SPF
Lists which mail servers are allowed to send email for your domain, so receiving servers can reject the rest.
Managed email hosting
Email hosting set up properly, then kept that way.
Microsoft 365 and Google Workspace, configured to enforcement from day one — DKIM, DMARC, SPF and Global Administrator hygiene — with an optional scoped remote subscription for the ongoing admin work that usually falls through the cracks.
Works with
What the setup project covers
- DKIM, DMARC and SPF configured and confirmed at enforcement, not just present in DNS.
- Global Administrator and break-glass access review, so no single account can lock out the whole organisation.
- MFA enforcement, security defaults and conditional access readiness (where the licence supports it).
- Mailbox, SharePoint, Drive and file-sharing governance, with controlled external sharing.
- Tenant ownership documentation and account recovery, written for whoever inherits it next.
Fixed price, quoted upfront
Setup is a fixed-scope project, priced after a short discovery conversation about your current tenant, domains and licensing — not an hourly bill that grows as the work goes.
Request a quoteMost business email still isn't authenticated properly.
SPF, DKIM and DMARC are free DNS records, but they're commonly left half-configured — present enough to tick a checklist, not enforced enough to actually stop a scammer from sending mail that looks like it came from you.
DKIM
Digitally signs outgoing mail, so a receiving server can tell if a message was altered or forged in transit.
DMARC
Tells receiving servers what to do when SPF or DKIM fail, and gives you visibility into who's sending mail as your domain.
Getting the records in place is one project. Watching the reports and safely moving DMARC to enforcement is ongoing work — see our monitored DMARC service.
The monthly subscription — a scoped alternative to a full retainer
Once the tenant is set up properly, some organisations want an ongoing hand rather than calling ad hoc every time something changes. The subscription is deliberately narrow — Microsoft 365 or Google Workspace administration, remote-only — not a general help desk retainer.
- Account requests — new starters, leavers, role and licence changes.
- Domain changes and DNS record management.
- Scheduled security reviews of the tenant, delivered as a plain-English report.
- Day-to-day Microsoft 365 or Google Workspace admin tasks as they come up.
Not a lock-in
It's a scoped subscription for one function, not an open-ended contract for everything IT. Cancel any time — see why this isn't a traditional MSP arrangement.
Ask about the subscriptionWe're not a provider that holds the keys forever.
Elevated Global Administrator access is time-boxed to the task at hand, then logged and removed rather than left standing between visits — whether or not the subscription is running. The tenant, its documentation and its administrator accounts stay yours.
Common questions about managed email hosting.
Do you provide onsite IT support, or is this all remote?
The work is remote-first by design — identity, email and cloud security don't need someone on-site to fix properly, and staying remote is part of what makes fixed-scope, upfront-quoted pricing possible. If you need hands-on desktop or hardware support, that's a good complement to run alongside an existing onsite provider or Townsville Computer Man, not a replacement for either.
Is the managed email hosting subscription a lock-in contract?
No. It's a scoped monthly subscription for a specific function — account requests, domain changes, scheduled security reviews and day-to-day Microsoft 365 or Google Workspace admin tasks, handled remotely — not an open-ended retainer covering everything IT. You can stop at any time, and because the scope is narrow and named upfront, it's simple to compare against what you're getting from any other provider.
What are DKIM, DMARC and SPF, and why do they matter?
They're DNS records that prove an email claiming to be from your domain actually came from a system you authorised. Without them configured properly, it's straightforward for a scammer to send a convincing fake email that appears to come from your business, your bank or a supplier — and your own outgoing mail is more likely to land in spam. Setting them up, then confirming they're enforced rather than just present, is part of every setup we do.
Do you keep Global Administrator access to our tenant permanently?
No. Elevated access is time-boxed and used only for the task at hand, then logged and removed rather than left standing. The tenant, its documentation and its administrator accounts are yours — we're not a provider that holds the keys forever, whether or not you keep the subscription running.
What does the scheduled security review actually check?
Each cycle produces a plain-English report on your Microsoft 365 or Google Workspace tenant — administrator accounts and access, MFA and sign-in activity, DKIM/DMARC/SPF status, mailbox and file-sharing exposure, and anything that's drifted since the last review. It's a working document, not a sales pitch for more hours — if everything checks out, the report says so.
Already had a tenant hygiene review? See Microsoft 365 and cloud security.
Get a quote for your Microsoft 365 or Google Workspace environment.
Tell us what you're running today and what's prompted the enquiry — a lockout scare, a new domain, or just wanting it done properly. We'll confirm fit before anything is quoted.
Request a quoteMicrosoft, Microsoft 365 and related marks are trademarks of the Microsoft group of companies. Google, Google Workspace and related marks are trademarks of Google LLC. Suburban Secure is not affiliated with, sponsored by, or an authorised partner or reseller of either company. Features depend on licence tier, domain configuration and existing tenant setup, and are confirmed before implementation.