy is raised to quarantine or reject and the final record set is documented.

Delivery & fulfilment

Stream Edge Solutions ships nothing. Every package on this site is carried out and handed over remotely — this is exactly what happens after you order.

REMOTE SERVICEHow this is delivered
  1. 1We confirm requirementsWe read what you sent with the order, come back in writing with anything missing, and agree the scope before any chargeable work starts.
  2. 2We build and configure remotelySetup, configuration and testing are done by our team over a remote connection — on your systems or on ours, whichever the package specifies.
  3. 3We hand it overYou receive the working setup, the credentials, the documentation and a walkthrough. Everything built for you is yours at handover.

Carried out remotely by our team. Nothing is posted and no one visits. Typical turnaround: Records published within 2–3 business days; the enforcement step follows 30 days of monitoring.

Delivery method
Remote Setup
Expected delivery time
Records published within 2–3 business days; the enforcement step follows 30 days of monitoring
Measured from the point everything under “what we need from you” is with us — not from the moment you pay.

Full detail of how work is handed over, what happens if requirements are outstanding and how order records are kept is in the Delivery & Fulfilment Policy.

What we need from you

Nothing starts until these are in place, and the turnaround above is measured from that point — not from the moment you pay.

  • Access to the DNS records for the domains in scope
  • A list of every system that sends mail in your name, or authority to ask your staff for it
  • Administrator access to each sending platform so DKIM signing can be enabled
  • A named contact to receive the monitoring summary and approve the move to enforcement

Who this is for

  • Businesses whose customers have received forged invoices or payment requests
  • Companies whose legitimate mail keeps landing in junk folders
  • Organisations sending through several platforms at once
  • Anyone asked by a customer or insurer to show domain authentication is in place

Business needs this addresses: Improve IT infrastructure

What's not included

Just as plainly as the list above: the things this package is not.

  • Mailbox migration or the provision of mail hosting itself
  • Mail platform, marketing tool and DMARC reporting subscriptions, which you pay those providers directly
  • Inbound filtering, anti-phishing training and mailbox-level rules
  • Restoring the reputation of a domain already on a sending blocklist, which is separate work
  • Any guarantee that no spoofed message will ever reach a recipient; these records make forgery much harder, not impossible

Anything outside the scope above is quoted separately, in writing, before it is carried out. Nothing is added to your bill without your agreement.

FAQs

Will this stop people forging our address completely?

It stops most of it. Once enforcement is in place, receiving mail servers that honour DMARC will reject or quarantine mail that fails, which covers the large providers your customers most likely use. It cannot stop a lookalike domain registered by someone else, and a receiving server that ignores the policy will still deliver.

Could this block our own email by mistake?

That is exactly why the policy is not raised on day one. The 30 days of monitoring exist to surface the sending service nobody remembered, before it is capable of being blocked. If enforcement does cause a problem later, the policy can be lowered again in minutes.

We use a big mail provider already. Do we still need this?

Yes. Mail providers authenticate their own sending, but they do not publish a DMARC policy for your domain, and they cannot know about the invoicing tool or the website form that also sends as you. Alignment across all of those is the part that actually stops forgery, and it is the part that is usually missing.

Who pays for the reporting tool?

For a small business, free reporting is usually enough and we set that up within this price. If you want a paid dashboard with longer history, that subscription is yours and is billed to you by that provider, not by us. We will tell you honestly whether the paid option is worth it at your volume.

Refund & cancellation

What happens if you change your mind, and what happens to money already paid.

Cooling-off before work starts
You have 7 days after ordering to cancel while work has not yet begun. Up to 25% may be retained to cover scoping and scheduling already carried out.
Work already done
Once delivery has started, refunds are assessed against the work completed and the deliverables already handed over — the list under “what you get” above is what that assessment is made against. Approved refunds are processed within 14 days.
If we cannot deliver what is described here
You are refunded. The scope on this page is the scope we are held to, which is exactly why the exclusions above are stated before you buy rather than after.

The full terms, item type by item type, are in the Refund & Cancellation Policy. How the work reaches you is covered by the Delivery & Fulfilment Policy.

Not sure this is the right product?

We would rather point you at the right thing than sell you the nearest one. Ask us before you buy — no obligation.

Ask a questionRequest a custom quote

Related products

Others that solve nearby problems, in case this is not quite the right fit.

Or see all 11 in Cybersecurity & Digital Protection.

Contact us