Stop criminals sending email that looks like it came from your business.
Right now, anyone can put your email address in the "from" line and send a fake invoice to your customers. Three small settings on your domain, called SPF, DKIM and DMARC, let inboxes spot the fake and bin it. We set them up for you, properly, for a fixed £59.
Check your domain free Ask a question
UK based. No subscription. No website needed from us. If your domain is already set up correctly, we will tell you and there is nothing to pay.
The problem
Email was never built to check who really sent a message. A fraudster does not need to hack you: they simply type your address and send a "new bank details" invoice. Phishing was reported by 35% of UK micro businesses in the government's Cyber Security Breaches Survey 2025.
The fix
Three public records on your domain tell every inbox in the world which systems are allowed to send as you, and what to do with anything that is not. It also helps your genuine email land in the inbox instead of junk.
Who it is for
Small UK businesses using their own domain for email (for example you@yourbusiness.co.uk) on Microsoft 365, Google Workspace or another provider.
The three records, in plain English
- SPF (the guest list): names the servers allowed to send email for your domain.
- DKIM (the tamper seal): a digital signature on your real email that a forger cannot copy.
- DMARC (the standing instruction): tells inboxes what to do when a message fails the checks, and sends you reports about who is using your name.
Having one or two of these is common, and can give a false sense of safety. All three need to work together.
One fixed price: £59
£59 one-off, no VAT charged
- A plain-English check of what your domain publishes today
- SPF, DKIM and DMARC configured for every service that genuinely sends as you (email, invoicing, newsletters, booking tools)
- DMARC started safely in monitoring mode, so none of your real email is blocked
- A follow-up after the reports come in (usually 2 to 4 weeks), to tighten DMARC to the setting that actually turns fake email away
- A before-and-after report you can keep and show to anyone who asks (insurer, client, auditor)
We confirm what your domain needs before you pay. Payment is taken securely by Stripe.
How it works
- Free check. Run the free checker or email us your domain. We reply with what is missing.
- Book. If you want us to fix it, pay the £59 fixed fee.
- Access. You add us as a user on your domain's DNS account (we will show you how), or we send you the exact records to paste in yourself. We never need your email password.
- Setup. Records are live within 2 working days and you get the "before" half of your report.
- Tighten. Once the reports show all your genuine senders pass, we switch DMARC to enforcement and send your final report.
Questions
Will this stop all spam reaching my own inbox?
No. It protects your domain from being used to fool other people. Filtering the spam you receive is a separate job your email provider does.
Could it stop my real emails getting through?
It could if it was rushed, which is why we start in monitoring mode and only tighten once the reports prove every genuine sender passes.
I use Microsoft 365 or Google Workspace. Is it not done already?
Partly. Both support DKIM, but neither sets up a full DMARC policy for you, and gaps usually appear when a second system (an invoicing or newsletter tool) sends as you.
Do you need my password?
No. We ask to be added as a user on your DNS provider, or we give you the records to paste in yourself.
What if my domain is already fine?
Then we tell you so, and there is nothing to buy.
Contact
Email hello@spoofguard.co.uk with your domain name and any questions. We reply within one working day, Monday to Friday. We work by email so everything you are told is in writing.
SpoofGuard is run by Lloyd Byatt, an IT Operations Engineer based in Biggleswade, Bedfordshire.