KOVA OS · SHIELD
Know which services send using your domain, what needs approval and what remains unresolved. Shield records the agreed authentication work. Start with the free public-record check—not a complete security audit.
$750 one-time setup · One business domain · Up to three approved sending services
No mailbox password for the public check. No DNS changes without written approval of the exact plan.
Is Shield the right fit? Shield helps businesses review their own email domains and sending tools. A sending service is a platform—Microsoft 365, a CRM or an invoicing tool—not each employee mailbox.
Shield does not investigate compromised accounts, stop lookalike domains or fake display names, build bulk cold-email infrastructure, or guarantee inbox placement. Email authentication does not stop every phishing attempt or authorize a payment. Verify payment requests through a separate, trusted channel.
Ask whether Shield fits →WHAT THE CHECK SEES AND SETUP VERIFIES
Your IT provider retains control of access and publishes or approves changes through your process. We confirm scope and timing before work. Ongoing review is separate and optional.
See the setup scope →View the sample Shield Record →APPROVE THE CHANGE. KEEP THE RECORD.
FICTIONAL SAMPLE · REHEARSAL ONLY
The handoff records agreed senders, observations, approved changes, checks and open items. Ask: Which services were checked? What did the evidence show? Who owns unresolved items?
The sample uses example.com and invented senders to show the format. No live domain or message was tested, no DNS was changed, and no client received it.
Read the full sample →FICTIONAL SAMPLE: Monitoring-policy example; no live records checked.FICTIONAL SENDERS: Workspace; Client CRM.SAMPLE ONLY: No production DNS changes proposed.SAMPLE RESULT: Rehearsal only; live sender alignment not established.OPEN ITEM: Confirm scope and collect authorized test-message evidence.EXAMPLE: Prepared only; not delivered to a client. No access granted or revoked.Dated public-record observations before approved changes. The fictional sample contains no live domain evidence.
FICTIONAL SAMPLE: Monitoring-policy example; no live records checked.Representative scenario showing how a typical multi-sender environment can be structured: an initial observation finds a monitoring-only policy (p=none) alongside billing mail that needs alignment review. During a staged setup after access and written approval, approved sending sources can be mapped, exact changes reviewed before publication, and the policy advanced only when the agreed checks support it. Actual results and open items are then recorded in the client handoff.
DATED INTERNAL IMPLEMENTATION EVIDENCE
Historical public-record evidence from the date above. It does not prove every sending service works correctly, guarantee delivery, or show today’s settings.
Kova Shield is founder-led. Al Cirton is the named setup owner. Meet Al →
THE OFFER AND STRAIGHT ANSWERS
KOVA SHIELD SETUP · ONE-TIME ENGAGEMENT
$750 one-time
One business domain and up to three approved sending services, with the review, written approval, post-change checks and dated record described above.
Adding another sending tool creates another configuration to review. Ongoing review does not start automatically with setup. See setup scope and optional review →
Your setup owner: Al Cirton. Your IT provider keeps ownership and access. Changes require your written approval.
View the sample Shield Record →It shows the handoff format, not a customer result or live verification. Results and open items are recorded for the agreed work.
Clear limits on the public check, the setup work, and what still belongs with your IT provider.
Read how Shield works →A sending service is a tool or platform sending messages using your domain, such as Microsoft 365, a CRM or invoicing service—not each employee mailbox. We confirm the included services before work.
No. SPF, DKIM and DMARC help participating mail systems evaluate messages using your exact domain. They do not stop lookalike domains, compromised accounts, fake display names or social engineering. Keep payment verification separate from email authentication.
No. Your IT provider retains ownership and access. Shield handles the agreed sender inventory, proposed authentication changes, checks and record alongside them. Changes require written approval of the exact plan.
Yes—if they inventory senders, review authentication, check representative messages and document changes and open items. Ask what they cover before adding another service. Compare scope and evidence, not green results or record counts.
No. Authentication is one factor. Reputation, content, recipient behavior, filtering and sending practices also affect delivery.
It asks participating receiving systems to quarantine or reject messages that fail DMARC alignment. Receiving systems make the final handling decision. A published policy alone does not prove that every legitimate sender passes or that every message is safe.
Estimated 3–7 business days after required access and written approvals. DNS propagation, third-party sender verification and observation may extend timing; this is not a promise of full DMARC enforcement in that window.
The public check needs no login. For setup, your DNS administrator or IT provider can publish approved updates directly, or arrange appropriate least-privileged access. Do not send mailbox passwords, recovery codes or private keys through an inquiry.
Run the free public check. If you need help interpreting the next step, ask Al about the domain.
Baseline review scope and price are confirmed before work. An inquiry takes no payment and authorizes no DNS change or subscription.