Email & Domain Trust
Fixed two businesses’ spoofable email without breaking their real mail, then turned the checks into free tools.
- For
- A healthcare professional services firm and an LPL-affiliated financial advisory
- When
- 2026
- Status
- Both remediations closed. Monitoring ongoing. Tools live.
The situation
Small businesses send email from their own domain, and most never check whether it’s protected. DMARC sits in monitor-only mode with nobody reading the reports, there are two SPF records where there should be one, DKIM was never turned on, and the newsletter tool sends from a hostname nobody set up.
At a healthcare professional services firm, a phishing email pretending to be their own admin address landed in staff inboxes. At an LPL-affiliated financial advisory, the owner’s outgoing mail was showing up at recipients flagged as possible impersonation.
What I built, and why
Every service that sends as the domain has to be found and authenticated before the policy gets strict, or the policy starts blocking the business’s own mail.
For the healthcare firm, I turned on DKIM signing in Microsoft 365 and put an inbound rule in front of the hole the same day, then authenticated the CRM and website mail and stepped DMARC from quarantining half of failing mail to full reject over about two weeks.
The advisory was fiddlier. Their broker-dealer publishes its own DNS requirements, their mail runs through a Proofpoint tier that the default SPF include gets wrong, and their marketing platform’s messages were being altered after they were signed. The main domain went to reject, as the broker-dealer requires. The marketing subdomain got its own, more lenient policy so the newsletters kept arriving.
Along the way I kept running the same checks by hand, so I built them into three free tools on this site: the Email Auth Scanner, Site Audit and EML Inspector.
Why I did it this way
Moving to reject slowly
Each step toward reject waited on a few days of clean aggregate reports. Going straight to reject is how you find out, from a customer, that the invoicing tool was never authenticated.
A separate policy for marketing mail
The advisory’s marketing mail was being modified by gateways after signing, so it would fail DMARC anywhere strict. The marketing subdomain got its own record, so the main domain could enforce fully.
Our own scanner gave a client a B, and that was right
After the advisory reached reject, our scanner graded it B: a softfail SPF rule the broker-dealer requires, plus two flags that are cosmetic for their setup. Every deduction had an explanation.
Parsing email in the browser
The EML Inspector’s basic check parses the message in your browser, so it never leaves your computer. People point it at suspicious mail from their own inbox.
What changed
Healthcare firm: the active hole closed the same day, at least 66 spoofing and fake-payment attempts caught in the first week, and the domain now at full reject. It grades A on our scanner.
Financial advisory: from an F to 96.8% DMARC-compliant at close-out, with no spoofing in the reports. We still monitor it.
The three tools have been live since May 2026. The Email Auth Scanner is the first thing we send when someone asks about their email.
Built with
- SPF
- DKIM
- DMARC
- DNS
- Microsoft 365
- Proofpoint
- PowerDMARC
- Next.js
- TypeScript
- Vercel
- Supabase
