EmailCheckup

How healthy is your firm's email?

Start with what the outside world can see. Enter your email domain and we'll read the public records that decide whether someone else can send mail as your firm. It takes a few seconds and nothing is stored.

The scan is the outside view. A full checkup goes inside your Microsoft 365 or Google Workspace tenant, where most of the risk lives.

Domain report

yourfirm.ca

  • Mail servers

    Not checked

    Who receives mail for the domain: Microsoft 365, Google Workspace or something else.

  • SPF

    Not checked

    One published list of who may send as you, within the 10-lookup limit.

  • DKIM

    Not checked

    Signing keys that let receivers verify mail really came from you.

  • DMARC

    Not checked

    Your instruction for mail that fails: report it, junk it or refuse it.

  • DNSSEC

    Not checked

    Signed DNS answers, so nobody can quietly substitute their own.

  • CAA

    Not checked

    Which certificate authorities may issue certificates for the domain.

The scan sees the outside. The checkup looks inside.

Spoofing protection is one part of email health. Account takeovers, quiet forwarding rules and missing backups don't show up in DNS. They show up in your tenant, and in your inbox when something goes wrong.

  • Domain and DNS

    Everything in the scan, plus lookalike domains you own, registrar lock and renewal, and who actually controls your DNS.

  • Tenant security

    MFA coverage, admin roles, legacy sign-in, forwarding and inbox rules, audit logging, external sharing and mobile access.

  • Licensing

    Seats nobody uses, editions that don't fit, and features you already pay for but haven't switched on.

  • Protection and recovery

    Whether mail and files are backed up outside Microsoft or Google, and whether anyone would notice an account takeover.

  • Insurance and compliance

    How the findings line up with what cyber insurers ask, Canadian privacy law and what your regulator expects.

See everything in the checkup

Built for firms, not hobby domains

The checkup is for established Canadian organizations with roughly 10 to 150 staff: accounting firms, law firms, investment and financial firms, engineers, architects and other professional services. The kind of firm where one compromised mailbox means a wire transfer, a client file or a regulator letter.

We review Microsoft 365 and Google Workspace with the same care. Plenty of providers treat Google as an afterthought. We don't.

Firms usually ask us when

  • the cyber insurance renewal asks questions nobody can answer with confidence
  • a client or partner received a convincing email that wasn't from you
  • someone new is responsible for IT and wants a baseline
  • the firm is merging, splitting or changing IT providers
  • the licensing bill keeps growing and nobody is sure why

How a checkup works

Four steps. You stay in control of access the whole way through.

  1. Request

    Email us your firm name, staff count and platform. We reply within one business day and set up a short call to agree scope.

  2. Read-only access

    You grant a temporary read-only admin role in Microsoft 365 or Google Workspace. We review settings and logs. We don't change anything.

  3. Report

    A branded, plain-English report with every finding sorted into fix now, fix soon and nice to have, and what each one means for the firm.

  4. Walkthrough

    We go through the report with you on a call. Then you remove our access, and either KDTS fixes it or your own IT does.

What a finding looks like

An excerpt in the style of a real report, with the firm details removed.

FindingPriorityWhat it means
Two mailboxes forward all mail to personal Gmail accountsFix nowClient files leave the firm with no record. A common sign of an old takeover, or an old habit.
Four of 31 accounts have no MFA, including one adminFix nowThe first thing an insurer asks about, and the most common way into a mailbox.
DMARC published at p=none since 2021Fix soonSomeone set up reporting and nobody read the reports. Spoofing is seen but not stopped.
Six licences assigned to former staffNice to haveTheir mailboxes still need a retention decision, but the seats can likely go.

Get the inside view

Email [email protected] or use the button. Tell us your firm name, staff count and platform, and we'll reply within one business day.

Request a checkupWhat happens next