Email authentication
SPF flattening, per-stream DKIM keys, staged DMARC from p=none to p=reject, plus BIMI groundwork once alignment holds.
Poughkeepsie, New York · Serving the U.S. since 2016
Business email that arrives — every message, every morning.
Hudson Relay Systems designs, migrates and looks after the mail infrastructure that small and mid-sized American companies run their day on. Authentication, routing, retention, monitoring — handled by named engineers who answer the phone.
0Years in operation
0Domains under management
0Median inbox placement
0Average first response
SPF / DKIM / DMARC alignmentMicrosoft 365 tenant migrationPostfix & Dovecot hardeningIP & domain warm-upBounce and complaint triageGoogle Postmaster monitoringTLS-RPT & MTA-STScPanel & WHM mail serversJournaling and archive retentionBlocklist delistingInbox placement testingBackup MX and queue failoverSPF / DKIM / DMARC alignmentMicrosoft 365 tenant migrationPostfix & Dovecot hardeningIP & domain warm-upBounce and complaint triageGoogle Postmaster monitoringTLS-RPT & MTA-STScPanel & WHM mail serversJournaling and archive retentionBlocklist delistingInbox placement testingBackup MX and queue failover
Why owners call us
Email breaks quietly. We make it loud, then we make it stop.
Most companies discover a mail problem the way our clients used to: a customer says "I never got your invoice." By then the damage is three weeks old. We install the plumbing and the alarms — correct SPF, DKIM signing on every stream, an enforcing DMARC record, reject/defer alerting, and a weekly report a non-technical owner can actually read.
- A written baseline of your current mail estate within five business days
- Authentication fixed at the DNS level, with rollback notes for your registrar
- Migrations executed after hours so no one loses a workday
- Plain-English reporting — no dashboards you have to be trained on
Core services
Six things we are asked for most
Every engagement starts with an audit. Where it goes next depends on what the audit turns up — and on what you actually need, not on what fills a retainer.
Migrations & cutovers
On-prem Exchange, cPanel, Zimbra or Google Workspace into Microsoft 365 — or the reverse. Mailboxes, calendars, aliases, public folders.
Mail server administration
Postfix, Dovecot, Exim and WHM/cPanel estates: patching, queue health, rDNS, TLS, rate limits and backup MX.
Deliverability recovery
Blocklist delisting, complaint-loop enrolment, seed-list placement testing and a documented sender reputation plan.
Security & compliance
Phishing-resistant MFA rollouts, journaling, legal hold, retention policies and quarantine review workflows.
Managed monitoring
24/7 queue, DNS and certificate watch with an on-call escalation path for retainer clients.
How an engagement runs
Four steps, no surprises on the invoice
We quote fixed fees for scoped work. Retainers are month-to-month after the first term. Nothing auto-renews without an email you have to answer.
Fixed-fee auditsMonth-to-month retainersNo lock-inU.S.-based staff
Discovery call
Thirty minutes on the phone with an engineer, not a salesperson. We ask for your domain and read your public DNS live.
Written audit
A 10–18 page findings document: what is broken, what is risky, what is fine. Yours to keep either way.
Remediation window
Scheduled changes with a rollback plan. Cutovers run evenings or weekends at no premium.
Ongoing watch
Weekly digests, monthly review call, and an on-call number if a queue backs up at 2am.
Who we work with
Small teams with grown-up email problems
Professional services
Law firms, accountants and consultancies that must prove a message was sent, received and retained.
Healthcare & dental
Practices needing encrypted transport, retention rules and staff phishing training on a modest budget.
Regional retail & e-commerce
Order confirmations, shipping notices and receipts that cannot land in a promotions tab.
Nonprofits & municipalities
Grant-funded organizations that need documentation, not jargon, for their board.
“We had three years of invoices quietly bouncing at one large customer. Hudson Relay found it in the first audit call and had DKIM signing correctly by that Friday.”
“The migration ran Saturday night. Monday morning nobody in the office noticed anything had changed, which is exactly what I paid for.”
“Angela's team explains things without making you feel stupid. Our board finally understands why the mail server matters.”
The audit, in detail
What lands on your desk after week one
| Checked | What you get |
|---|---|
| DNS & authentication | SPF lookup count, DKIM selectors per stream, DMARC policy and reporting endpoints |
| Reputation | Blocklist status across 40+ public lists, complaint-loop coverage, Google Postmaster grades |
| Transport | TLS versions and ciphers, MTA-STS policy, TLS-RPT, reverse DNS and PTR alignment |
| Mailbox estate | License waste, shared vs. user mailboxes, forwarding rules, orphaned aliases |
| Continuity | Backup MX, queue thresholds, retention windows, restore test results |
| Risk register | Findings ranked critical / high / advisory with an estimated hours figure for each |
Common questions
Before you call
How quickly can you start?
Audits usually begin within three to five business days of a signed scope. Emergency deliverability work — an active blocklist or a mail outage — is triaged the same business day where capacity allows.
Do you work outside New York State?
Yes. Roughly two thirds of our clients are outside the Hudson Valley. All work is delivered remotely; on-site visits are available within a two-hour drive of Poughkeepsie.
Do you resell hosting or licenses?
No. We are vendor-neutral and take no commission from any platform. You buy your licenses directly and keep the relationship.
What does an audit cost?
A single-domain baseline audit is a fixed $650. Multi-domain and multi-tenant estates are quoted after the discovery call. See our pricing page for the full breakdown.
Will you talk to our existing IT provider?
Gladly. A large share of our work arrives through MSPs who want a specialist for the mail layer without handing over the whole account.
Find out what your domain looks like from the outside
Thirty minutes, no cost, no obligation, no sales script. We read your public records with you on the line and tell you plainly whether anything needs doing.