Exchange Online is the service behind every mailbox in Microsoft 365. It delivers your email, stores it and protects it. Just as important: it proves to the rest of the world that an email from your domain really came from you. ECSG configures Exchange Online, the domain records that authenticate your email (SPF, DKIM and DMARC) and the policies that keep mailboxes secure.
Your team reads email in Outlook — on a computer, a phone or a browser. Behind it, Exchange Online stores every message, delivers mail, applies rules and enforces security. Configure the engine well and every app on top of it works better.
The app for reading, writing and organizing email, calendars and contacts. See Outlook 365 →
The front endMailboxes, shared mailboxes, archiving and retention, mail flow rules, anti-spam and anti-malware filtering, and sign-in policies.
The engineEmail was invented without a way to prove who sent it. That's why anyone can try to send a message that looks like it came from your CEO or your accounts department. These three DNS records close that gap — and they're now required by major providers like Google, Yahoo and Microsoft for bulk senders.
Lists the servers authorized to send email for your domain — Microsoft 365, your email security gateway, your marketing tool. Anything else fails the check.
Every outgoing email is digitally signed. The receiving server checks the signature against a public key in your DNS to confirm it's authentic and untouched.
Tells receiving servers to deliver, quarantine or reject email that fails SPF and DKIM — and sends you reports about who is sending as your domain.
Jumping straight to "reject" can block legitimate email from tools you forgot about. We take every domain through a careful path.
DMARC starts in monitoring mode (p=none). Reports show every service sending email as your domain.
Discover all sendersOnce legitimate senders are authorized, failing messages are sent to spam or quarantine.
p=quarantineFake email using your domain is rejected outright — before it ever reaches a client's inbox.
p=rejectResult: your clients and vendors can trust that email from your domain is really from you.
Every Microsoft 365 mailbox includes Exchange Online Protection. With Business Premium, Microsoft Defender for Office 365 adds deeper protection. We configure both — and where needed, add Proofpoint in front for an extra layer.
Spam, bulk mail and known malware are filtered for every mailbox, with policies tuned to your business.
Detects emails pretending to be your executives, your domain or your key partners.
Links in email and Office documents are checked at the moment someone clicks, not just when the email arrives.
Suspicious attachments are tested in an isolated environment before they reach the user.
If a delivered email is later identified as malicious, it's automatically pulled from mailboxes.
Messages from outside the company are clearly marked, so impersonation attempts stand out.
Layered email security: for clients who need more, Proofpoint filters email before it reaches Microsoft 365, and our 24/7 SOC watches for compromised mailboxes. See Email Threat Protection →
When attackers get into a mailbox, they usually hide: forwarding rules, deleted alerts, quiet monitoring of invoices. These settings make that much harder — and much easier to detect.
Attackers can't silently copy every email to an external account.
Old, insecure email protocols are disabled, so every sign-in goes through MFA.
Access and changes to mailboxes are logged, so investigations have evidence.
New inbox rules that hide or forward email are flagged by our 24/7 SOC.
Archive mailboxes and retention policies keep important email for as long as you need it.
Sensitive messages can be sent encrypted to anyone (with the right Microsoft 365 plan).
Very often because SPF, DKIM or DMARC are missing or misconfigured — especially when you also send email from other tools like a CRM or marketing platform. We review your records and fix them.
Without DMARC enforcement, yes — it's one of the most common tricks behind invoice fraud. With SPF, DKIM and DMARC set to quarantine or reject, those fake emails are blocked.
Exchange Online Protection and Defender for Office 365 provide solid protection. Proofpoint adds a dedicated, specialized layer in front of Microsoft 365. We recommend the right combination based on your risk and budget.
No, when it's planned correctly. We review every service that sends email for you before tightening any policy, and changes are made outside business hours.
Storage depends on the Microsoft 365 plan, and archive mailboxes can add more space. We'll confirm the limits for your licenses and set up archiving when needed.
We'll check your domain's SPF, DKIM and DMARC records and your mailbox security settings, then explain in plain language what's missing and how we'd fix it. No obligation.
Secure. Reliable. Human.
Check My Domain