What's in an email checkup

One record, listing every service that legitimately sends as you, ending in a strict rule, and within the 10 DNS lookups receivers will follow.

Signing turned on for every sending service, not only the main mailbox platform. Key length and rotation.

Whether the policy actually stops spoofing (quarantine or reject), whether reports go anywhere, and whether anyone reads them.

Signed DNS answers, and limits on which certificate authorities may issue certificates for the domain.

Mail routes where you think it does, with no leftover records pointing at an old provider or filtering service.

Other domains the firm owns (old names, .com versions, typo catches) and whether they are locked down so nobody can send as them.

Transfer lock, auto-renew, expiry date and the contact on file. Losing a domain to a missed renewal takes email with it.

Which account holds the registrar and DNS logins, whether it has MFA, and whether it belongs to the firm or to someone who left.

Every account that can sign in, including shared mailboxes with passwords, service accounts and the partner who "never logs in from anywhere else".

How many people hold global or super admin, whether admins use separate accounts, and whether an emergency access account exists and is protected.

Older protocols and app passwords that skip MFA entirely.

Mail forwarded outside the firm, and rules that hide, move or delete messages. Both are classic signs of a takeover.

Whether mailbox and admin activity is recorded, and kept long enough to answer "what did they see?" after an incident.

OneDrive, SharePoint and Google Drive links open to anyone, and files shared with personal accounts.

Which phones can sync mail, and whether the firm can remove its data from a lost or departing device.

Retention policies, litigation hold or Google Vault, and whether departed staff mailboxes are kept on purpose or by accident.

Which one is in place, and whether the policies match how the firm actually works. Conditional Access is reviewed only where it is licensed.

Seats compared with active staff, and edition by edition: does everyone need the same plan?

Licences on former staff, shared mailboxes that don't need one, and overlapping add-ons bought at different times.

Features already in your plan that would close a finding in this report, at no extra cost.

The specific gaps a higher edition would close, so a licence decision is made on findings rather than a vendor brochure.

Whether mailbox, OneDrive, SharePoint and Drive data is backed up somewhere other than Microsoft's or Google's recycle bin, where it lives, and how far back it goes.

Whether anyone is watching for impossible sign-ins, new forwarding rules and suspicious consent grants, and who gets the alert at 2 a.m.

Inbound filtering, impersonation protection, link and attachment scanning, and how external mail is marked.

A short look at the devices that sign in to email: managed or personal, protected or not.

How each finding lines up with what insurers commonly ask about MFA, backups and email security.

BC PIPA and PIPEDA require reasonable security arrangements for personal information. We show where email fits in that picture.

Regulators expect members to take reasonable steps to protect client information. The report gives you something concrete to point to.

A widely used baseline for smaller organizations, used as a yardstick so progress can be measured year to year.

Whether the firm has written acceptable use, AI use, incident response, MFA and password, and backup policies. KDTS can provide them.