Mailprotector

One week from today our team will be at MSP Summit in Orlando, FL 😎

Christopher Hall, Jonathan Hathaway, and Kate Schlarf will be there and ready to talk all things with the MSP community.

If you’re looking to stop email threats, minimize inbox noise, and deliver better protection to your clients, come see us at Booth 808.

📅 September 28-30
📍 Orlando, FL
🎯 Booth 808

Stop by and see how Mailprotector is helping MSPs rethink email security with a Zero Trust approach.

Calling all Atlanta MSPs, class is almost in session 🎒📚

On September 23, our team is heading to Atlanta for MSP Back 2 Skool with Empath, a hands-on workshop built for MSP leaders who want to turn all those “So… what should we actually be doing with AI?” client conversations into something useful.

The session will be covering:
📚 Better AI conversations with clients
🧠 Real business problems worth solving
🗺️ A practical 30/60/90-day roadmap
💰 A repeatable motion your MSP can actually take to market

You’ll even work through the day with a real client or prospect in mind, so this isn’t eight hours of taking notes you’ll never look at again.

The best part? It is absolutely free for MSPs to attend. You just have to show up.
📍 City Winery Atlanta
📅 September 23

Grab your seat: https://hubs.la/Q04xHvJ60

What are the advantages of DMARC, and why does this even exist? It builds on SPF and DKIM authentication, because it's filling that gap of the spoofing and impersonation that we often see with the 'from address', which is what a user is going to see in their email client.

This helps everybody's domain create a bit more trust, and it makes it harder for bad actors to spoof or impersonate, because now we're connecting that 'from address', that 'display address', to the actual authentication that's done by SPF and DKIM.

The main thing to remember about DMARC is that it isn't looking at the envelope sender, the address SPF checks. It's looking at the domain in the 'from address', the one that shows up in the email client, and comparing that against the sending domain's DKIM and SPF checks for alignment.

Most impersonation and spoofing attempts start with a name the user recognizes. You open Outlook, or whatever client you're in, and the message looks like it's from John Doe. Behind the scenes in the header, the envelope sender could be someone else entirely.

Say the from address is Widget Company. John Doe works there, so when I get a message from John, I trust it. What DMARC does is check that story. The envelope sender is coming from Widget Company, so it aligns against the SPF record, the server it came from. DKIM confirms the message wasn't altered between the sender and the recipient. Everything lines up, and the message passes the DMARC check.

The envelope sender and the 'from address' displayed in their email client can be different. Attackers bank on it, and DMARC is there to prevent that as much as possible.

Watch the full episode "A Closer Look at DMARC" with our VP of Support, Mark Glowacz: https://hubs.la/Q04xBxtT0

Are you a chicken?

In Ybor City that's a protected status. The feral flock roaming those streets descends from birds the cigar workers kept in the 1880s, they're covered by city ordinance, and there's a volunteer group that looks after them. You cannot legally chase one.

Ten minutes from there, CyberFOX has the SecureIT Summit on September 9 and 10. Keynotes, boardroom sessions, networking, a yacht party. Should we keep going?

We'll be in the rotation. Bring your worst email security question, unless you're a chicken.

https://hubs.la/Q04w8yfm0

What breaks SPF records most often in real environments?

Most of the time, it’s emails sent by systems people forget about.

Marketing platforms, CRMs, ticketing systems, scan-to-email devices, voicemail systems, and other transactional services all send mail. If those aren’t included, SPF fails.

Another common issue is DNS sprawl. Too many include statements can push the SPF record past the DNS lookup limit and invalidate it.

And finally, SPF isn’t a set-it-and-forget-it record. When tools change, SPF has to change with them.

This webinar series helps put the email security pieces together: https://hubs.la/Q04w7qtw0

Just-in-time phishing is here, and it's changing email detection.

AI made it cheap to generate a phishing message for one person, use it once, and adapt every follow-up to the target's replies.

Just-in-time phishing is an attack in which an AI system generates each message at the moment of use, specialized to one target and the context accumulated so far.

Each message is a single-use artifact, and the next one can be produced at a low, roughly constant marginal cost. With an AI agent running the exchange, every reply becomes context for the next decision and message.

That definition has four requirements:

1. The message is generated after the attacker selects the target and context.
2. Its content is specialized to observations about that target.
3. The content is intended for one use rather than distribution as a stable campaign template.
4. Producing another specialized message has a low, roughly constant marginal cost.

The useful parallel to a just-in-time compiler is timing. An ahead-of-time attack commits to its artifact before it encounters a particular target. A just-in-time attack waits for target-specific inputs, then produces an artifact specialized to them.

A reply supplies more information. The generator can use it to correct a bad assumption, match the target’s vocabulary, or choose the next request. The two screenshots show that progression. The first message seeks only a response. Once the target responds, the second can introduce a link inside a conversation that now feels expected.

An AI agent can automate that loop. It can watch for a reply, add the new message to the target’s context, decide whether to continue or change approach, and generate the response. The attacker does not have to return to the model and write a new prompt for every turn. The patience that once made a conversational attack expensive can now be built into the workflow.

The analogy stops there. “Just in time” describes when the attack content is produced, not every detail of how a compiler works. Bulk templates will remain useful when speed and predictable output matter more than specialization.

Why an email security company is starting an engineering blog? Mailprotector has been doing email security for more than 25 years.

In that time we’ve accumulated the kind of knowledge that doesn’t show up in product docs. This blog is where we move that knowledge into the open. https://hubs.la/Q04w74gk0

Nobody writes a 5-star review about a search bar.

But a Shield user just did. Buried in the middle of a G2 review about blocking spam and malicious mail, they called out Spotlight for one reason: it finds the email wherever it landed, whatever folder it went to.

You have lived the other version of this with ten places checked, a Message Trace running slow in another tab, and a client waiting on you to say where their email went.

Techs tell us they go to Spotlight first and only run a Message Trace if the timeline comes up short. Better yet, your client can run the same search without calling you.

Not all email security is created equal. Check out more standout features you get with zero trust email security: https://hubs.la/Q04w6G_-0

An email security outage that drags on for days will make any MSP reconsider their whole stack.

Luis Alvarez, of Alvarez Technology Group, Inc., switched after living through one:

"We were using a different email security system. It failed, causing an outage for close to 10 days. We were scrambling to change MX records to just send unfiltered emails so our clients could still send and receive. That's when we said we're done, we need to find an alternative. We found Mailprotector and we love it, especially Bracket, the email encryption system, which our clients love. Super easy to use."

Clients love it when they don't have to think about encryption. Put brackets around the subject line to send. That's it.

See how it works with this interactive demo: https://hubs.la/Q04w6vwb0

You and your party are on a quest.

The king has tasked you with escorting a few golden geese from one city to another. Halfway through the journey, three guards stop you on the road.

Orders of the king, they say. Hand over the geese and they’ll make sure they’re delivered safely.

Do you trust them?

Drop everything you're doing, roll the dice and play along with our new blog titled "What Dungeons & Dragons Can Teach Us About Zero Trust Email Security" written by Christopher Hall, Partner Success Specialist at Mailprotector.

https://hubs.la/Q04tBxD30

Thank you MSPGeek Inc. for the feature!

What’s the safest DMARC policy to start with so you don’t break all things email?

If you’re just getting started, p=none is usually the safest move.

That puts DMARC into monitoring mode. Mail still flows, but you get visibility into where messages are coming from and whether SPF and DKIM are aligned. Once you understand all the sending sources, you can decide whether to quarantine or reject.

Most DMARC problems happen when policies are tightened before that visibility exists.

If you're still wrapping your head around all things , we cover the basics here: https://hubs.la/Q04tB6St0