# Email Security — geearr

> Email security consulting stops attackers from impersonating your domain and your people. geearr takes domains from “anyone can spoof us” to DMARC p=reject without breaking legitimate mail, hardens transport with MTA-STS, and builds BEC and payment-fraud controls around the humans.

**Your domain is someone’s phishing kit. Take it back.**

Email is still the number-one way into an organization — and the number-one way attackers impersonate you to your customers. George takes domains from “anyone can spoof us” to DMARC enforcement without breaking legitimate mail, then hardens the human side: phishing, business email compromise and payment-fraud workflows. He also built Fromenance, a communication-provenance platform for banks and insurers, because SPF, DKIM and DMARC alone do not prove a specific message is real.

## What gets tested

### Authentication & enforcement

- Inventory of every SaaS that sends mail as you
- SPF flattening & 10-DNS-lookup limit fixes
- DKIM 2048-bit keys, rotation & alignment
- DMARC rollout: p=none → quarantine → reject
- Parked & non-sending domain lockdown

### Transport & brand

- MTA-STS & TLS-RPT
- DNSSEC & DANE where supported
- BIMI with VMC/CMC readiness
- Lookalike & cousin-domain monitoring
- Dangling-record & subdomain-takeover checks

### Threats & people

- Phishing & BEC tabletop exercises
- Microsoft 365 / Google Workspace & gateway tuning
- Payment-change & vendor-fraud controls
- DMARC report & header forensics
- Communication provenance for customer-facing mail

## What you get

1. Domain-by-domain email authentication scorecard
2. Staged DMARC enforcement plan with report monitoring
3. DNS changes prepared (or applied) for SPF, DKIM, DMARC, MTA-STS and BIMI
4. BEC and payment-fraud control recommendations
5. Executive summary for your board, regulators or cyber insurer

## Standards

RFC 7208 (SPF) · RFC 6376 (DKIM) · RFC 7489 (DMARC) · RFC 8461 (MTA-STS) · RFC 7505 (Null MX) · Google / Yahoo / Microsoft bulk-sender rules · M3AAWG best practices

## FAQ

### What are SPF, DKIM and DMARC?

SPF lists which servers may send mail for your domain. DKIM cryptographically signs each message so receivers can verify it was not altered. DMARC ties the two to the visible From: address and tells receivers what to do when a message fails — monitor (p=none), send to spam (p=quarantine) or block (p=reject) — while sending you reports on who is mailing as you.

### Do I need DMARC set to p=reject?

If you want to stop attackers from spoofing your exact domain, yes. A DMARC policy of p=none only monitors; it does not protect anyone. Google, Yahoo and Microsoft already require DMARC for bulk senders, and p=reject is the goal for any domain your customers trust. The safe path is a staged rollout that inventories every legitimate sender first.

### Does DMARC stop phishing and business email compromise?

DMARC stops exact-domain spoofing, which is a large share of phishing — but not lookalike domains, compromised vendor accounts, or a real employee mailbox being taken over. Effective BEC defense combines DMARC enforcement, lookalike-domain monitoring, mailbox hardening, and out-of-band verification for payment and banking changes.

## Related

- Guide: [How to get DMARC to p=reject without breaking email](https://geearr.com/guides/dmarc-p-reject-rollout)
- Glossary: [SPF](https://geearr.com/glossary#spf)
- Glossary: [DKIM](https://geearr.com/glossary#dkim)
- Glossary: [DMARC](https://geearr.com/glossary#dmarc)
- Glossary: [BIMI](https://geearr.com/glossary#bimi)
- Glossary: [MTA-STS](https://geearr.com/glossary#mta-sts)
- Glossary: [Email spoofing](https://geearr.com/glossary#email-spoofing)
- Glossary: [BEC](https://geearr.com/glossary#bec)
- Glossary: [Phishing](https://geearr.com/glossary#phishing)

## Contact

- Email: george@georgerios.com
- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- LinkedIn: https://linkedin.georgerios.com
- X: https://x.com/riosgeorge

---
Canonical: https://geearr.com/services/email-security · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt