Free email security audit · Northeast Ohio
Right now, can a stranger send email as your company?
A free 60-minute audit for Northeast Ohio businesses on Microsoft 365 or Google Workspace. We answer two questions: whether someone outside can send mail using your name, and whether someone is already reading mail inside your tenant. You get the answers in writing two business days later.
- 60 minutes on a screen share. Nothing installed, no message content read.
- A written findings sheet within two business days, with the exact record changes to make.
- Free up to 50 mailboxes. No card, nothing owed afterward.
- An active forwarding rule nobody created, you hear about during the call — not in the document.
The offer
Free Email Security Audit
Freeup to 50 mailboxes, no card
What you get
- A yes or no answer: can a stranger send email as you today
- Every forwarding rule in your tenant checked for signs of a break-in
- Which mailboxes have no two-factor, and which belong to people who left
- A written findings sheet in two business days, record values written out
60 minutes on a screen share. Nothing installed, no mail read.
Optional · tap oneStep 1 · tap one
Which sounds most like you?
Would rather talk than type? Call and you get Noah, not a queue. (330) 305-2750
The offer
Free Email Security Audit
Freeup to 50 mailboxes, no card
What you get
- A yes or no answer: can a stranger send email as you today
- Every forwarding rule in your tenant checked for signs of a break-in
- Which mailboxes have no two-factor, and which belong to people who left
- A written findings sheet in two business days, record values written out
60 minutes on a screen share. Nothing installed, no mail read.
30-second self-check
Five questions. See where your email stands.
Tap Yes, No or Not sure. It runs on this page and sends nothing unless you add it to your request.
Your result
0 / 5 covered
Tap an answer on each question. Nothing is sent until you press the button at the end.
What you walk away with
Here's what the findings sheet looks like.
Each problem, what it allows, and the exact change that closes it. Tap any row.
Email security findings
Example: Maple Street Dental, 9 mailboxes (made up for this page)
Fix nowDMARC policySet to p=none, and reports go to an address nobody reads
What it means
Anyone can send mail as the practice's domain and most receivers will still deliver it.
The fix
Send reports to a watched inbox, review two to four weeks, then move to p=quarantine. The full record is written out in the sheet.
Fix nowForwarding rulesOne mailbox auto-forwards everything to an outside Gmail address
What it means
Nobody on staff set it up. It is the classic sign someone else is reading that mailbox.
The fix
Remove the rule, reset the password, end every session and review 30 days of sign-ins. You'd hear this one during the call.
Fix soonTwo-factor sign-in7 of 9 mailboxes enrolled
What it means
One of the two without it is the front desk mailbox that receives invoices.
The fix
Enroll both, then turn on a policy that requires it for everyone.
Fix soonEx-employee mailboxes2 accounts belong to people who left last year
What it means
Still licensed, still able to sign in, and watched by no one.
The fix
Block sign-in, convert to shared mailboxes or export and delete, and drop the licences.
Fix soonSMTP sending with a password onlyAllowed for the whole tenant
What it means
A stolen password can be used to send mail from a script without two-factor.
The fix
Turn it off tenant-wide and allow it only for the copier mailbox that needs it.
OKSPFValid, 6 of 10 DNS lookups used
What it means
Your senders are authorized and there's room to add another.
The fix
Nothing now. Re-check when you add a new sending service.
Tap a row to open it. Sample only: the company and findings are made up.
The scope, in writing
What you get, and what you don't.
Invoice fraud usually starts with a mailbox somebody else is quietly reading. This audit looks at both ends of that: the records that let strangers impersonate you, and the settings that let an intruder stay.
Included
- SPF, DKIM and DMARC read for every domain you send from, with a yes or no answer to whether a stranger can spoof you today
- SPF lookup count against the ten-lookup limit, and whether your DMARC policy is doing anything or just observing
- MX records, MTA-STS and TLS reporting — whether mail to you is encrypted in transit
- Every mailbox listed: which have multi-factor authentication, which are shared, and which belong to people who left
- Mailbox rules and forwarding across the whole tenant. An auto-forward to an outside address that nobody set up is the classic sign of a compromised account
- Legacy and basic authentication protocols still enabled, which is how MFA gets bypassed
- Admin roles: how many global admins exist, and whether all of them have MFA
- A check of your addresses against known breach data, so you know which of your people already have a password in circulation
- A written findings sheet: each problem, what it allows, and the specific change that closes it
Not included
- Reading anybody's mail. We look at rules, permissions, records and logs — never message content.
- Publishing the DNS records. We write them out exactly; changing your DNS is either your job or a separate piece of work you ask for.
- Phishing simulation or security awareness training. Different service, and one you buy on purpose rather than get bundled.
- Migrating you to a different mail platform. If that turns out to be the right answer, it is a quoted project, not part of a free hour.
- Why one marketing campaign landed in the promotions tab. We check whether your sending platform is authorized to send as you, not how your newsletter performs.
Start without waiting for me
The DNS half, in about a minute, without me.
Whether a stranger can send mail as you is written in public DNS records, so you do not need an appointment to read it. Our free checkup pulls your SPF, DKIM, DMARC, MX and MTA-STS records and tells you what they currently allow. What it cannot see is the inside of your tenant — the forwarding rules, the admin accounts, the ex-employee whose mailbox is still live. That is the hour.
What the scan reads
- SPF
- DKIM
- DMARC policy
- SPF lookup count
- MX records
- MTA-STS
- TLS reporting
- Blacklists
The scan is free and there is no card. Your name and email make the free account that keeps the report, right here, and it only reads what the internet can already see — nothing inside your building.
Or open the full checkup page first.
After you hit send
What happens next, step by step.
Step 1
You send the form
Mail platform, rough mailbox count, and a couple of times that work. I reply within one business day.
Step 2
Sixty minutes, screen shared
Your admin drives, or you give a read-only account for the session and disable it after. Everything we look at, you watch us look at.
Step 3
Two business days
The findings sheet arrives with the record values written out. Anything urgent (an unknown forwarding rule, an admin with no MFA) was already said out loud.
Step 4
You decide who fixes it
Most of it is a DNS change and a handful of settings. Do it yourself, hand it to your provider, or ask me for a quote to do it.
Before you send it
The questions people actually ask.
Won't turning on DMARC break our email?
It will if you jump straight to a reject policy before you know everything that sends mail as you — your invoicing system, your CRM, your marketing platform, the copier. That is exactly why the record starts at p=none with reporting switched on, you watch for a few weeks to see who is really sending, and only then tighten. The audit tells you which senders would break before anything changes.
Do you need access to our mailboxes?
No. A screen share with your own admin driving covers the whole checklist. If you would rather hand over an account, a read-only global reader role is enough and you can disable it the moment we hang up. We do not read message content in any version of this.
What does it cost after?
The audit is free and stays free. If you want the records published and the reports read for you every month, that is our DMARC reporting service and it is quoted per domain in writing. If you want the whole email environment run (filtering, MFA enforcement, offboarding) that is part of managed IT, month to month, no minimum term.
We're on Google Workspace, not Microsoft 365.
Same audit. The record checks are identical because they are DNS, and the tenant side maps across: MFA enrollment, admin roles, forwarding rules, third-party app access, and accounts belonging to people who left.
We're six people. Is this worth an hour?
Six people is the size where this matters most, because a six-person company usually has one person who can authorize a payment and no second set of eyes on the invoice. Business email compromise, an invoice quietly redirected by somebody reading your mail, is a category the FBI's Internet Crime Complaint Center tracks on its own, precisely because of how much money moves through it.
Our provider says we're already covered.
Then this is a sixty-minute confirmation and you get a document that says so. It is worth checking, because SPF, DKIM and DMARC are DNS records anyone can read from outside, including me and including an attacker. The most common finding is a DMARC record that exists, is set only to observe, and has not been read by anyone since the day it was published.
Reading, if you are not ready to talk yet
Book the sixty minutes.
You will end the week knowing whether someone can send mail as your company, and whether anybody already is. That is worth an hour even if the answer turns out to be no.