What is DMARC, and does my practice need it?

DMARC is an email authentication policy that tells receiving email servers how to handle messages that appear to come from your domain but fail authentication checks. If your medical or dental practice sends emails to patients using its own domain, DMARC helps protect your practice against email spoofing and phishing. ObaShield helps configure DMARC, SPF, and DKIM to protect your domain and improve email deliverability.

What's the difference between SPF, DKIM and DMARC?

SPF identifies which mail servers are authorized to send emails on behalf of your domain. DKIM adds a digital signature to verify that an email is authentic and has not been altered. DMARC uses SPF and DKIM authentication results to help receiving servers decide how to handle unauthenticated emails. Together, these three protocols help protect healthcare practices against email spoofing and phishing.

Will this break our appointment reminders or patient portal emails?

ObaShield identifies the systems that send emails on behalf of your practice, including EHR platforms, patient portals, billing systems, and appointment reminder services. Email authentication is implemented in stages, starting with monitoring before moving to full enforcement. This helps ensure legitimate patient communications continue working without email downtime.

Do you sign a Business Associate Agreement?

Yes. ObaShield signs a Business Associate Agreement (BAA) before any work begins. This establishes the required responsibilities for handling protected health information when providing services to healthcare practices.

How long does it take?

The process starts with a free email security scan that takes about 60 seconds. After reviewing the results, ObaShield schedules a kickoff call of approximately 30 minutes to understand your email systems. The setup and enforcement process depends on the number of email services and domains involved. Protection is implemented gradually to avoid disrupting legitimate emails.

Will this help with our cyber insurance application?

ObaShield helps healthcare practices address common cyber insurance requirements, including multi-factor authentication and email authentication. We review security gaps, implement appropriate improvements, and provide documentation that can support your cyber insurance application. However, completing these improvements does not guarantee insurance approval.

We use Microsoft 365 or Google Workspace. Aren't we already protected?

Microsoft 365 and Google Workspace provide built-in email security features, but using these platforms does not automatically mean your domain has complete email authentication and security protection. ObaShield reviews your email configuration, sets up DMARC, SPF, and DKIM, strengthens platform security, and reviews multi-factor authentication to help protect your practice.

Doesn't our EHR or IT vendor handle this?

Your EHR or IT vendor may manage certain email services, but they may not be responsible for every system sending emails on behalf of your practice. ObaShield reviews all email-sending services, including EHR platforms, patient portals, billing systems, and appointment reminders, to identify and configure the necessary email authentication records.

What if the scan finds problems?

If the free email security scan identifies problems, ObaShield reviews the results with you during a quick call and identifies the systems sending emails from your domain. We then provide recommendations, configure the necessary SPF, DKIM, and DMARC records, and gradually strengthen protection. Monthly monitoring and reports help you understand your domain's email security status.

Email Security

Someone is sending emails as your business right now. Your clients can’t tell it’s not from you.

ObaShield is a certified cybersecurity firm delivering email domain protection, 24/7 threat monitoring, encrypted email, and compliance-ready security for small businesses, healthcare practices, federal contractors and Defense Industrial Base organizations.

ObaShield is a certified cybersecurity firm delivering email domain protection, penetration testing, and compliance-ready security for SMBs, federal contractors, and Defense Industrial Base organizations.

Email Authentication

Stop anyone from sending email as you.

Vulnerability Management

Find the weak spots before attackers do.

Firewall & Network Security

Keep threats out of your systems.

Compliance Advisory

Get ready for CMMC and NIST 800-171.

24/7 Threat Monitoring

Around-the-clock watch on your computers, email and accounts.

Encrypted Email

Encrypted email for your clients and patient information.

HIPAA Risk Assessment

The written risk assessment every practice is required to have. (Link to /healthcare-email-security/)

WHY IT MATTERS

ONE SPOOFED EMAIL CAN UNDO 20 YEARS OF CLIENT TRUST.

$2.77B

Lost to business email fraud in 2024

48 Days

To get your protection set up.

WHY IT MATTERS

ONE SPOOFED EMAIL CAN UNDO 20 YEARS OF CLIENT TRUST.

Billions

Lost to email fraud every year

48h

To get your protection set up

COMMON EMAIL SECURITY ISSUES

Is Your Domain Vulnerable?

Without proper email authentication, your messages can be spoofed, blocked, or marked as spam.
Here are the most common issues we find.

SPF Missing

Any server can send email pretending to be your domain. Your clients receive convincing fakes.

DKIM Missing

Your emails have no cryptographic signature. Messages can be intercepted and altered in transit.

DMARC Missing

No policy tells receiving servers what to do. Spoofed emails land directly in inboxes.

OUR SOLUTIONS

What ObaShield Delivers

We set up and manage the tools that keep your domain, your email, and your business safe.

SPF Record Setup

Strict enforcement so only authorized servers can send.

DMARC Policy Deployment

Step-by-step enforcement until spoofed emails are blocked outright

Domain Record Monitoring

Instant alerts if any of your email records break or change.

DKIM Key Generation

Cryptographic signing for every outbound email.

DNS Audit

Full review of all existing records before changes.

Monthly Reports

Delivery stats, DMARC data, and security health score.

The report every client gets on the 1st of the month

Technology Partners

We’re an authorized partner with the security and networking brands that large companies rely on. That means you get the same tools, set up and managed by us, at pricing you can actually work with.