Set up right
We verify, complete and correct your SPF and DKIM, add MTA-STS and TLS-RPT, and move DMARC to full enforcement in stages — without breaking the mail you depend on.
Managed email authentication
Make your domain
impossible to fake.
Your domain almost certainly has some authentication on it already. Rarely all of it, and rarely switched on. We take it from wherever it stands today to fully enforced: SPF, DKIM, DMARC, MTA-STS and TLS-RPT. Then we run it for you — no dashboard to learn, no records to babysit.
Free exposure scan · reads only public DNS · no changes to your mail flow
Your email works. That's not the same as being protected.
Most teams set up email once, maybe added an SPF record, and moved on. That's usually where it stops. The trouble is that half-configured authentication still passes the eye test. Mail flows, nothing looks broken, and meanwhile anyone on the internet can put your domain in the From line. Nothing reports back, so you'd never know.
A working MX record and mailboxes only cover mail coming in. None of it stops someone sending mail that looks like it came from you. That's a separate job, and it's the one most setups skip. Until your authentication is verified and actually enforced, it isn't protecting anything.
Anyone can put your domain in the "From" line today.
An unverified SPF record can fail silently and still look fine.
"Monitor only" DMARC blocks nothing. It just reports after the fact.
AI can find an unprotected domain and start abusing it faster than any inbox filter can react. Detection is always a step behind the attack. StopForge shuts impersonation off at the source, in your domain's own authentication, so there's nothing left to detect.
Where is your email on the path to protected?
Email authentication isn't a switch you flip — it's a path. Most organizations are somewhere in the first two steps, and many aren't sure which one. Not knowing is normal: finding out is step one.
Most organizations start here
1
Verify
Find out what you actually have today. Most setups have gaps nobody knows about.
2
Authenticate
Set up the records that prove your real mail is really you (SPF and DKIM).
3
Enforce
Switch on blocking (DMARC at reject) so forged email is rejected — without disrupting your real mail.
4
Maintain
Keep it working as you add tools and vendors and as threats change. This step never ends.
5
Distinguish (optional)
Show your verified logo in inboxes (BIMI). The finishing touch, once you're protected.
Not sure which step you're on? That's exactly what the free scan tells you — in seconds, with no changes to your mail.
Find my stepThe whole stack, handled.
Nobody can send as you.
SPF, DKIM and DMARC prove your identity and block impersonators.
Nothing travels exposed.
MTA-STS and TLS-RPT force encryption in transit and report when it fails.
- SPF
- DKIM
- DMARC
- MTA-STS
- TLS-RPT
- BIMI optional add-on
How StopForge works.
-
1
Free scan
In seconds, we read your public records and show you exactly where you stand. No changes, no obligation.
-
2
Exposure assessment
We turn on reporting and watch real data for a couple of weeks, then show you every service sending as your domain — including the ones nobody can identify — with a clear roadmap.
-
3
Path to enforcement
We verify, complete, and correct your records, then move you to full enforcement in stages, without breaking the email you depend on.
-
4
Managed
We keep it that way: authorizing new senders before they break your mail, catching new spoofing, and keeping your records and sender inventory audit-ready.
Who's behind it.
StopForge is run by a founder who has spent 25+ years building and shipping security products — including Hueya and PhishOn, consumer-privacy and anti-phishing platforms brought to market to protect people and organizations from targeted attacks.
Email impersonation is that same problem from the other side. Instead of training people to spot a fake, we make your domain impossible to fake in the first place. That focus is the whole point here. It's all we do.
We're a practice, not a product.
Most of what's out there is software you log into and run yourself. This isn't that. We take the whole thing off your desk: the assessment, the records, the staged move to enforcement, and the day-to-day after. We keep the number of organizations we work with deliberately small, so each one gets the attention it needs.
Every engagement starts the same way. A free scan, then a short assessment of what's actually sending as your domain. From there we scope the work to your situation. There are no packages to choose between and no price list to upsell against. We tell you what protecting your domain takes, and if we're a fit, we do it.
Run for you
We authorize new senders before they break your mail, catch new spoofing as it appears, and keep your records current as your stack changes.
Audit-ready
Every change documented, a clean inventory of who sends as you, and compliance evidence on hand when someone asks for it.
BIMI — your verified logo in the inbox — is available as an add-on once you're enforced.
Questions, answered.
How do I know if my SPF or DMARC is actually working?
Most setups look configured but fail in ways you can't see from the inbox — a record that exceeds its lookup limit, a sender that isn't covered, or a DMARC policy still set to "monitor." The free exposure scan reads your live public records and shows you exactly what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail.
Will moving DMARC to reject break my legitimate email?
It can, if you enforce before every real sender is authenticated — which is exactly why we don't. We turn on reporting first, inventory every service sending as your domain, fix SPF and DKIM for each, and only then move to reject in stages. Done in the right order, enforcement blocks forgeries without dropping a single real message.
We already have an SPF record. Isn't that enough?
SPF alone doesn't stop impersonation. It covers one path, breaks silently past ten DNS lookups, and says nothing about what to do when a check fails — that's DMARC's job. Real protection needs SPF, DKIM and DMARC working together, enforced, and kept current as your senders change.
What if we haven't set up any of this yet?
That's fine — plenty of organizations start with nothing in place. The free scan still works (it'll simply show an open, unprotected domain), and we build your SPF, DKIM, DMARC, MTA-STS and TLS-RPT from the ground up, then manage them. Starting clean is often faster than untangling a half-finished setup.
What does StopForge cost?
Protecting a domain isn't one-size, so we don't publish a price list. Getting you to full enforcement is a scoped project; staying there is an ongoing managed service. After the free scan and a short assessment, we tell you exactly what your situation takes. The scan and the assessment cost nothing, with no obligation.
How long until we're protected?
The free scan is instant. The exposure assessment runs about two weeks while we watch real reporting data and identify every sender. From there we complete and correct your records and move to enforcement in stages — most organizations reach full enforcement within a few weeks, without disrupting live mail.
Do you need access to our mail servers or systems?
No. We work entirely in public DNS — the same records the rest of the world already sees. The scan and assessment require no access to your mailboxes, servers, or internal systems.
Rather we just take it off your plate?
If you'd sooner hand this over than wrestle with DNS records: give us your domain and where to reach you, and we'll get you to full protection — set up, enforced, and kept that way.
Prefer to see where you stand first? Run the free scan →
Thanks — we'll be in touch to get your domain protected.