Plain-English guides to email security, DMARC, and protecting your domain - no jargon, no filler.
Explainer
Somewhere on your next cyber insurance proposal is a question about email authentication. Here is why underwriters ask, what DMARC, SPF and DKIM signal about your risk, and how to turn a vague tick-box into documented evidence at renewal.
Explainer
Small business email security advice usually comes in two flavours: terrifying or expensive. This is neither - a plain priority list of what genuinely matters, what order to do it in, and what you can safely leave for later.
Explainer
Receiving a scam email “from your own address” feels like a breach. Usually nothing was hacked - email’s 1980s design simply lets anyone write any sender address. Here is how spoofing works, what each side sees, and the one control that ends it.
Explainer
p=reject is where DMARC actually protects you - and the journey there is where most organisations stall, sometimes for years. Here is the staged route, what your aggregate reports should show before each move, and the blockers to expect.
Explainer
“Check your junk folder” is not a business strategy. When legitimate email lands in spam, there is always a reason - and most of them are diagnosable from your domain’s public records. Here are the six causes, in order of likelihood.
Explainer
BIMI displays your verified logo next to your emails in Gmail, Apple Mail and Yahoo. It is real, it works - and for most small UK businesses the costs outweigh the benefit. Here is the complete, honest picture, including what the certificates cost.
Explainer
Your mail servers support encryption - but do the servers sending to you actually achieve it? TLS-RPT is the standard that tells you, in a daily report. Here is what those reports contain, and what an anomaly looks like.
Explainer
Most email travels encrypted - but only politely, and a criminal in the middle can ask both servers to drop the encryption. MTA-STS removes that option. Here is how it works, why the NCSC recommends it, and why starting in testing mode matters.
Sector guide
A charity's name opens inboxes and wallets - which is exactly why criminals borrow it. With the Charity Commission opening 603 fraud cases in a single year, here is a practical, low-cost approach to protecting your charity's email identity.
Explainer
Business email compromise needs no malware and no hacking - only an email convincing enough to move money. Here is how BEC actually works, the three distinct techniques behind it, and an honest account of which one DMARC stops.
Sector guide
The FCA does not mandate DMARC - and copy that claims otherwise should make you trust the vendor less. Here is the accurate picture: where email impersonation sits under SYSC, Consumer Duty and SM&CR, and how monitored DMARC serves as evidence of reasonable steps.
Explainer
Add a reporting address to your DMARC record and the world's mail providers start sending you XML files daily. Here is what every field in those files actually means, why the raw format is unreadable at any scale, and what a useful translation looks like.
We use privacy-friendly, self-hosted analytics and a sampled, masked session-replay tool to find usability problems. Nothing is shared with third parties, and these load only if you accept. See our Privacy Policy.