Email is the front door of your business, and it is the door attackers knock on first. Spoofed invoices, phishing links, and hijacked accounts all arrive the same way: through a mailbox. Xponzy hardens the email domains and mailboxes we manage with proven, standards-based measures, and helps your team build the habits that technology alone cannot replace.
Email Authentication: SPF, DKIM, and DMARC
These three DNS-based standards are the foundation of a trustworthy sending domain. SPF declares which servers may send mail for your domain. DKIM signs each message so receivers can verify it was not altered. DMARC ties the two together, tells receiving servers what to do with mail that fails, and sends reports about who is sending as your domain.
We implement all three, roll DMARC out gradually from monitoring to enforcement so legitimate mail is never disrupted, and keep watching the reports afterward. Those reports regularly reveal forgotten senders, misconfigured tools, and outright abuse attempts you would otherwise never see.
Spam and Phishing Protection
On the mailboxes we manage, we maintain sensible filtering hygiene: keeping filters tuned, blocking known-bad patterns, and reviewing settings when spam starts slipping through or legitimate mail gets caught. Just as important, we help your team recognize the messages filters miss, such as look-alike sender addresses, urgent payment requests, and unexpected attachments.
Transport Encryption with MTA-STS
MTA-STS is a policy that tells other mail servers to deliver mail to your domain only over encrypted, verified connections, protecting messages from interception in transit. Where your platform supports it, we publish and maintain the policy as part of your domain configuration.
Account Access and Two-Factor Authentication
Most email breaches start with a stolen password. We provide practical guidance on strong, unique passwords, enabling two-factor authentication wherever your platform supports it, and revoking access promptly when someone leaves the company. Small process changes here prevent the majority of account takeovers.
Backup and Retention Guidance
Deleted does not have to mean gone, but only if you decide that before it matters. We advise on what your platform retains by default, what recovery windows actually exist, and what backup or retention arrangements make sense for your business and any obligations it has, so expectations are set before an incident rather than after.
Security Reviews
On request, we review the state of your email security: DNS authentication records, filter configuration, administrator accounts, and mailbox rules such as hidden forwarders, which are one of the most common signs of a compromised account. You receive clear findings and a prioritized list of fixes, and we can implement them for the services we manage.
Start with a Conversation
Whether you want a one-time review or ongoing management, the first step is simple: tell us about your domain and how your team uses email through our contact form, and we will recommend where to begin.
