What is going on
The From line is not checked unless you ask for it.
Email was built so that any server can put any address in the From line. Receivers only reject forgeries when the domain owner publishes a rule saying what counts as real. Most small-business domains have never published one.
Gmail, Yahoo and Microsoft now hold every sender to that rule. A domain without it gets forged in its customers' inboxes, and its own legitimate mail is treated as a stranger's.
Roughly a third of the small-business domains we check have the gap. The fix is three DNS records, set carefully and switched on in stages.
What we do
Set up, proven on your own mail, switched on. You answer two questions.
- We read your domain
Public DNS only. We see your mailbox host and whatever is already published, and tell you what a receiving server can and cannot verify about you today.
Us - You answer two plain questions
Which systems send email as your company (your mailbox, maybe invoicing, a newsletter tool, a website form) and where your domain's DNS is managed.
You, one reply - We write the records
Exact values, with the field names your DNS host uses. You paste them in, or give us a scoped Cloudflare token and we apply them with a full backup of the zone first.
Us, then you, five minutes - You send one test email per system
We check the real headers the receiving server wrote, and tell you which systems pass and what to change for any that do not.
You, one email each - We switch enforcement on in stages
First monitoring, then quarantine, then reject, each after two clean weeks of reports. You get a short note every week. Nothing legitimate is switched off without you seeing it in a report first.
Us, about six weeks - You sign off on the final stage
Reject only goes on when you say so, in writing. After that, forged mail in your name is refused before anyone sees it.
You
What it costs
One price. No software, no subscription, no access to your mailbox.
- Every sending system identified and verified with a real message
- The three records written for your DNS host, applied for you on Cloudflare
- Enforcement switched on in stages over about six weeks, with a weekly note
- Reports from Google, Microsoft and Yahoo read for you, so you never open an XML file
- A written status page for your order, and a plain summary when it is done
Check us first
We run our own domains this way.
Look up mailsigned.com in any DMARC checker. The policy is reject, the SPF record ends in a hard fail, and the DKIM key is published. Our email to you will pass every check we are asking you to pass.
Questions
Asked before ordering.
Will this block any of our real email?
Not if we do the job properly, and the staged rollout is how we make sure. Every system you tell us about sends a test message that we verify from the receiving server's own headers. Enforcement only moves forward after two weeks of reports show nothing legitimate failing, and the final stage waits for your written go-ahead.
What access do you need?
None to your mailbox. We need DNS records added at your domain's host. You can paste them yourself from the exact values we send, or on Cloudflare you can give us a token limited to DNS edits on that one zone, which you can revoke the moment we are done.
How long does it take?
The records are usually in place the same day you reply. The protective setting is switched on in stages so nothing of yours gets caught, which takes about six weeks from start to reject.
We use Google Workspace or Microsoft 365. Is this not already handled?
Both can sign your mail, but neither publishes the rule that tells other servers to refuse forgeries, and signing is often not switched on. We check the current state of your domain and tell you exactly what is and is not in place before you pay anything.
What is actually being set up?
Three public DNS records. SPF lists the servers allowed to send for your domain. DKIM is a signature your mail server adds so the receiver can confirm the message was not altered and came from you. DMARC is the rule that tells receivers what to do when a message fails both, and where to send the reports. The records are the easy part. Knowing every system that sends as you, and proving each one passes before you enforce, is the work.
Who is behind this?
MailSigned is run by Ryan, who operates a portfolio of small online businesses with their domains at reject. The service came out of setting this up for our own domains and seeing how many customers and suppliers had never done it.