Only you should send email as you.
Today, nothing stops a stranger from sending email that looks exactly like it came from your business: a fake invoice, new bank details for a payment, a message to your own staff. Your customers cannot tell the difference, because right now their inboxes cannot either. We close that door, prove it is closed, and keep watch after.
Takes 30 seconds to request. If your domain is already protected, we tell you, show you the records, and that is the end of it. No scare tactics, no retainer pitch.
Fixed prices. No hourly meter.
Canadian dollars. Priced for small businesses, not enterprise budgets. Human help with this starts at US$3,900 elsewhere, and enterprise contracts run into five figures a year. Ours is a product, with the price on the door.
Free Check
- We read the public email records for your domain
- Plain-language verdict: protected, watch-only, or wide open
- Exactly what is missing, and what it exposes
- No login, no obligation, no follow-up spam
Email Authentication Fix
US customers: US$149, charged in USD.
- Full backup of your current records before anything changes
- Every system that sends as you found and accounted for
- Records written correctly and tested with live sends
- Reports watched for 14 to 30 days, then fakes blocked, with your sign-off
- Before-and-after proof pack
Hard Case
US customers: from US$249, charged in USD.
- Too many senders tangled into one record
- Several domains under one business
- Sending split across subdomains
- Signs of forgery already in your reports
- Everything in the standard fix included
After your fix: optional Monitoring, CA$35 per month per domain, or CA$350 per year (US$25 per month for US customers). Every month we read the reports the world's inboxes send about mail claiming to be you, and alert you if your records break, a new sender appears, or forgery shows up. Offered after your fix is delivered and proven, never pushed before.
30-second self-check
Three honest questions. You get a straight read on your risk and, if you need one, your exact price. No email required to see your result.
The 60-second answer
Who this is for
Three honest buckets. Find yours, then act accordingly. We would rather lose a sale than sell protection to someone who does not need it.
Your email moves client money
Law firms, real estate offices, bookkeepers, anyone whose emailed instructions move deposits, trust funds or closing money. The forged email in your name is the standard wire-fraud play, and your clients have no way to spot it. This is who the fix exists for.
You take card payments
Since March 31, 2025, the PCI card-security standard has required businesses that handle card payments to run automated anti-phishing protections, and its own guidance names these email records as the example. It does not order them by name, and neither do we pretend otherwise. It is one more reason to have them in place.
Already protected, or you send nothing
If your records already tell inboxes to reject forgeries, you are covered, and our free check will happily prove it and walk away. And if your domain sends no email at all, there is nothing to protect yet. Come back when it does.
What happens if you wait
This gap does not announce itself. Nothing breaks, nothing bounces, no warning arrives. It stays invisible until the one day it is used, and that day is chosen by the stranger, not by you.
A fake email spends your client's money
A stranger copies your address, writes to your client with new payment details, and the money goes to the wrong account. Business email fraud drove US$2.77 billion in reported US losses in 2024 alone, per the FBI's internet crime report.
Your name, their bank account
Forged invoices and payment redirects land beside your real messages, in the same thread style, with your real signature. Your customer pays the fake and blames you twice: once for the loss, once for not preventing it.
You would not even know
With no protection record in place, you also get no reports when someone forges you. The first version of this service is simply seeing: who is sending as you today, and what the world is doing with it.
The check costs nothing and reads only public records. Get checked free today.
How the fix works
Remote, careful, and proven at the end. You never hand over an email password, and nothing changes before a full backup of your records exists.
Free check
You send your domain, the part after the @ in your email. We read its public email records and tell you plainly: protected, watch-only, or wide open, with exactly what is missing. No charge, no obligation, no password.
Fixed price in writing
If you are exposed, you get one fixed price before any work: CA$197 for a standard fix, or a quote from CA$349 if your setup is a hard case. You pay that one fixed price up front, before any change is made. No hourly meter, no surprises, no added fees.
Backup, set up, watch, enforce
Full backup of your records first. Then we find every system that sends as you, write the records correctly, test with live sends, and watch the reports for 14 to 30 days. Only when every real sender checks out do we step up to blocking fakes, with your sign-off at each step.
Proof pack
You receive your before-and-after records, what was tested, and the date blocking took effect. If anything in your setup changes later, the backup is your rollback. Optional monitoring is offered once, after the proof lands.
Do not take my word for it
The big mailbox providers enforce these checks themselves, on their own published timelines. Read their words, then decide. One honest note before the quotes: their hardest rejection rules bind high-volume senders first, roughly 5,000 messages a day. The forgery gap above exists at every size, including yours.
Gmail is ramping up rejections, November 2025
Google's own Email Sender Guidelines FAQ now states: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." Google and Yahoo have required these records from bulk senders since February 1, 2024.
Non-compliant bulk mail is refused, May 2025
Since May 5, 2025, Microsoft rejects mail that fails these checks for high-volume senders to Outlook.com, Hotmail and Live addresses, with the error "550 5.7.515: sending domain does not meet the required authentication level."
Read Microsoft's documentation - Yahoo Sender Hub best practices
PCI DSS 5.4.1, in force since March 31, 2025
The card-security standard requires automated anti-phishing mechanisms for businesses that handle card payments, and its guidance names these email records (SPF, DKIM, DMARC) as the example controls. Stated precisely: the standard does not order them by name. An assessor still expects to see anti-spoofing protection in place.
US$2.77 billion in reported losses, 2024
The FBI's Internet Crime Complaint Center puts reported US losses from business email compromise at US$2.77 billion for 2024. The forged email that starts it looks ordinary. It just was not sent by the business it names, and nothing in that business's records told anyone to stop it.
The double guarantee
1. No risk to start
The check is free, reads only public records, and needs no login and no password. It comes with a straight answer even when the answer is "you are already protected, you owe us nothing." If your records already block forgeries, we will show you and walk away.
2. No risk if it goes wrong
Payment is final and there are no refunds. What you get instead is stronger: we keep working until your records verify live and aligned, with before-and-after proof, and every change starts from a full backup we can roll back to. We never promise nobody can ever imitate your business, because lookalike addresses exist, and we never promise your mail lands in the inbox. We promise the records, the enforcement, and the proof, which are the parts we control.
Straight answers
Can someone really send email pretending to be my business?
Yes. Email was built without a built-in check that a message really came from the address it claims. Unless your domain publishes the records that close that gap, a stranger can send mail that shows your exact business address, and most inboxes will deliver it beside your real messages. Try the free check: it reads exactly those records, in public, in about a minute.
What are SPF, DKIM and DMARC, in plain English?
Three public records for your domain. The first is a guest list: it names the services allowed to send email as you. The second is a signature: your real mail carries a tamper-proof stamp that inboxes can verify. The third is the instruction: it tells every inbox what to do with mail that fails the first two checks, from "just report it" up to "reject it," and where to send the reports. On their own each helps a little. Together, enforced, they are what stops a fake.
I am a small business. Do the Google and Microsoft rules apply to me?
Their hard rejection rules bind high-volume senders, roughly 5,000 messages a day to personal inboxes. Most small businesses send far less, and we will never tell you Google is about to reject your mail under those rules. The forgery gap is separate from the rules: it exists at any size, because nothing in your records tells an inbox to block a fake. One caution that does apply at any size: if you ever cross the volume line even once, with one big campaign, the big providers treat you as a bulk sender from then on.
Will this break my email?
It can if it is rushed, which is exactly why we work the careful way: a full backup of your records before anything changes, a list of every system that sends as you before we touch a thing, a watch-only period of 14 to 30 days reading the reports, and enforcement stepped up only when every real sender is checking out, with your sign-off at each step. If anything ever does go wrong, the backup is a clean rollback.
Do you need my email password?
Never. The work happens in your domain records, the settings behind your website and email address. You either grant us access to where those records live, the registrar or the company that hosts your domain settings, or we send you an exact sheet of records to paste in yourself, and we verify them live. Your email password is never part of it.
I already have an IT person. Do I still need this?
Maybe not, and the free check settles it in a minute. Many IT setups cover computers and mailboxes but never touch these domain records, because nobody's checklist asked. Ask your IT person one question in writing: "Is our domain set to reject forged mail, or only to watch it?" If the answer is enforced and proven, you are covered. If it is watch-only or a shrug, that is exactly the gap we close.
What does monitoring actually do?
Once your protection is enforced, inboxes around the world send daily reports about mail that claims to be you. Monitoring means we read those reports for you every month: who is sending as you, what passed, what failed, whether a new sender appeared, and whether anyone is forging your name. You get a short plain-language summary, and an alert when something breaks, all for CA$35 a month per domain or CA$350 a year.
Where are you and how is the work done?
Kollaz is based in Ottawa, Canada. The work is done remotely, in the evening so your business day is never disrupted. You deal with a named person, a fixed price in writing, and a proof pack at the end, not an anonymous ticket queue.
Find out if a stranger can send email as you. Free.
Send your business domain. No login, no password, no obligation. You get a plain-language verdict: protected, watch-only, or wide open, and only if you need it, one fixed price to close the door with proof.