Email Security and Filtering in Central Texas
Email security means proving your own mail is genuine and stopping fraudulent mail before it reaches your staff. Most attacks on a small organization arrive this way: a fake invoice, a look-alike sender, a "new bank details" request or a link that turns bad after delivery. Engineer Austin sets up the records that prove your mail is genuine, tunes the protection your mail host already includes, adds a dedicated filtering layer when that is not enough, and finds out why your own mail lands in junk.
Prove your own mail, filter everyone else's
- SPF, DKIM and DMARC, moved to enforcement. These DNS records prove that mail sent as your domain is genuine. Every service that sends as your domain is found and authenticated, then DMARC moves in stages from report-only to quarantine to reject, guided by the reports mailbox providers send back. Done in that order, legitimate mail keeps flowing while impostors are turned away.
- Built-in protection, tuned first. Microsoft 365 and Google Workspace both include anti-spam, anti-malware and anti-phishing controls. We configure them properly before recommending anything else, including Microsoft Defender anti-phishing and safe links where your licenses include them.
- A dedicated filtering layer when it is needed. For organizations that need more, a filtering service sits in front of your mailboxes and checks every message for spam, malware and impersonation, opens risky attachments in an isolated sandbox before delivery, and rewrites links so they are checked again at the moment someone clicks.
- Quarantine your staff can use. Suspect mail is held, not lost. Staff receive a short digest and can release a legitimate message or report a bad one in a click or two, and anything they are unsure about comes to us.
- Impersonation and look-alike domains. Protection for your executives, your finance staff and your own domain name, so a message from a domain one letter off, or from a free account using your manager's name, is flagged or held.
- External-sender banners. A plain notice on mail from outside the organization, so a message claiming to be from a coworker that came from the internet stands out.
- Encryption for sensitive mail. A simple way to send protected messages for patient, client or personnel information, with guidance on when to use it. For HIPAA-covered practices we explain the options and the trade-offs; your compliance decisions stay yours.
- Mail-flow troubleshooting. Why a customer's mail lands in junk, why replies never arrive, and why the contact form on your website stops delivering, traced through message headers and DNS to the actual cause.
- Deliverability check for your outbound mail. Your domain's records, your newsletter and billing platforms, and your sending reputation checked against the current requirements of Gmail, Yahoo and Outlook.com.
- Payment-change verification. Filtering catches many fraud attempts, but a process catches what gets past it: a written rule that any change to bank details is confirmed by calling a number you already have, never one in the email. We help you write it and train your staff to follow it.
Works with Microsoft 365, Google Workspace and most other mail hosts. Typical uses: a finance office that received a convincing fake invoice, a medical practice sending patient information, a city or district whose notices land in residents' junk folders, a business whose website form quietly stopped working, and anyone moving DMARC to enforcement for the first time.
Your domain stays yours
Your domain, your DNS and your mailboxes belong to you, and every record we publish is documented so another provider could pick it up. Our filtering configurations and rule sets are our intellectual property, licensed for your use while you are a client.
Start with the problem you have today
You do not need to be a managed client, and your mail does not need to be hosted by us. We take on single email projects for any mail host, quoted as a fixed fee or billed time and materials, whichever works best for you, with a written summary you keep. IT providers can also bring us in for a DMARC rollout or a difficult mail-flow problem at their own client.
Email security review
Your current protection, records, banners, quarantine and sending services reviewed, with numbered findings and a fix list ranked by impact.
DMARC rollout
Every sender found and authenticated, then the policy moved to enforcement in stages, with the reports reviewed at each step before the next.
Deliverability check
Why your own mail goes to junk, checked against the current sender requirements of the large mailbox providers, with the fixes in writing.
Mail-flow troubleshooting
Missing replies, bounced messages and website contact forms that never arrive, traced to the cause and fixed.
Dedicated filtering layer
A filtering service placed in front of your mailboxes, tuned to your organization, with a quarantine your staff can manage.
Encrypted mail setup
Protected sending for sensitive information, configured on your existing mail host where it is included, with short instructions for staff.
Inventory, authenticate, filter, verify
Inventory every sender
We list every system that sends mail as your domain: your mail host, website forms, billing, newsletters, copiers and line-of-business software. Many delivery problems start with one that nobody remembered.
Authenticate and enforce
SPF and DKIM are set for each sender, DMARC starts in report-only mode, and the reports show what is passing and what is not. The policy tightens only when the reports show your legitimate mail is ready.
Filter and protect
Built-in protection is tuned first, then a dedicated filtering layer is added where it is needed, with impersonation rules, external-sender banners and a quarantine your staff understand.
Verify and document
We send test messages in both directions, confirm that mail arrives and that bad mail is held, and record every DNS record and setting so you know exactly what is in place.
Email protection you can see and explain
- A sender inventory: every service allowed to send as your domain.
- SPF, DKIM and DMARC records as published, with the DMARC policy stage and the date of each change.
- A DMARC report summary showing what passes, what fails and why.
- Filtering and quarantine settings, and a one-page guide for staff on releasing and reporting mail.
- A written payment-change verification rule, ready to adopt.
- Numbered findings ranked by impact, with a recommendation for each.
How AI speeds this up for you
DMARC reports arrive as machine-readable files from many mailbox providers. We sort and summarize them with AI assistance in our approval-gated tooling, and draft the findings the same way, so you get a clear answer sooner. A person checks every finding and every DNS change before it is made, and no client message content or secret is ever pasted into a public AI tool. How we use AI.
Kept current. Email rules keep changing: Gmail and Yahoo began requiring authentication from bulk senders in 2024, with one-click unsubscribe for marketing mail, and Outlook.com followed for high-volume senders in 2025. Attackers now hide links in QR codes and in documents hosted on trusted services, and standards such as MTA-STS, TLS reporting and BIMI keep maturing. We review these changes each year and tell you at your review when one affects your mail.
Changed in stages, checked at every step
A DMARC policy set to reject on day one can block your own invoices; a filter tuned too loosely lets fraud through. We treat email like any other system we design: the current state is measured, each change is made in stages and checked against the evidence, and every record is documented. The work is done on engineering principles under a licensed engineering firm. Engineer Austin is Texas Registered Engineering Firm F‑15739; our team does the work to house standards set by our licensed Professional Engineer.
Who this is for
Offices, medical and dental practices, accounting and legal firms, cities, counties and special districts, schools, churches and nonprofits, and any business that sends invoices or takes payments by email. Email work is often scoped with our Microsoft 365, cybersecurity and managed IT services, with staff training on fraud and phishing, and with website hosting and management so website forms deliver.
Email security, answered plainly
Isn't the protection in Microsoft 365 or Google Workspace enough?
For many small organizations, configured properly, it is a good start, and we tune it before recommending anything else. A dedicated filtering layer makes sense when targeted phishing or fraud keeps getting through, when you handle sensitive information, or when you want a quarantine and reporting process that is simpler for staff. We tell you which case you are in and why.
What are SPF, DKIM and DMARC, in plain terms?
SPF lists the servers allowed to send mail for your domain. DKIM adds a signature that proves a message was not altered. DMARC tells receiving mail systems what to do when a message claims to be from you but fails those checks, and sends you reports about it. Together they make it much harder for someone to send mail that looks like it came from your domain, and the large mailbox providers now expect them from anyone sending in volume.
Will moving DMARC to reject block our own mail?
Not if it is done in stages. DMARC starts in report-only mode, and the reports show every service sending as your domain. We authenticate each legitimate sender, then move to quarantine and finally reject only when the reports show your own mail passing. If a new service appears later, the reports show it before it becomes a problem.
Why does our mail go to junk, and why does our website form stop working?
Usually because a sending service is not authenticated, a record is out of date, or a website form is sending as your domain from a server that is not allowed to. Gmail, Yahoo and Outlook.com have all tightened their sender requirements, so setups that worked a few years ago can now fail. We trace the message to the cause and fix the records or the form so mail is delivered again.
Can filtering stop payment-change fraud?
It stops much of it, but not all. A fraudulent request sometimes comes from a real vendor's mailbox that has been taken over, so it passes every technical check. That is why we pair filtering with a simple process rule: any change to bank or payment details is confirmed by calling a number you already have on file, never one in the email. We help you write the rule and train staff to use it.
Do you need to host our email to do this?
No. We work with Microsoft 365, Google Workspace and most other mail hosts, and you keep your domain, DNS and mailboxes. A review, DMARC rollout or mail-flow fix can be a single project. If we add a filtering layer, it sits in front of your existing mailboxes and is managed by us while you are a client.
Start with a written assessment.
Tell us what you have and what is not working. Someone from our team, not a salesperson, replies within one business day by email or phone, and brings in our engineer when your request needs one. The assessment report is yours to keep whether or not you buy anything.