Company emails land in customers' spam folders, invoices from the accounts team go unread, and one day a supplier receives a message that looks like it came from your manager, asking for payment to a new bank account. These problems often come from missing or wrong email authentication records on your domain, from staff using personal addresses, or from mailboxes created by different people with no plan.
Kemlat reviews your domain and email setup, then configures the three records that help receiving servers confirm your messages are genuine. SPF lists the servers allowed to send email for your domain, DKIM adds a digital signature to each message, and DMARC tells receiving servers what to do with messages that fail these checks and asks them to send you reports. We also organise mailboxes, secure staff accounts and train someone in your team to manage them.
How we work
- 01
Review the current setup
We check your domain's DNS records (the public settings that tell other servers where to deliver your email and which senders to trust), your email provider, and every service that sends email in your name, such as the website, the accounting system or a newsletter tool. We also review how mailboxes and passwords are managed.
- 02
Plan the changes
We agree the email provider, the structure of personal and shared mailboxes, naming rules, and the full list of services allowed to send email for your domain.
- 03
Set up SPF and DKIM
We publish one SPF record that lists every allowed sending service, while staying within SPF's technical limit of 10 lookups per check (some services use more than one), and switch on DKIM signing with your email provider and the other services. We then confirm that real messages pass both checks.
- 04
Introduce DMARC in stages
DMARC starts in monitoring mode, which collects reports without affecting delivery. Once the reports show that every genuine sender passes, we tighten the policy so receiving servers send forged messages to spam or reject them.
- 05
Secure accounts and hand over
We switch on two-step login, close unused accounts and set steps for new and departing staff. Your contact person is trained to manage accounts and read the DMARC reports.
What you receive
Email setup review
A report on your current records, sending services, mailbox structure and the risks found.
SPF, DKIM and DMARC records
Authentication records published and tested for every genuine sending service, with DMARC tightened in stages.
Mailbox and account security
Mailboxes organised under agreed rules, with two-step login switched on and unused accounts closed.
Testing, documentation and handover
Delivery tests, a document of every record and setting, and training for the person who will manage email.
What changes for you
- Messages from your domain are more likely to reach inboxes instead of spam folders.
- Once DMARC is enforced, email that pretends to come from your exact domain is far more likely to be rejected or sent to spam.
- Mailboxes belong to the organisation, and access is removed promptly when staff leave.
- Your team can manage accounts and spot sending problems without outside help.
Where this service sits in the KEMLAT Method
Scope: Email provider subscriptions and domain registration fees are paid separately. Moving old email between providers can be included if it is agreed in the scope.
Questions clients ask
Will DMARC block our own emails?
Not when it is introduced in stages. We start in monitoring mode, find every service that sends on your behalf, correct their settings, and only then ask receiving servers to reject messages that fail.
Which email provider should we use?
Microsoft 365 and Google Workspace are the most common choices for companies, and both support everything described here. We recommend one based on the tools your team already uses for files and meetings.
Can you move our old emails to the new provider?
Yes, if it is in scope. We plan the move so new mail switches over at an agreed time and old messages are copied with their folders.
Does this stop all fraudulent emails?
No. Once enforced, these records make email that fakes your exact domain far more likely to be rejected or sent to spam, but fraudsters can still use similar-looking domains or other channels. Two-step login and staff awareness remain necessary.
Related services
All servicesStart with a conversation
Tell us where you are today. We will suggest the right first step, with no obligation.