Steve Galloway - Comstat | Ruthin, North Wales

2025 Email Security Guide for Business Owners: Avoiding Scams and Attacks

by Steve Galloway | Aug 8, 2025

The Hidden Dangers of Business Email in 2025

Email remains a vital tool for business communication. But in 2025, it’s also a growing target for cybercriminals. From phishing scams to AI-powered fraud, threats are evolving fast. Let’s explore what business users need to watch out for—and how to stay safe.

Click on the headers below to find out more about email Inbox threats. Click on inmages to view at full-sized resolution.

Phishing Scams: Smarter, Sharper, and More Targeted

Phishing is no longer about mass emails with poor grammar. Today’s scams are precise and convincing. Attackers use generative AI to craft messages that mimic real people and companies according to Threatlabz. These emails often target HR, finance, and payroll teams—where sensitive data and money flow.

The only way to tell that this evidently legitimate email from Microsoft is a hoax was to hover over the “verify payment information” link to see that the link was not a valid Microsoft end point.

Key tactics include:

Voice phishing (vishing): Scammers impersonate IT support over the phone.
CAPTCHA-protected phishing sites: These look legitimate and bypass basic security.
Crypto wallet scams: Fake alerts trick users into giving up credentials.

Threatlabz goes on to say that even education sectors are under attack, with phishing up 224% in 2024. The goal? Steal data, money, or access to systems.

AI-Powered Fraud: A New Era of Deception

AI is changing the game. It helps scammers build fake websites, clone voices, and create deepfake videos [2]. These tools make fraud faster and harder to detect.

Common scams include:

• Fake job offers: AI-generated listings lure applicants into sharing personal info.
• E-commerce fraud: Entire storefronts are built with fake reviews and products.
• Tech support scams: Attackers pose as IT staff to gain remote access.

Microsoft reports that AI tools are being used to scan the web for company data. This helps attackers create highly personalized lures.

Summary

Customizing folder colours is a great way to help you and others find content easily, especially in large folder lists. Remember, you can also “favourite” a folder to help find your content faster.

Changing a folder’s colour in OneDrive will only be visible to you.

Changing a folder’s colour in Sharepoint will be visible to users who you share it to.

Since Teams stores folders and files in Sharepoint, Teams administrators can change folder colours by opening a Teams’ file library using <View in Sharepoint>.

Lastly, Sharepoint’s broader capabilities means that advanced users can automate folder properties including folder colours.

Business Email Compromise (BEC): The Silent Threat

BEC attacks are rising. These scams involve impersonating executives to request wire transfers or sensitive data according to Socium. AI helps attackers mimic writing styles and internal workflows.

Watch out for:

Lookalike domains: Slight changes in email addresses trick employees.
Predictive phishing: AI analyzes past emails to time attacks perfectly.
Urgent requests: Messages often pressure staff to act fast without thinking.

BEC is costly and hard to detect. It’s one of the most damaging threats facing businesses today.

How to Stay Protected

Cyber threats are evolving, but so are defenses. Here’s how to stay ahead:

Use multi-factor authentication (MFA) across all platforms.
Train employees regularly with phishing simulations.
Deploy AI-powered email filters to catch suspicious content.
Secure mobile devices against smishing and app-based attacks.
Consider enhanced security like Conditional Access, which limits access to approved devices.

Zero Trust principles and advanced threat detection tools are key. They help limit damage even if an account is compromised.

Summary

Email threats in 2025 are smarter and more dangerous than ever. AI is helping attackers craft believable scams that bypass traditional defenses. But with awareness, training, and the right tools, businesses can fight back.

It is difficult to explain the catastrophinc effect that a professional hack on a business has. Even with resources that companies like Marks & Spencer have, a well executed hack brings enormous costs and losses to bear. Worryingly, high profile hacks are only the tip of the iceberg – small business statistically bear the brunt of hacks than any other business class. Nor is it business that any IT professional wants to have to take one. Usually, this is because it was avoisdable in the first place. Talk to us first.

About ComStat.uk: Internet Service Provider Comstat provides IT support, web hosting, and media services including web design, Microsoft 365 setup, and audio/video production, serving businesses across Denbighshire, North Wales and Wirral from Ruthin, and Lancashire and the Northwest from Bolton.

Safeguard your .uk domain names – Nominet

by Steve Galloway | Aug 4, 2025

Register an account with Nominet

Your domain name is a critically important part of your online services and your business identity. Your domain name is how customers find and trust you online. It is the jigsaw piece that has to work every time someone needs to see your website or send you an email. So, your domain name is strategically vital to your visibility and daily operations.

Click on the headers below to learn how to use a Nominet account to tighten control of your .uk domain names. Or, skip the sermon, and access Nominet Online Services here.

Compliance

UK businesses like yours are responsible for protecting personal data under statutory GDPR provisions. If your domain name is registered through a third party (like a web designer or IT supplier), and you do not have direct access to your domain name’s control panel, you do not know that your registration details are accurate. When you bought a domain name, were you even thinking about legal title? This can lead to compliance issues.

Ownership versus administrative control

There are good reasons why owners do not have daily access to your domain name. Domain names are like phone books which direct traffic to the services you need to operate. For instance, email might operate from Microsoft 365, and your web site operates from a server based at Canary Wharf, London. Your domain name controls this, and inadvertant edits to your records could catastrophically disrupt your services. Even a missing period or full stop could take your IT services down. So, unless you are expert in one of IT’s trickiest technologies – DNS – you need to rely on someone who is.

Most owners give administrative custody to consultants at Registrar level, but do not secure their overriding rights at Nominet. This is a critical risk.

So, you still need someone you trust to operate your domain name as if they are owners. That entity is called the administrative contact. Usually, though, businesses just give their IT support the ownership credentials. That is OK if you trust your IT supplier like you might trust your lawyer. Even so, you need a back door so that you have a trump card to change admin or transfer the domain name to another registrar. It is not really a matter of trust. An IT supplier might fail. A malicious hacker might gain access to your domain name with the intention of holding you to ransom.

Nominet provides independant access to owners

Nominet is the not-for profit organistation which governs the operation of .uk domain names – about 10 million domain names at time of writing. You can buy directly through Nominet, however the organization prefers to delegate daily conduct of new registrations, transfers and renewals to registrars like GoDaddy, TuCows, Enom, OpenSRS, Joker.com and many more. You probably have not heard much about Nominet and that is probably a tribute to its well regarded operations worldwide.

You probably had an email from Nominet when you bought your domain name asking you for some information. In most cases, we find that this email is ignored. Partly, this is because you might not know who Nominet is. Partly, because the domain name bears such an insignificant cost, the effort to seal loopholes seems pointless.

Access Nominet Online Services here.

Protect Your IT assets

Take advantage of ownership privileges

Registering an account at Nominet helps you clarify legal title and other information that was not properly recorded at point-of-sale. For instance, Nominet might list you as owner because you had to use your name and address to get a credit card to work. However, the domain name should really be the property of a limited company. Owner information is legally binding, so seemingly small details which can cause problematic and costly issues at law in future.

Also, although you have to delegate daily management of your domain names to an IT expert (unless you have a professional IT department), you can still exercise control as owner. If you do have this kind of control, then your IT experts can pass custody of your domain name to other registrars who might provide better tools for features that you need. Or, if someone hacks your registrar account and hijacks your domain name, you can resort to Nominet to recover control.

This security is overlooked to a worrying degree. Even organizations that puport to be fastidious about IT policy and GDPR rarely act to secure one IT asset which can cause catastrophic damage to online services.

Nominet Online Services

Nominet has a facility for that protects your global ownership for .uk domain names – Nominet Online Services.

Nominet’s online portal allows you to associate domain names that you own with your Nominet account which provides a haven of last resort in situations where a supplier fails, or a malicious entity attempts to hijack ownership of the domain, or other force majeur problems. By associating your domain name with your own Nominet account, you can manage your data directly and ensure its handled in line with GDPR requirements. Really, GDPR is not about penal legislation. Rather, GDPR is a framework to help you document what is common sense in the first place.

This kind of control is essential for business continuity and peace of mind. Access Nominet Online Services here.

Link Your Domain to Your Nominet Account

Take Action

If you own a .UK domain name, you can associate it with your Nominet account. This gives you full control over your domain and ensures you’re protected. Access Nominet Online Services here. This service only operates for .uk domain names, so you could not include a .com domain name in your Nominet protfolio. .com and other domains use other tools to “harden” ownership, and we can give you advice about this if you need to follow this up.

Adding background images with Sitejet

by Steve Galloway | Aug 4, 2025

Background images in web pages

This note briefly describes how to use background images with Sitejet. Bcckground images are difficult for a few reasons. The biggest problem is rendering an image, or a repetition of an image as a “tiles” so that it appears consistently on large screens, laptops, tablets, and mobile devices. For background images, consider using expert help.

In this example, a website owner uses a semi-transparent section to overlay a background image.

Click on the headers below to learn more about managing background images using Sitejet Builder’s “no-code” option.

Where does the image belong?

A web page is not like a sheet of A4 paper – unless we specify an area in which to contain our content, a web page has limitless dimensions. So, the first issue to decide is where does an image belong?

Web site layout elements

Conventionally, a web page has a global element called a CONTAINER. Within a container there can be one or more SECTIONS, which in turn can have one or more MODULES.

Background images can be inserted in any of these elements. A background image can fill an entire container, or it can fill an element as finite as a row within a module. An image can fill any element in between. An image could include a simple solid fill colour like light grey to distinguish between alternate rows.

How big should the image be?

Image dimensions

Unfortunately, what works for one web site may be disastrous elsewhere, and image content itself can become a problem. You may have to crop or scale an image after seeing what it looks like when you insert the image into a background.

The best starting point is an image that measures 1920w x 1080h. This will usually resolve satisifactorily for desktop/laptops. However, background images need to be sized differently for tablet and mobile, so you may need 2 or 3 images which can be called upon to suit viewers’ devices. However, this is not an absolute rule. Headers (especially) and sections/rows may require a sizizing compromise to work efficiently with a page layout.

File size and type

Files should be no more than 500KB. For home use, file size is not critical, however mobile users may experience slow page loads in areas where mobile coverage is minimal, and those who carry minimum data limits are more susceptible to possible service drop-outs as they reach monthly targets.

webp may be desirable file formate for images that tend to err towards large file sizes. jog/jpeg is a standard file format for static images, and png is used for images where image transparency or other effects are required.

Image Considerations

How the image is programmed depends on a few factors. For instance, you may want a static image that “covers” the container area. A background image can be anchored to text as you scroll, but it can remain static so that text moves as you scroll. Also, a background image may need to have some opacity – i.e. fading so that textual content is clearly legible. This can be handled by your desktop graphics software before you add the picture to your web site image library. Or a background image can be managed by introducting “opacity” or “transparency” in html coding on your web site dashboard. This can make an image look like a watermark when heavily applied. If you are using a pattern, it would be possibe to use a small square or rectangular image which your web server replicates across a container area.

Embedding background image using Sitejet dashboard

This workflow is for a situation where an image is to be applied to a website page “container”. The options are available at section and module levels.

1. Select the Container: Click on the container you want to edit.

2. Open the Style Settings: In the right-hand panel, go to the “Style” tab.

3. Background Settings:
• Scroll to the Background section.
• Choose “Image” as the background type.
• Click to upload or select an image from your media library.

4. Adjust Display Options:
• Set background size (e.g., cover, contain).
• Choose position (e.g., center, top-left).
• Set repeat options if needed.
• Optionally, add a background overlay for contrast.

Options like “cover”, “contain” and placement all have drastic effects on rendering and may need individual configuration for tablet and mobile view.

Summary

Background colours, like a light grey or light blue solid colour, are effective and easily implented. Background images can be visually appealing, but are awkward to render and are probably better reserved for expert intervention unles you are prepared to spend a lot of time configuring layout settings. You can use Sitjet’s “no-code” approach to configure background images at container level, and the principle applies to section and module elements. Advanced effects may require using the HTML authoring tool in sitejet to configure xHTML features.

How to configure DNS for a contact form

by Steve Galloway | Jul 22, 2025

Integrating contact forms with an external email service

This guide walks you through modifications you need to make to your domain name’s DNS zone record so that your contact form mail can reliably connect to your external email service, like Microsoft 365 or another email supplier.

This article is written for web designers who know websites but may not be as familiar with DNS.

Click on the headers below to find out how to modify DNS records and other steps in the order shown. Click on images to view at full-sized resolution.

1. Why?

One of the biggest reasons spam happens is because a hacker can purport to be you by sending email using your email address from email servers that you do not control. This means end users have to constantly combat rogue email, and email services have to make educated guesses about what is good email before passing it to your Inbox.

These modifications to SPF, rDNS, DKIM, and DMARC help a receiving email server determine that the email it receives really does come from an email server in your control.

If a receiving server cannot validate the source of your email, the receiving server is likely to conclude that your email has been sent from a spammer, in which case the email will be dropped. Your server can implement some tools, but your domain name has to be configured to co-ordinate with your server too.

2. Scenario

This example assumes that a web site owner uses Microsoft 365 for email and the domain name which governs the web site and email is managed at a registrar like GoDaddy where the authoritative zone record is held. In reality, the registrar might be different. For instance, the domain name might be managed at Cloudflare or even Microsoft 365 itself.

The important point is to understand where your authoritative zone record is managed. the web server will have a zone record. However, if the domain name is regitered at a regisrar like Tucows and the domain name uses Tucow’s nameservers, then the authoritative nameserver for your domain is at Tucows.

This workflow assumes:

Your website is hosted on at IP address 88.202.183.10
The domain’s authoritative DNS is managed at a registrar like GoDaddy
Email for the domain (e.g., yourdomain.co.uk) is handled by Microsoft 365
You want your contact forms to send email from the domain (e.g., info@yourdomain.co.uk) using your web server’s mail system

This assumes that you already have a valid email address called info@yourdomain.co.uk. Also, this assumes that DKIM and DMARC are already configured for Microsoft 365. Microsoft organises its DKIM records using CNAME records – this means that Microsoft can handle DKIM identifiers in-house.

This is useful because most other entities use an A record which means multiple there would be multiple DKIM records in your authoritative zone. This is possible, but it might affect reliability. So, if you already have DKIM records in your authoritative zone to cope with another email server, it might be worth considering options.

Preparation

Review the existing authoritative zone record to check for SPF, DKIM, and DMARC. You will need:

credentials for the domain name registrar control panel access
credentials for cPanel to edit and get records from your web server
credentials for any other services that might be implicated, like Microsoft 365
if DKIM is not already configured, refer to this guidance note
if DMARC is not already configured, refer to this guidance note

3. SPF (Sender Policy Framework)

SPF tells receiving email servers which IP addresses you have approved to send mail for your domain. Usually, this record is already posted in your zone record. In the example below, the record is only configured to recognize Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

So, now we need to include your web server’s IP address to verify that your web server is a valid email server too.

What to do:

Log into the DNS editor where your domain name is managed (e.g. GoDaddy)
Find your existing SPF TXT record (it starts with v=spf1).
Add your server’s IP: ip4:88.202.183.10 before the -all.

Example:

v=spf1 include:spf.protection.outlook.com ip4:88.202.183.10 -all

The syntax is not absolute. For instance, the following record also works:

v=spf1 ip4:88.202.183.10 include:spf.protection.outlook.com -all

Adding your web server’s IP address to the SPF record authenticates both Microsoft 365 and your web server as valid mail servers for your domain.

4. rDNS (Reverse DNS / PTR Record)

Unless you rely on exceptional settings, you do not need to do anything about rDNS. A PTR record is already established in the reverse zone for our servers. This means that the IP address for your server is already mapped to your hostname.

A PTR record can only be created where a reverse zone is accessible. Usually, this means having to post a support ticket at your domain registrar, or asking the owner of the IP address you have been granted to map the setting for you.

5. DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails.

Usually, DKIM is established with an A record. Microsoft 365 already uses DKIM via CNAME records. This is convenient. Other registrars might already require an A record that you rely on. It is possible to have multiple A records establishing DKIM records for different servers. This might cause some reliability issues though. So, you might need to monitor traffic flow after making this kind of change. In any event, your web server needs its own DKIM setup if it sends mail too.

What to do in cPanel:

Log into cPanel
Go to Email > Email Deliverability
Click open <Manage>
Do not enable DKIM. Instead:
Copy the TXT Name and Value fields shown for DKIM
Add this TXT record to your DNS at GoDaddy

This allows receiving servers to verify that your server’s emails are legitimate.

6. DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC tells receiving servers how to handle emails that fail SPF or DKIM checks. settings. This may already be established in your authoritative zone and that record would already be valid as long as:

your SPF record already includes for your web server’s IP address
or DKIM passes for your server (if you set it up)

Example

You can use the values suggested in cPanel > Email > Email Deliverability to create a DMARC record. DMARC uses an industry defined instruction set which is universally adhered to. For now, it is probably only necessary to operate DMARC in “test” mode. However, some services like Microsoft 365 may be sensitive (especially to “contact form” mail and require an elevated metric like p=quarantine.

Name: _dmarc.domainname.co.uk

Value: v=DMARC1; p=quarantine; rua=mailto:your-alias@domainname.co.uk

The three incremental states for DMARC are:

p=none
p=quarantine
p=reject

8. cPanel Mail Routing

Lastly, check that your server expects email to be managed externally. As the records above are being added to your authotitative zone, cPanel will often detect that external email servers are now in use. However, you need to check this setting.

What to do:

log into cPanel > Email > Email Routing
check <Remote Mail Exchanger> if it is not already enabled
save the setting

This ensures your server sends contact form emails to Microsoft 365 instead of trying to deliver them locally.

Testing and Summary

After updating your DNS:

Use MXToolbox to check SPF, DKIM, and DMARC
Send test emails from your contact form to Gmail or Outlook and inspect the headers
Look for spf=pass, dkim=pass, and dmarc=pass

Summary

By configuring SPF, rDNS, DKIM, and DMARC correctly, your contact forms can send email reliably—even when Microsoft 365 or other suppliers handle your domain’s email. This setup helps prevent your messages from being flagged as spam and protects a client’s domain reputation and brand intact.

Free AI website design

by Steve Galloway | Jul 14, 2025

Sitejet - free AI website design generator

Your web hosting account includes free access to Sitejet AI website design generator. Sitejet builds fully functioning websites with as little as your trading name, business sector, and a few other details. Sitejet includes a website design editor so that you or your website designer can customize website elements and introduce special effects.

Sitejet usually costs from $15/mo as a standalone service at time of writing. We are now providing this feature in your cPanel dashboard as standard at no additionalt startup or ongoing cost.

Click on the headers below to find more about Sitejet. Click on images to view at full-sized resolution.

What does Sitejet do?

Sitejet AI is an innovative DIY website builder. By providing your company name, business type, and a few other details, Sitejet AI can generate a professional website that reflects your brand and services using professionally authored website templates. Finshed websites are “mobile responsive”, which means that website content is optimized for PC, laptops, and mobile devices. The process can take seconds to execute.

AI generated website design lowers cost barriers

Sitejet is perfect for business owners who:

do not have IT expertise
who want to establish an online presence
who need to minimize cost
who optionally want a proof-of-concept to minimize conventional development costs

At time of writing, Sitejet Studio costs from $15/mo as a standalone product. As a cPanel user, we are including this utility as standard in your web hosting dashboard for no charge

Sitejet includes Ecwid Shopping Cart. Note that this feature is subject to subscription for more than 5 product listings.

In addition to a customizable template library (about 150 mobile-responsive templates at time of writing), Sitejet includes:

AI text generation and image/video galleries
no-code drag and drop editor for layout editing
AI co-ordinationwith business logos, and
SEO meta and content optimization
SEO reporting/metrics by Xovi Now

Save on Conventional Designer Costs

Hiring a professional web designer can be expensive. With Sitejet AI, you can bypass these costs and still achieve a high-quality website. The AI generator handles the heavy lifting, creating a site that is both functional and visually appealing. This means you can allocate your budget to other important areas of your business.

AI can make big inroads on web design costs. However, templates are often a “proof of concept” and in our experience users tend to want some kind of customization. Sitejet provides a dashboard for dealinng images, fonts, colour themes, and more. Read the next section to understand how you can use Sitejet AI templates to set the scene for your web designer to customize features.

Demonstrate Your Vision to Website Designers

Templates never quite get it right. This is why big business relies on professional help to achieve visual improvements and SEO optimization. So, AI website generation is not a replacement for professional website design at all. Instead, it works bes as a tool to help your website designer target qualitative improvements at a significant savings to you.

If you plan to hire a web designer for more detailed and customized effects, Sitejet AI can be incredibly useful. By generating a basic website as a “proof of concept”, you can clearly demonstrate your vision and requirements for quotations or tender. This saves time and also ensures that the final product better aligns with your expectations.

Summary

Sitejet provides you with no-code drag and drop editor to build your website from the ground up. Use it to design your own website or as a proof of concept to better equip your design team to achieve better results.

Sitejet usually costs about £150+ per annum, so this addition to your cPanel dashboard already brings enormous value to bear, compared to conventional design costs.

« Older Entries

Next Entries »