Engineering capabilities
- Zone audit and record cleanup
- Sending-source inventory
- Staged DMARC enforcement
- Failover and TTL strategy
Backup & Email
DNS & Mail Authentication
Authoritative DNS design with SPF, DKIM and DMARC rolled out in stages so mail stays deliverable and the domain becomes hard to spoof.
Security & hardening
- DNSSEC where the registrar supports it
- Registrar lock and access control
- MTA-STS and TLS-RPT
- DMARC aggregate report monitoring
DNS and mail authentication chain
Every legitimate sending source is enumerated before policy changes, then authentication moves to enforcement in stages so mail never silently breaks.
-
01
Registrar & zone
- Registrar lock
- Authoritative nameservers
- TTL strategy
Ownership, contacts and transfer lock verified before any record work begins.
-
02
Record hygiene
- A / AAAA / CNAME audit
- Stale record removal
- Failover records
Conflicting and orphaned records removed; TTLs lowered ahead of planned cutovers.
-
03
Sending sources
- Mail tenant
- Marketing platform
- Application / CRM senders
Each source inventoried and explicitly authorised u2014 nothing sends unlisted.
-
04
Authentication
- SPF
- DKIM signing
- DMARC p=none u2192 quarantine u2192 reject
Alignment verified with real message headers at each stage before tightening.
-
05
Transport & reporting
Encrypted transport enforced and reports reviewed so new senders are caught early.
Frequently asked questions
Will enforcing DMARC break our mail?
Not when it is staged. Policy starts at p=none, aggregate reports are reviewed for a full billing and campaign cycle, unauthorised senders are fixed, and only then does enforcement move to quarantine and reject.
Is SPF on its own enough?
No. SPF breaks on forwarding and only checks the envelope sender. DKIM signing with aligned DMARC is what actually makes a domain hard to spoof.
How many DNS lookups can SPF have?
Ten. Exceeding it makes the record permerror and effectively unauthenticated, so includes are flattened or consolidated when a domain gets close.
Can you get our domain off a blacklist?
Delisting is requested once the cause u2014 a compromised account, an open relay, misconfiguration or an unauthorised sender u2014 has been identified and closed. Delisting before the fix simply repeats.
Scope the work before you commit budget
Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.