Stop attackers sending emails that look like they came from you

Protect your domain from spoofing, fake invoices and impersonation attacks.

Sendmarc helps you see who is sending email on your behalf, fix the gaps and move towards blocking anything that shouldn’t be there.

You stay in control of your domain. Your emails stay trusted.

Managed DMARC · Email domain protection

Your customer trusts your email address.
Help stop someone else using it.

A customer receives an invoice that appears to come from you. Your email address is in the From field. The bank details belong to someone else. Criminals can attempt this kind of domain spoofing without ever logging into your mailbox.

Black Swan provides DMARC setup and ongoing monitoring for businesses, schools and charities. We identify your genuine senders, resolve authentication problems and help enforce protection against spoofing. We keep reviewing the reports after setup, so you have someone to deal with failures and changes.

Get a DMARC monitoring quote See how we help

What happens when someone sends a fake email in your name?

If a customer pays a forged invoice that appears to come from your address, you could be left dealing with an unpaid bill, a dispute and a customer who is now wary of your emails. DMARC helps receiving systems spot unauthorised use of your domain and act on it.

Make your domain harder to impersonate

Give receiving email systems a clear policy for rejecting messages that fail the checks for your domain.

Help genuine email get through

Resolve authentication problems that can cause your invoices, newsletters or school messages to be treated as suspicious.

Know what sends in your name

Build a clearer picture of the services using your domain, from staff email to your website and accounts software.

Have someone responsible for the follow-up

Black Swan reviews your DMARC reports, investigates unfamiliar senders and helps resolve authentication problems as your systems change.

“We use Microsoft 365. Aren’t we covered?”

Microsoft 365 and Google Workspace provide email authentication capabilities. Your own domain still needs the right configuration, and your mailbox platform may be only part of the picture.

Your accounts package sends invoices. Your website sends enquiries. A newsletter service sends updates. Each legitimate sending service needs to authenticate in a way that works with your domain’s DMARC policy.

If somebody added a DMARC record a few years ago, it is worth checking what has happened since. Your website, accounts software or newsletter service may have changed.

Glitch & Black Swan explain

Could Glitch send an email pretending to be your business?

Glitch wants a fake invoice to look as though it came from your email domain: the part after the @ sign. SPF, DKIM and DMARC give the receiving mail system ways to check that claim.

Glitch

Putting your name on his invoice

“Your email address. My bank details. What could possibly go wrong?”

Glitch can try to fake the From address without logging into your mailbox. He is counting on the recipient’s email system accepting his claim that the message came from your domain.

Black Swan Cyber

Your security partner

“Writing our address on it doesn’t make it ours.”

We help identify your legitimate senders, including Microsoft 365, your website and invoicing systems. We review reports, resolve authentication issues and plan a gradual move to enforcement, checking legitimate mail along the way.

SPF, DKIM and DMARC explained in plain English

SPF

Is this server allowed to send?

Sender Policy Framework checks the sending server against the authorised list for the email’s technical return-address domain. That can differ from the From address you see, so SPF alone does not verify that visible address.

DKIM

Does the digital signature check out?

DomainKeys Identified Mail lets a sending service sign email with a domain’s digital signature. The recipient checks that signature and whether the signed content has changed. It is separate from the name or logo in your email footer.

DMARC

Does the proof match the From address?

DMARC checks whether a passing SPF or DKIM result aligns with the visible From domain. At least one must pass and align. It also publishes your policy for failures and lets you request reports.

Alignment means the authenticated domain matches the From domain under your chosen rules. The default rules allow related subdomains; strict rules require an exact match.

What your DMARC policy does
A DMARC policy of p=none requests no action on failures. p=quarantine asks for suspicious treatment, usually junk; p=reject asks for rejection. Receiving systems make the final delivery decision.

These checks help protect your domain from spoofing. They do not stop someone using a similar-looking domain or a compromised genuine account, and a pass does not prove that a message or payment request is safe.

Meet Glitch and Black Swan Ask us to review your email domain

Who is checking your DMARC reports?

A checker can confirm that a record exists. It cannot take responsibility for the reports that arrive afterwards. With our managed DMARC monitoring service, Black Swan reviews sending activity, investigates failures and helps keep your authentication settings working as you add or change services.

If you have a record but no clear owner

We review the policy and reporting arrangements, then explain what is working and what needs attention.

If reports arrive but nobody acts on them

We help distinguish genuine services from suspicious sources and turn the findings into practical next steps.

If you are worried about blocking real email

We check legitimate senders before tightening the policy and monitor the results as changes are made.

If your IT provider already manages the basics

We can work alongside them on domain authentication and reporting, with clear responsibility for changes and follow-up.

Still using p=none? We can help you move to enforcement.

A policy of p=none is useful while you discover senders and fix problems. It requests no DMARC-specific action against messages that fail. With reporting configured, it gives you information to plan the next step.

Quarantine: treat failures as suspicious

A p=quarantine policy asks receiving systems to put failing messages into suspicious-mail handling, often the junk folder.

Reject: refuse failing messages

A p=reject policy asks receiving systems to reject messages that fail DMARC. This is the stronger policy we work towards once legitimate senders are ready.

Receiving systems make the final delivery decision. Our job is to help you make that move with evidence, so your real email is accounted for before protection is tightened.

What our managed DMARC service includes

1. Review your domain

Check the existing SPF, DKIM and DMARC setup, your policy and where reports go. Explain the findings in plain English.

2. Identify legitimate senders

Bring together your known services and reporting data. Include occasional senders, such as termly school updates or monthly invoices.

3. Resolve authentication gaps

Work with your IT provider and sending services to correct the configuration and alignment problems that cause genuine mail to fail.

4. Introduce enforcement

Plan and apply policy changes in stages, checking results as protection is tightened.

5. Ongoing DMARC monitoring

Continue reviewing reports after enforcement is in place. Investigate unfamiliar sources and authentication failures, and help check new sending services as part of your agreed support.

6. Explain what needs doing

Explain what we have found, which changes are needed and who will make them. You can ask us about an email problem without having to interpret the reports yourself.

We use Sendmarc for DMARC reporting and management. Black Swan handles the review and follow-up with you or your existing IT provider. Ask us for a quote covering your domains and the ongoing support you need.

Three useful questions to ask your IT provider

If you already have IT support, these are reasonable questions to ask:

Are all the services sending email from our domain correctly authenticated?
Does our DMARC policy request rejection of failing messages, or are we still monitoring?
Who reviews the reports and checks new services before they start sending?

If the answers are vague, or nobody is reviewing the reports, Black Swan can take on the DMARC monitoring. We can work alongside your existing IT provider, resolve authentication issues and help maintain an enforced policy. Ask us about managed DMARC monitoring.

Who we help

This service is particularly useful when you send important messages from your own domain, use several sending systems and want someone to take responsibility for getting authentication right.

Businesses and professional firms

Protect the domain used for invoices, appointments and customer communication.

Schools and nurseries

Protect the domain parents, staff and suppliers recognise, including email sent by third-party systems.

Charities and community organisations

Help protect the trust behind fundraising appeals, supporter updates and supplier messages.

Busy owners and small IT teams

Get specialist help with the setup and follow-through, without having to become a DMARC expert.

We support businesses, schools and charities across Chesterfield, Sheffield and the surrounding areas. We can manage your DMARC monitoring and help with incoming email protection and Microsoft 365 account security too.

Fake senders, phishing emails and stolen accounts need different checks

A spoofed invoice using your domain is one problem. A phishing email arriving in your inbox is another. A criminal signing into a real staff account needs a different response again. We offer three services to help with these risks.

Someone is pretending to send from your domain

Managed DMARC monitoring

We help authenticate your genuine senders, move to enforcement and keep reviewing reports for unfamiliar sources and failures. Black Swan manages the work using Sendmarc.

Get a DMARC monitoring quote →

A convincing attack reaches your inbox

Avanan / Check Point Email Security

Add protection against phishing, malicious attachments and links, including attacks sent from compromised genuine accounts. Help catch dangerous messages before someone acts on them.

See how Avanan protects your email →

Someone gets into a Microsoft 365 account

Huntress ITDR

Add monitoring for suspicious identity and account activity, helping detect and respond to signs of a compromised Microsoft 365 account.

See how Huntress ITDR helps →

Black Swan can supply and support these services individually or together. If you want help with all three, we can review what you already have and recommend a setup for your organisation.

Discuss email protection

Need a way to recover deleted or damaged email too? See our Microsoft 365 backup service.

Common questions about managed DMARC

We have never had a spoofing problem. Is this still useful?

Yes. Not receiving a complaint does not establish whether your domain is protected. Reviewing the configuration and available reports gives you a better basis for deciding what needs attention.

What are SPF, DKIM and DMARC in simple terms?

SPF checks whether a sending server is authorised for the technical sending domain. DKIM checks a domain’s digital signature and the integrity of signed content. DMARC connects a passing SPF or DKIM result to the visible From domain and publishes a policy for failures. The explainer above adds more detail.

Will this stop legitimate messages being delivered?

A poorly planned enforcement change can block legitimate senders that have not been configured correctly. We identify those services, resolve issues and review results as the policy changes, reducing that risk.

What does a DMARC failure mean?

Neither SPF nor DKIM provided a passing result aligned with the visible From domain. That can indicate spoofing, but it can also reveal a genuine service that needs correcting. We investigate before treating an unknown source as malicious.

Can you help with a DMARC record or Microsoft 365 setup?

Yes. We can review your DNS records, DKIM configuration, third-party senders and reports, then help you progress to enforcement. Sendmarc is the platform we use to support that work; it is not a requirement of the DMARC standard.

Will this guarantee our emails reach the inbox?

Correct authentication removes an important source of delivery problems. Inbox placement also depends on reputation, content and recipient behaviour, so no DMARC service can guarantee it.

Do small organisations need this, or only bulk senders?

Any organisation using its own email domain can benefit from protection against exact-domain spoofing. Google also requires SPF, DKIM and DMARC for bulk senders to personal Gmail accounts. Its minimum DMARC policy can be p=none; meeting that minimum is different from enforcing an anti-spoofing policy.

What about domains we own but do not use for email?

Include them in the review. A domain does not need a working mailbox for someone to try to spoof it. A non-sending domain can be configured to tell recipients that messages claiming to come from it should not be accepted.

How long does setup take, and what does it cost?

That depends on the number of domains and sending services, the current configuration and the support needed. We scope the work before quoting. The move to enforcement should allow enough time to account for legitimate sending patterns, including occasional messages.

Does a DMARC pass mean a payment request is safe?

No. It confirms domain authentication, not the honesty of the message. Continue verifying changed bank details through a trusted contact route, even when an email passes authentication.

Ask us about DMARC monitoring and email protection

Tell us your email domain, how many people use email and whether you use Microsoft 365 or Google Workspace. We can quote for managed DMARC monitoring and discuss whether Avanan email security and Huntress ITDR would also help with the threats you face.