Locking Down Email for a Mississauga Development Company

Development companies move large sums by email: deposits, draws, trade invoices. That makes them a target for fake invoices, payment-change requests and messages spoofing an executive or vendor.

Finex Development wanted to know two things: could someone send mail that looked like it came from their domain, and was their Microsoft 365 tenant set up to catch the rest?

Enforced DMARC closes the door that business email compromise usually walks through.

• Audited the email security of the company's Microsoft 365 domain, reviewing SPF, DKIM and DMARC.
• Found the main gap: DMARC was published but set to monitor only (p=none). It reported spoofed mail but told receiving servers to deliver it anyway. We moved the domain to enforcement so impersonation attempts are rejected.
• Delivered a written audit report, then walked the team through it in plain language: what was already protected, what changed, and what the change means for fake-invoice attempts.
• Configured external email warning banners in Microsoft 365, so every message from outside the organization is flagged before staff act on it.
• Provide ongoing Microsoft 365 licence and renewal management.
• Separately, installed and configured new office Wi-Fi.

Mail that spoofs Finex Development's domain is now rejected by receiving servers that honour DMARC, instead of landing in a client's or supplier's inbox. Staff see a warning on every external message, which is where payment-change requests usually arrive.

Many domains publish DMARC at p=none and never move on, because nobody is sure which services send mail on the company's behalf. Accounting software, a CRM, a website form and a newsletter tool can all send as your domain. Move to enforcement before they are aligned and your own invoices start bouncing.

The fix is an inventory of every sender, then a staged move through p=quarantine to p=reject while reading the DMARC reports. The policy values are defined in RFC 7489, and Microsoft's DMARC setup guide covers Microsoft 365. Our guide to rolling out DMARC from p=none to p=reject sets out the sequence, and the email spoof check shows where your domain stands today.