The Threat Real Incidents Compliance Floor Industry Compliance Our Tools Check My Domain Who This Is For Founder FAQ Get an Assessment →
Top The Threat Real Incidents Compliance Floor Industry Compliance Tools Check Domain Who It's For Founder Assessment FAQ
Check Domain Get Assessment →
The inbound arm of a dual-brand MESP

The 36-point gap between "DMARC implemented" and actually protected.

78% of domains have a DMARC record. Only 42% are at enforcement. Just 9% have actually moved to p=reject. The hawk closes that gap — domain by domain, all the way to 100% authentication.

Your domain name is your firm's reputation made digital. When it's spoofable, that reputation belongs to anyone.

Live · Global Enforcement Rate

Domains at DMARC enforcement (p=reject or p=quarantine)

0%
0% → 100% AUTHENTICATION

0%

AT P=REJECT (FULL PROTECTION)

$0B

BEC LOSSES, FBI IC3 2024

Source: Valimail 2026 State of DMARC Report (Feb 2026) · EasyDMARC 2026 Adoption & Enforcement Report · FBI IC3 Annual Report 2024.

Our mission

Get every domain we touch to p=reject. Not "monitoring." Not "quarantine." Reject. Your clients don't trust their inbox — they trust your domain name. When a spoof clears the inbox claiming to be from you, that trust is what gets spent.

The cost of inaction

BEC isn't a hypothetical. It's a line item on someone's quarterly loss report — every quarter.

FBI IC3 · Reported BEC Losses · 2024

What U.S. businesses lost to business email compromise in a single year.

$0B

0

BEC COMPLAINTS FILED

$0B

TOTAL 2022–2024

$0M
Right here at home · Maryland, 2024 Lost by Maryland businesses just like the small law firms and accounting practices we serve. The federal number is the headline; this one is the neighborhood.

And the wire transfer is just the visible loss.

Every successful spoof of your domain is a withdrawal from a reputation account that took years to build. The next legitimate email from your firm gets read with a fraction of a second of hesitation that wasn't there before — multiplied across every client inbox, that's the cost nobody puts on the IC3 report.

BEC is the second most profitable scam in cybercrime. It doesn't need malware, exploits, or sophisticated infrastructure — just a spoofed "From" address and someone moving fast.

DMARC at p=reject stops domain spoofing at the inbox. Without it, your domain is a free-to-use tool for impersonators targeting your clients, your vendors, your staff.

Sources: FBI IC3 Internet Crime Report 2024; PSA I-091124-PSA. As of April 2025.

Real incidents · Public record

The receipts are public. Each of these started with a spoofed or compromised email a properly-enforced DMARC posture would have made significantly harder.

The compliance floor keeps rising

Mailbox providers stopped asking. They started enforcing.

For two decades email authentication was a "best practice." In the last 24 months it became a market access requirement. Here's where the floor is now — and where it's going.

Feb 2024 · Google & Yahoo Bulk Sender Mandate

DMARC required for bulk senders to Gmail and Yahoo Mail.

Senders pushing 5,000+ messages per day to Gmail or Yahoo were required to publish a DMARC record (p=none minimum), align SPF or DKIM, and honor one-click unsubscribe. Non-compliance meant deferrals and outright rejection.

May 2025 · Microsoft Outlook / Hotmail

Microsoft followed suit on consumer mailboxes.

Microsoft applied bulk-sender authentication requirements to Outlook.com, Hotmail, and Live properties — closing the last major gap where unauthenticated bulk mail could still land in inboxes.

Nov 2025 · Gmail Hard Reject

Gmail escalated from soft warnings to active rejection of non-compliant mail.

Per Google's reporting, sender requirements have already driven a 65% reduction in unauthenticated messages reaching Gmail — roughly 265 billion fewer unauthenticated messages in 2024 alone.

2026 → Forward

The conversation has shifted from "do you have DMARC" to "is it enforcing."

The Valimail 2026 report shows enforcement plateauing at 42%. That plateau is where attackers are camping. Closing the 36-point Enforcement Gap is now a competitive trust signal — and a regulatory tailwind for industries with explicit duties of care.

Compliance, by industry

Your professional rules already require you to do this. We just make it operational.

Domain authentication is not a technical curiosity. For attorneys and CPAs, the rules of professional responsibility and applicable safeguards regulations have been pulling in this direction for years. We translate the rule into the DNS record.

Law Firms

ABA MODEL RULES OF PROFESSIONAL CONDUCT

Confidentiality and competence aren't optional, and the ABA's formal opinions have been clear since 2017: technological competence is a duty, not a virtue. DMARC enforcement maps directly to three rules.

  • Rule 1.1 CompetenceIncluding the duty to keep abreast of changes in the law and its practice — explicitly including the benefits and risks of relevant technology (Comment 8).
  • Rule 1.6 Confidentiality of InformationRequires reasonable efforts to prevent inadvertent or unauthorized disclosure of client information. A spoofable domain is not a reasonable effort.
  • Rule 1.15 Safekeeping PropertyTrust account wire fraud — particularly in real estate closings — is one of the most active BEC vectors. Authentication directly safeguards client funds in motion.
  • MD PIPA Maryland Personal Information Protection ActRequires "reasonable security procedures" for personal information held by businesses operating in Maryland. Domain authentication is part of a defensible posture.

CPA Firms

IRS · FTC SAFEGUARDS · PCI DSS

Tax preparers are explicitly named in federal information security obligations. The rules are not aspirational — they are referenced by examiners, by insurers, and by the IRS itself.

  • IRS Pub 4557 Safeguarding Taxpayer DataThe IRS's required information security program for tax professionals includes specific guidance on email authentication and protecting client communications from impersonation.
  • FTC Safeguards 16 CFR Part 314The amended FTC Safeguards Rule requires written information security programs for financial institutions — which the FTC defines to include CPA firms preparing tax returns.
  • PCI DSS v4.0 Where Card Data Touches EmailFor any practice handling card payments or processor communications, v4.0's anti-phishing controls (Req 5.4) explicitly reference email authentication mechanisms.
  • MD PIPA Maryland Personal Information Protection ActState-level reasonable-security requirements that apply to any practice handling client tax records, SSNs, or financial information in Maryland.
The Hawk's Toolkit

Forensic-grade analysis. Built in-house. No black boxes.

Most "email security" products are licensed scanners with a UI bolted on. The hawk's tools are purpose-built around the way real BEC investigations actually work — header forensics, alignment analysis, and policy posture, in language a partner can hand to a client.

Methodology

The Save Play.

The path from "no DMARC" to p=reject is not a switch you flip. There's a name for the disciplined sequence we use to get there without breaking a single piece of legitimate mail.

We watch every IP that sends as your domain. We map every legitimate sender. We move methodically through the policies. The hawk is patient — because you can't afford for us to be reckless.

1
Observe — p=none Aggregate reports flow into DMARCHawk. Every legitimate sender gets identified.
2
Squeeze — p=quarantine Turn the screw without breaking the bottle. Watch what changes.
3
Close the gate — p=reject Full enforcement. Spoofs die at the doorstep.
Live domain check · DNS-over-HTTPS

Where is your domain right now?

Enter any domain. We'll pull its actual DMARC and SPF records from public DNS in real time and tell you, in plain English, whether you are protected, partially protected, or wide open.

?

Domain
DMARC
Policy
SPF
Reporting

Want a forensic-grade write-up of your full posture?

Request an assessment →
Who this is for

Built for the firms most exposed and least served.

The enterprise market has dozens of email security vendors fighting for a seat at the table. Small law firms and CPA practices have… a few generic MSPs who handle email as one of fifty services they touch lightly. The hawk was built specifically to close that gap.

  • Small law firms · 1 to 25 attorneys Where every client communication carries trust and every wire transfer is a target.
  • CPA practices · Under 50 employees Tax season is BEC season. The IRS is watching. So are attackers.
  • Professional services · Baltimore & the DMV Local. Reachable. Same time zone. Same threat landscape.
  • Email-dependent businesses without in-house security If a phishing or spoofing incident could cause six-figure financial harm or career-ending reputational damage — and you don't have a CISO — you are the audience.
Founded by

Andre Milligan

Founder · Operator · Baltimore, Maryland

A career sysadmin and managed services professional in the Baltimore area. Andre built and deployed TracerHawk — and the operational architecture that powers it — as a working production system before incorporating the company that operates it.

The architecture, methodology, and tooling are his own. The vision is to bring enterprise-grade email infrastructure intelligence to the small business market that has historically been priced out, talked down to, or ignored entirely.

You will not be passed to a junior account manager. You will work directly with the operator who built the platform.

Free posture assessment

Get the hawk on your side.

A no-cost, no-obligation assessment of your current DMARC, SPF, and DKIM posture and a written report — the same report we'd hand a managing partner. No sales theater, no scare tactics. Just a clear-eyed read on where you are and what it would take to get to p=reject.

  • Full DMARC, SPF, and DKIM record analysis
  • Industry-specific compliance mapping (Rule 1.6, IRS Pub 4557, MD PIPA, etc.)
  • Forensic write-up suitable for leadership or insurance
  • A concrete Save Play remediation plan with sequencing
  • Direct line to the operator — no junior account managers

↳ Goes directly to the operator. We don't sell, share, or syndicate this data.

✓ Got it. We'll be in touch within one business day from a real human at the InboxHawk operator address.
Frequently asked

Questions we get every week from partners and IT directors.