SPF, DKIM and DMARC published and tested
Your domain, your mailboxes, and the three records that decide whether your mail is trusted. Set up, tested, and checked again after the switch.
Business email · Sydney, NSW
FingerTip sets up business email on your domain, migrates the old mail across, and configures the three records that decide whether receiving servers trust it: SPF, DKIM and DMARC. If your mail and files need to stay in Australia, we provision an Australian server for the job and name the provider in the quote. Sydney based, working Australia wide.
Twenty minutes, no cost, no obligation.
Mail from your domain lands in spam when your DNS does not tell receiving servers who is allowed to send for you. Three records do that: SPF, DKIM and DMARC. If any one of them is missing, incomplete, or still authorising a service you stopped using two years ago, filters cannot separate you from someone forging your address, so they file the message as suspicious.
The pattern is always the same. A quote goes out on the Tuesday. The client rings on the Friday to ask where it is. It has been in their junk folder all week.
This is not something you did wrong. Authentication was optional when most domains were set up, and the receiving side tightened afterwards. Nobody sends you a notice when a standard moves.
It gets worse quietly. Every message that lands in junk teaches the filter a little more, and by the time anyone notices, the domain has a reputation. Reputation takes longer to repair than it took to damage.
So FingerTip starts by reading what your domain publishes today, finding every service that sends on your behalf, and authorising those and nothing else. You get that written down before any change is made.
What we set up
Your domain, your mailboxes, and the three records that decide whether your mail is trusted. Set up, tested, and checked again after the switch.
Old mail, calendars and contacts carried across in full, not just the last few months. Mail keeps arriving at the old mailbox until the cutover, and the old mailbox stays reachable afterwards.
FingerTip moves businesses off Google Workspace when they want their files somewhere they control. Mailboxes, shared calendars and shared drives, on infrastructure FingerTip runs rather than resells.
FingerTip manages mailcow for Australian businesses, and mailcow is what FingerTip uses for its own mail. mailcow gives a business full mail, calendars and contacts with no per-seat licence, on a server FingerTip runs for you.
If you are looking for someone to run a mailcow install, that is work we take on.
If your mail already arrives and you only need a DMARC record published, that is an afternoon of your own work. We will point you at the instructions rather than invoice you for it.
If you need Microsoft 365 specifically, for Teams and SharePoint, we are not the right people. FingerTip runs infrastructure it controls rather than reselling licences from someone else.
If nobody at your business can approve a DNS change, nothing here can start. Every part of this work needs one.
If you need mail held in Australia on day one, say so before anything else. An Australian server is provisioned for the engagement rather than already sitting there, so it changes the start date.
Yes. FingerTip publishes DMARC records for businesses that failed a security questionnaire. A DMARC record can be published in an afternoon, but publishing one that rejects mail before you know what sends for you will stop your own invoices.
We start in reporting mode, read a few weeks of reports to find every legitimate sender, then tighten to p=reject once nothing is left out. You get the record, and the reports that show it was safe to turn on, which is the part the questionnaire is asking you to evidence.
Mail goes to spam when the sending domain does not tell receiving servers who is allowed to send for it. FingerTip reads what your domain publishes now and shows you what it says.
The common fault is an SPF record that still authorises a service the business stopped using, or no DKIM signing at all, which leaves filters unable to separate the business from someone forging its address.
SPF, DKIM and DMARC are three DNS records that work together to prove mail from a domain is genuine.
| Record | What it declares | Without it | DNS type |
|---|---|---|---|
| SPF | Which servers may send mail for the domain | Any server can claim to send as you | TXT |
| DKIM | A signature proving the message was not altered in transit | Receivers cannot confirm the message is yours | TXT (selector) |
| DMARC | What receivers do when SPF or DKIM fails, and where reports go | Receivers decide for themselves, usually the junk folder | TXT (_dmarc) |
DMARC also returns daily reports naming every service that sent mail using the domain.
FingerTip stops domain spoofing by publishing SPF, DKIM and DMARC and moving the DMARC policy to p=reject.
At p=reject, a receiving server that gets a message failing both SPF and DKIM discards it rather than delivering it to a junk folder, so spoofed mail sent as your domain stops arriving anywhere. Getting there safely needs the reporting stage first, so that no legitimate sender is cut off when the policy tightens.
Yes. FingerTip moves businesses off Google Workspace. Mailboxes, calendars and contacts move across, and shared drives move with them.
The usual reason is wanting the data somewhere the business controls, and the usual worry is losing the parts of Workspace people actually use. We go through that list before anything moves, so you know in advance what stays the same and what is different.
They are not the same kind of product, so comparing them on price per user does not tell you much. Google Workspace and Microsoft 365 are bundles: email, documents, file storage and video meetings sold together at one per-seat price. FingerTip sells each of those separately, so email can be fixed without changing anything else about how the business works.
| Compared on | FingerTip | Workspace or Microsoft 365 |
|---|---|---|
| How it is sold | Each service on its own. Email, file storage and documents are separate decisions | One bundle, one per-seat price |
| What the email service includes | Mail, calendars, contacts, webmail and mobile sync. Storage and documents are separate services | Email, documents, file storage and video meetings together |
| What you pay for | The services you take | Every seat gets everything, used or not |
| Changing one piece | Replace one service and keep the rest | Replace the suite or keep it |
| Leaving | One service at a time | All of it, or none |
| Who it suits | You want email fixed without changing anything else | You want one vendor, one bill and one login |
Taking more than one service does not mean more paperwork. Anything you add goes on the same invoice, and what you take depends on what you actually need. If what you want is Teams or SharePoint specifically, the bundle is the better buy and we will tell you so.
Usually, yes. FingerTip handles blocklist delisting, which is possible once the cause is fixed. Delisting without fixing the cause leads to being relisted.
The common causes are a compromised mailbox sending spam, a web form that relays anything it is handed, or a shared sending IP where another customer on the same address was the source. We fix the cause, request delisting from each list separately, and move you onto your own IP if that is what put you there.
Yes. When a customer needs mail or files held in Australia, FingerTip provisions an Australian server for that engagement. The provider and the data centre country are named in the quote, before you commit, because the cost of the server is part of the price.
Being precise matters here, because jurisdiction follows the operating company as well as the hardware: data held on infrastructure operated by a company subject to the US CLOUD Act stays within reach of a US subpoena wherever the server sits.
Tell us what your obligation is, whether that is a contract clause, a security questionnaire or a regulator, and we will put in writing what we can host and where.
Email, domain and website belong together, in your name. Nothing of yours is registered to us, and nothing is held as leverage. It is the same rule the whole practice is built on.
FingerTip also sets up and manages UniFi business networks, so the office network sits with the same business as your email.
The full version is on the data ownership page.
Tell us what you have now and we will tell you what moving involves. If the fix is an afternoon of your own work, we will say so.
Twenty minutes, no cost, no obligation.