itopsi
Pricing
About
Contact
FrançaisCall me back
Protect your domain and mailboxes

Email security and DMARC setup for Canadian businesses

Our email security services put SPF, DKIM and DMARC on your domain and move DMARC in stages to a reject policy, so a receiving server refuses mail that only pretends to come from you. We list every service that sends as your domain before the first change, so your own invoices, payroll notices and newsletters keep arriving.

Ask us to call you backBook the free audit
A business owner in his sixties on his mobile phone at a white desk, his open laptop facing him and out of view
A changed bank account on an invoice gets confirmed by phone, on a number you already had.

A person here calls you back the same business day, usually within an hour.

  • Written permission first
  • A report in plain words
  • Checked again after the fix

SPF, DKIM and DMARC in plain words

SPF, DKIM and DMARC are three short text records published in your domain's DNS. SPF lists the servers allowed to send mail for your domain, DKIM adds a signature that proves a message was not altered on the way, and DMARC tells receiving servers what to do when a message claiming your domain passes neither check.123

What is DMARC, in one sentence: it is the record that turns the other two into a rule. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the address your customer sees in the From line. Without that match, a fraudster can pass SPF on a domain of their own and still show your name.34

DMARC became a full Internet standard in May 2026, when RFC 9989 replaced the older RFC 7489. Two changes matter for an office: the old percentage setting is gone, and a new test-mode flag lets a domain publish its policy before receivers act on it.3

The three records, what each one tells a receiving server, and where it is defined
RecordWhat it tells the receiving serverDefined in
SPFWhich servers may send mail for this domain. A record is limited to 10 DNS lookups, which is where long lists of services break.5RFC 72081
DKIMThis message carries a signature made with the domain's private key, and the text was not changed after signing. CCCS recommends 2048-bit keys, rotated every year.5RFC 63762
DMARCWhat to do when SPF and DKIM both fail to match the From address: none, quarantine or reject.RFC 9989 (2026)3

Why email spoofing reaches small Canadian offices

Email spoofing works because, by design, internet mail lets anyone type any address into the From line. A domain without a DMARC reject policy gives receiving servers no instruction to refuse a forged message, so a fake invoice in your name can land in a client's inbox looking like one of yours.5

The Canadian Centre for Cyber Security lists DMARC on all of an organization's email services among its baseline controls for small and medium organizations, next to filtering of incoming and outgoing mail.6 Large mailbox providers now push in the same direction: Google requires SPF, DKIM and a DMARC record from anyone sending 5,000 or more messages a day to personal Gmail accounts.7

The fake-invoice scam usually combines two things: a forged or look-alike sender, and a real mailbox someone has been reading. Our guide to the invoice scam that hits small Canadian firms walks through how it runs. DMARC closes the first door; the mailbox checks further down this page close the second.

  • Forged From address on your exact domain: stopped by DMARC at reject, once every legitimate sender is aligned.
  • Look-alike domain one letter away: outside what DMARC can see; handled by registering the obvious variants and by a payment rule your staff follow.
  • A real mailbox taken over with a stolen password: handled by a second sign-in step, alerts on new forwarding rules and the checks in the section below.

How the DMARC rollout goes: none, quarantine, reject

A safe DMARC rollout moves the policy in three stages, none, then quarantine, then reject, and only after every service that sends as your domain passes. Both the Cyber Centre and Microsoft describe this gradual path, because jumping straight to reject is the usual way an office stops receiving its own payroll and billing notices.54

Each stage lasts as long as your real mail needs to prove itself. We hold a stage through at least one full cycle of your normal sending, month-end invoices included, and move on when the evidence is clean. The pace depends on how many outside services send for you; we give you the planned dates in the scope letter and adjust them openly if a stage turns up a surprise.

Stage 1: p=none, and the sender inventory

The DMARC record goes live in monitoring mode. We list every service that sends mail as your domain: the mailbox provider, the accounting platform, the CRM, the website form, the newsletter tool, the scanner in the back office. Each one is set to sign with DKIM on your domain or to send from a subdomain of its own.

Stage 2: p=quarantine

Failing mail now goes to the junk folder at most receivers. Anything legitimate that still slips through shows up here while the cost of a miss is a message in spam, and we fix it at the source.

Stage 3: p=reject, subdomains and parked domains

Forged mail is refused before it reaches anyone. The policy is extended to subdomains, and the domains you own but never send from get a record that says no mail should ever come from them, as the Cyber Centre and Microsoft both recommend.54

Mail sent as your domain SPF check Is this server on the list? DKIM check Is the signature valid? DMARC match Does the domain that passed match the From line? Match Delivered No match The policy decides The policy, stage by stage 1 nonedelivered, watched 2 quarantinejunk folder 3 rejectrefused
How a receiving server judges a message that uses your domain, and the three DMARC stages.

DMARC setup on Microsoft 365 and Google Workspace

DMARC setup works the same way on Microsoft 365 and Google Workspace: the records live at your domain registrar or DNS host, and each platform has its own steps for turning on DKIM signing with your domain. Neither one sets DMARC for a custom domain on your behalf.48

Microsoft notes that outbound mail failing DMARC at the destination, from a domain with a quarantine or reject policy, is routed through its high-risk delivery pool, so a misaligned service hurts more than one message.4 Google asks for SPF or DKIM to be in place about 48 hours before DMARC is added.8

  • Microsoft 365: DKIM signing switched on for each custom domain, a DMARC record on the *.onmicrosoft.com domain as well, and bulk-mail services moved to a subdomain so their reputation stays separate from your staff's mail.4
  • Google Workspace: DKIM key generated in the admin console and published, outside senders checked for SPF and DKIM on your domain, policy raised only after reports show clean results.8
  • Both: mail forwarded through mailing lists or older systems can break DKIM; we identify those paths and decide with you how each one is handled.

What else we check around the mailbox

Email security also covers the mailboxes behind the domain, because most fake-invoice losses start in a real account that someone else can read. The domain records stop forgery; the mailbox checks stop the quiet reading and redirecting that comes before a changed bank account number.

A mailbox holding client names, addresses or files is also a store of personal information. PIPEDA requires safeguards matched to how sensitive that information is, and Quebec's private-sector privacy act requires security measures and a response, including notice when there is a risk of serious injury, to any confidentiality incident.910 Our privacy page covers that side: PIPEDA and Quebec Law 25.

  • A second sign-in step on every account, starting with the owner, the bookkeeper and anyone who approves a payment.
  • Every existing forwarding rule and inbox rule reviewed, with anything nobody recognizes reported to you the same day.
  • Alerts on new forwarding addresses, new inbox rules and new administrator accounts.
  • Administrator accounts kept separate from daily-use mailboxes.
  • DKIM keys at 2048 bits where the platform allows it, with a yearly rotation date written down.5
  • Encrypted delivery between mail servers (MTA-STS) where your provider supports it.5

What you have in hand at the end

At the end of the work you hold a domain at a DMARC reject policy, a written list of every service allowed to send as you, and a short report showing the state of the records before and after. The report belongs to you and can go to your insurer, your auditor or your next IT provider.

  • SPF, DKIM and DMARC records set and tested on each domain and subdomain in scope.
  • The sender inventory: each service, who owns the account, how it is aligned.
  • A before-and-after report in plain language, with the technical detail in an appendix.
  • Mailbox recommendations: sign-in protection, forwarding and rule alerts, administrator accounts.
  • A note of what to do when you add a new service that sends mail, so the protection survives the next software purchase.

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

A DMARC record is three lines long, and the risk sits in what those lines assume about your mail. A chatbot will produce a record that looks correct and passes a syntax check; it has no way to know that your payroll provider, your booking system and the scanner by the printer all send as your domain. Publish reject on that guess and the first sign of a mistake is a client asking why your invoice never arrived.

SPF fails silently in its own way: an eleventh DNS lookup makes the whole record invalid, and receiving servers treat it as a permanent error.51 An office owner adding one more service on a Friday afternoon is how that usually happens.

A freelancer can do the technical part well and still leave you exposed: the registrar login goes with them, the sender list lives in their notes, and nobody is accountable when a new tool breaks alignment six months later. With us the scope is written in a signed letter, the findings and the sender list are yours, and a person you can reach answers for the result.

Five plain reasons to trust us with this

  • A registered Canadian company

    INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.

  • In practice since 2013

    The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.

  • We run servers of our own

    Our own servers and more than 80 websites are checked for known vulnerabilities every day.

  • Insured

    Commercial general liability insurance of CAD 1 million is in force.

  • Your scope, your report

    A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

  1. Step 1

    We agree what to check

    A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

  2. Step 2

    You sign the scope letter

    It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

  3. Step 3

    We check, and write it down

    One report in plain words for you, with the technical detail attached for whoever looks after your systems.

  4. Step 4

    We fix it

    We make the repairs ourselves, or together with your current IT provider or web developer.

  5. Step 5

    We check again

    A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

  • A fixed quote once the scope is agreed
  • The price in writing before work starts
  • A second check after the fixes
Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

What are SPF, DKIM and DMARC in plain words?
They are three text records on your domain. SPF lists the servers allowed to send your mail. DKIM signs each message so a receiver can tell it was not altered. DMARC tells the receiving server what to do when a message using your name passes neither check: deliver it, put it in junk, or refuse it. Together they make your domain hard to forge.
How long does it take to reach a DMARC reject policy?
It depends on how many services send mail as your domain. An office with one mailbox provider and a newsletter tool moves faster than a company with a CRM, an accounting platform and website forms all sending for it. We hold each stage through a full cycle of your normal mail, month-end included, and write the planned dates into the scope letter.
Will DMARC block our own legitimate email?
It can, if the policy goes to reject before every sender is aligned, which is the most common DMARC mistake. That is why the rollout starts in monitoring mode, lists each service that sends as you, fixes each one at the source, and raises the policy only when your real mail passes. Quarantine comes before reject, so any miss lands in junk first.
Does this stop the fake-invoice scam?
It stops the version that forges your exact domain. It cannot stop a look-alike domain one letter away, or a real mailbox someone has broken into. Those need a second sign-in step, alerts on new forwarding rules, the obvious look-alike domains registered, and a rule that bank-detail changes are confirmed by phone on a number you already had.
Does it work with Microsoft 365 and Google Workspace?
Yes. Both platforms support DKIM signing with your own domain and honour DMARC policies on incoming mail. The records themselves are published at your domain registrar or DNS host. On Microsoft 365 we also add a record to the onmicrosoft.com domain, and on Google Workspace we wait about 48 hours after SPF and DKIM before adding DMARC, as Google recommends.
What is a DMARC record and where does it go?
A DMARC record is a single line of text published in your DNS under the name _dmarc followed by your domain. It starts with v=DMARC1 and states the policy: none, quarantine or reject, plus optional settings for subdomains and reports. It sits wherever your domain's DNS is managed, which is often the registrar where you bought the domain.
How much do email security services cost?
The price depends on how many domains you own, how many outside services send mail as you, which mail platform you use, and whether the mailbox checks are included. After a 30-minute conversation we send a fixed price in the scope letter, and that price holds for the work described. Licences, if any are needed, are passed on at cost.

Read this next

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

  • Same day callback
  • Written permission first
  • Fixed quote

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back