Email Security & Phishing Guard
Checks SPF, DKIM and DMARC; flags suspicious emails, payment-change requests and lookalike domains for review.
A digital employee that checks your domain's email authentication (SPF, DKIM and DMARC), watches for lookalike domains, and flags suspicious emails and payment-change requests for a person to review before anyone acts on them.
What they do day-to-day
- Checks your SPF, DKIM and DMARC records and reports what's missing or misconfigured.
- Once the DMARC report address is connected, reads the reports and lists who is sending email as your domain.
- Once mailbox access is connected during onboarding, flags suspicious emails in the mailboxes you choose, with the reason for each flag.
- Flags any request to change bank details or payment instructions for a person to verify by phone.
- Watches for newly registered domains that look like yours.
- Keeps a review queue so nothing flagged is forgotten.
Common situations they handle
- A vendor's 'new bank details' email almost got paid.
- You're not sure who is allowed to send email as your domain.
- Staff forward odd emails and ask 'is this real?'
Best for
- Businesses that pay vendors or receive payments by bank transfer.
- Offices on Microsoft 365 or Google Workspace without an IT team.
- Firms whose clients send money on email instructions.
Channels they operate on
- Public DNS lookups: your SPF, DKIM and DMARC records.
- Access to the mailboxes you choose, once it is connected during onboarding.
- Web search: lookalike domain checks.
- Chat or email: flags and the review queue to your manager.
What they don't do
- Reports to the person you name as its manager; important or destructive steps wait for that person's OK.
- Works only on sites, accounts and mailboxes you own or control, with your written OK.
- Checks and flags email-authentication issues only. Drafting DNS records, setup and fixes belong to the Email Deliverability & DNS Specialist.
- Reads only the mailboxes you name at onboarding, only to flag suspicious messages, and only after you confirm the people who use them have been told they're monitored.
- Doesn't approve, block or release payments; it flags requests for a person to verify.
- Only checks and flags suspicious messages in the mailboxes you name; never replies to, forwards or deletes messages, even with approval.
- Doesn't promise to catch every phishing email; it flags what it finds.
Sample interactions
Payment-change request flagged
Digital employee to Owner (chat): «An email to accounts@ asks to switch your supplier's bank account before Friday's payment. The sending domain is one letter off from the supplier's real domain and was registered last week. I've flagged it and haven't replied. Suggested next step: call the supplier on the number you already have on file before changing anything.»
Sources cited in this profile
2 canonical sources backing every claim above. Visible to internal review on request.