I fix email authentication.

Two things happened to a client of mine

The first: their email disappeared.

Their mail was running on their hosting provider's system. The hosting expired. Everything was deleted — every message, every folder, every year of it. There were no backups.

They went a week without email. A week of invoices nobody received and replies nobody sent.

I built them a mail server on a VPS, hardened it, and got them working again.

The second happened later.

A message arrived from a noreply@ address on their domain. That mailbox had never existed. It came from an address that had nothing to do with us, carried no valid signature, and nothing aligned. Someone was sending mail as my client.

The only reason I saw it: the DMARC policy I'd already published put it in the spam folder instead of the inbox.

Most people delete spam. I opened the headers.

I don't know who sent it. I didn't need to. I moved the policy to p=reject, and unauthorised mail from that domain is now refused at the receiving server — before it reaches anyone at all.

What I take from that

Neither problem announced itself.

The deleted mailboxes were noticed because someone couldn't work for a week. The forged sender was noticed because a control I'd already put in place caught it, and because I read the headers instead of deleting the message.

Most domains being impersonated right now will never find out. Not because it's hard to see. Because nobody is looking.

That's the job.

What I run

This site's mail runs on a server I built and administer myself — poste.io, self-hosted, on infrastructure I manage. Not a dashboard I log into. A machine I'm responsible for.

• Ports closed except the ones that have to be open
• Admin panel reachable only over Tailscale, never the public internet
• SSH by key. Password authentication disabled.
• Blocked connection attempts arrive every day. That's what the internet does to a mail server, and it's why the logs matter.

It scores 10/10 on mail-tester. DKIM is 2048-bit. DMARC is at p=reject.

You don't have to take my word for it. The checker on this site works on my domain too.

How I work

Everything in writing.

No calls. You send your domain, I send back what I find — within one business day. You get a document you can forward to your team, not a memory of a conversation you have to summarise for them afterwards.

Findings in writing. Changes in writing. Proof in writing.

One record at a time

I make DNS changes in a fixed order, one at a time, and I verify each one before the next.

That isn't caution for its own sake. Rushing DNS changes is how authentication breaks quietly — the records look correct, and mail stops arriving anyway. Nobody complains, because nobody knows.

I'd rather be slow than have you find out from a customer.

What I'm not

I'm not a marketing agency. I won't write your emails or manage your campaigns.

I won't promise to get cold outreach into the inbox. Authentication isn't why cold email fails, and anyone who tells you otherwise is selling you something.

I'm not on call around the clock.

I'm one person. When you write, I'm the one who answers.

I work in European hours.

Start with the check. It's free, it takes four seconds, and it tells you whether any of this applies to you.