Your Email Protection Scorecard appears here
Type your domain in the field above and click Check. The read is instant, no sign-up.
Fix plan
Get the exact records to close the door
The scorecard above is the diagnosis. We send the full report to your email: the list of all your domain's current records, the exact records still missing, and what each gap leaves open. A document to forward to whoever handles this in your company.
What is at stake
The scam that poses as the boss and approves a payment
Finance receives an email “From: the director's name”, from an address that looks like the company's, asking: “wire this now, I closed with the supplier, I'll explain later”. The tone is the boss's, the urgency is real, and the destination account is new. The employee has no way of knowing the message was born on another server, on the other side of the world, because the domain does not block spoofing. The payment goes out. By the time the fraud surfaces, the money has already passed through three accounts.
It is the most expensive email-based fraud a company faces, and it starts in a sender field that nobody closed.
In 2024 alone, business email compromise caused about $2.8 billion in reported losses, and phishing and email spoofing together were the most reported cybercrime of the year (FBI, Internet Crime Report 2024). This is not an abstract risk: it is the scam that moves the most money out of companies today.
The trap
“I use Microsoft 365, so I'm protected”
It is the sentence that leaves the door open. Microsoft 365's protection looks after your inbox. Spoofing happens at your domain's authentication, and the scam lands in your clients' inboxes, with your name in the sender field.
“Microsoft already filters what reaches me.”
It does. But spoofing is not about what you receive, it is about what others send using your name to deceive your clients and suppliers. That email never passes through your inbox.
“I have antivirus and a spam filter, I'm covered.”
They look at suspicious attachments and links. None of that stops another server from writing your domain in the “From:” field. Only domain authentication (SPF, DKIM and DMARC) does.
“My company is small, no one will imitate me.”
The attacker does not pick by size, it picks by the open door. An unprotected domain is an automatic target, because it is cheap and it works. The name it borrows for the scam is yours.
Microsoft 365 is, in fact, a favorite target precisely because of the sheer number of companies that trust it. The missing layer is not inside it: it is in your domain's records.
The three keys
What closes the door to spoofing
Three records in your domain's DNS, working together, decide whether a scammer can send email in your name. This is exactly what the test above reads.
The list of who may send for you
SPF is the official list of servers authorized to send email on behalf of your domain. The receiver checks the message's origin against that list.
In practice: the list must end in a hard refusal of the unauthorized, otherwise many filters ignore the failure and let it through.
The seal that proves the email is yours
DKIM signs each message with an invisible seal, verified against a key published on your domain. It confirms the content truly came from you and was not tampered with.
In practice: it uses a selector and a public key in DNS. Without it, there is no way to prove the message is authentic.
The rule that orders rejection, and warns you
DMARC is the decisive key: it tells the world what to do when an email fails SPF and DKIM, and it delivers the report of who has been trying to spoof you.
In practice: the policy must reach reject. It is by far the most effective way to stop the boss-impersonation scam at the domain level.
The answer
Managed email security: the door closed, and kept closed
Authentication that closes and stays closed
We set up SPF, DKIM and DMARC up to the reject policy, and we read for you the reports of who tries to spoof you. The door stays closed, and each new attempt becomes an alert, not a surprise on the statement.
Filtering and 24-hour continuity
A layer that blocks phishing before the inbox, with accuracy close to 100% (vendor figure), and keeps your email up even when the server goes down. You keep working, with everything logged and recoverable, including email deleted from Microsoft 365.
What's included in Managed Email Security
- Your domain's authentication set up and kept at reject, with the reports of who tries to pass as you read for you.
- Anti-phishing filtering at the gateway, blocking the threat before the inbox.
- 24-hour continuity: your email up even when the provider's server goes down.
- Archiving that recovers deleted email, including what vanished from Microsoft 365.
A single owner for your email chain
Instead of splitting the blame among the provider, the filter and whoever touched the DNS, Zamak owns the whole chain: authentication, filtering, continuity and the report of what tried to get through. One conversation, one predictable invoice, and a team that operates alongside yours, not in its place.
We operate with tools certified in SOC 2 Type II, ISO 27001, HIPAA and PCI-DSS, as a Microsoft Solutions Partner and members of the Addee Elite Group, with 15 years protecting companies that cannot stop. The filtering statistics cited are the platform vendor's (Virus Bulletin).
If nothing changes
The open door gives no warning before the scam
While the domain stays without the rule that rejects spoofing, any day an email “in your name” lands in a client's inbox, or your own finance team pays an invoice that looked legitimate. The direct loss comes as money that does not come back. The indirect one, more expensive, is the client deceived using your company's name.
Protection takes little time to go up and starts blocking fraud from day one. Building it now costs a configuration. Building it on the day of the scam costs the whole fraud, plus the conversation explaining why the door was open.
Defensibility: the check reads your domain's public records (fact, not opinion) and the verdict follows the technical criterion of DMARC as a rejection control. No domain is declared “100% safe”: closing the door to spoofing is what is within reach, and it is what we deliver.
Frequently asked
Email spoofing, answered plainly
Close the door
See who may be using your name, and stop it
The test shows today's snapshot. Zamak closes the door and keeps it closed: authentication, filtering and continuity for your email, with a single owner.
Talk to an email security specialist
We review your domain with you and map the path to a closed door.
Book a conversationWho in your company would fall for a scam?
Assess how your team reacts to the attacks that arrive by email, from phishing to the boss-impersonation scam.
Take the phishing testFree exposure assessment
A quick picture of where your company is most exposed, beyond email.
Start the assessmentFree check. The read uses your domain's public records and sends no email.