Founder of SealedMail and a UK email-security specialist in DMARC, SPF, DKIM and email authentication for regulated sectors. He personally reads the DMARC and TLS reports behind every SealedMail account and writes the company's plain-English guides.
Explainer
The .com you bought defensively, the old trading name, the hyphenated variant - every domain you own but never send from can be spoofed as freely as your main one. Securing each takes three DNS records and five minutes. Most businesses haven’t done it.
Explainer
p=reject is where DMARC actually protects you - and the journey there is where most organisations stall, sometimes for years. Here is the staged route, what your aggregate reports should show before each move, and the blockers to expect.
Explainer
“Check your junk folder” is not a business strategy. When legitimate email lands in spam, there is always a reason - and most of them are diagnosable from your domain’s public records. Here are the six causes, in order of likelihood.
Explainer
Small business email security advice usually comes in two flavours: terrifying or expensive. This is neither - a plain priority list of what genuinely matters, what order to do it in, and what you can safely leave for later.
Sector guide
A charity's name opens inboxes and wallets - which is exactly why criminals borrow it. With the Charity Commission opening 603 fraud cases in a single year, here is a practical, low-cost approach to protecting your charity's email identity.
Sector guide
An email from your accountancy practice gets acted on - that trust is exactly what criminals exploit in payroll diversion and fake-invoice fraud. Here is what DMARC protects against for an accounting firm, what it cannot do, and where ICAEW and ACCA guidance fits.
Sector guide
Email fraud against law firm clients is not a hypothetical - the SRA has documented millions in client losses, most of it "Friday afternoon fraud". Here is what DMARC genuinely protects against, what it does not, and what the SRA's guidance actually says.
Explainer
Somewhere on your next cyber insurance proposal is a question about email authentication. Here is why underwriters ask, what DMARC, SPF and DKIM signal about your risk, and how to turn a vague tick-box into documented evidence at renewal.
Explainer
Business email compromise needs no malware and no hacking - only an email convincing enough to move money. Here is how BEC actually works, the three distinct techniques behind it, and an honest account of which one DMARC stops.
Explainer
Thousands of UK domains have a DMARC record set to p=none - and their owners believe they are protected. They are not. Here is what p=none really does, why it exists, and how to progress safely to a policy that blocks spoofed email.
Sector guide
The FCA does not mandate DMARC - and copy that claims otherwise should make you trust the vendor less. Here is the accurate picture: where email impersonation sits under SYSC, Consumer Duty and SM&CR, and how monitored DMARC serves as evidence of reasonable steps.
Sector guide
If your organisation handles NHS patient data, the Data Security and Protection Toolkit already expects you to take email security seriously - and DMARC is part of that picture. A plain-English guide for practice managers, with no technical background assumed.
We use privacy-friendly, self-hosted analytics, a sampled, masked session-replay tool, and Google Analytics to find usability problems and understand site traffic. These load only if you accept, and you can withdraw at any time via Cookie settings. See our Privacy Policy and Cookie Policy.