Get to the cause of the problem.
Missing messages, rejected mail, broken application sending or filtering that keeps getting it wrong. We investigate the evidence and carry out the agreed fixes.
£950
One incident. Up to four hours.
Specialist investigation with a defined scope and a written outcome.
Follow the available evidence.
Our investigations cover mail platforms, gateways, DNS and sending applications.
Estimated prices. Excludes licences, third-party usage and VAT where applicable.
The same symptom can have several causes. A few examples give us a starting point.
We follow the available message traces, inspect delivery responses and identify where recipient or provider records are needed. A comparison with an unaffected message helps narrow the route.
We examine the filtering decision, policy and message authentication. Any release or policy change goes through the authorised owner and is tested against the affected route.
We check the application’s submission route, credentials, relay permissions and domain configuration with its owner. The investigation distinguishes failure to submit from rejection later in the journey.
We inspect the available email evidence and coordinate with your security team on containment. Suspected BEC may also require action from finance, identity or wider incident-response specialists.
Useful details include the sender and recipient, the time and timezone, a message ID, the exact error and when the behaviour first appeared. If you have an existing incident reference, include it.
We arrange secure access to headers, logs or message content where necessary. Keep passwords and sensitive message contents out of the enquiry form.
Your written outcome records the timeline, evidence, changes and test results. Where a cause remains uncertain, it identifies the missing evidence and next action.
The four-hour allowance covers investigation, engineering and reporting for the incident. We agree additional hours before proceeding. A larger redesign or migration is quoted as a project.
Tell us what is happening, when it started and who is affected. We agree access and scope.
We review the evidence, involve the relevant providers and agree changes before making them.
We test the changes, record the findings and quote any further engineering.
That depends on access to the systems involved. We distinguish evidence of acceptance from evidence of inbox placement, and identify records needed from another provider.
We explain the findings so far and quote any further investigation or remediation. Some incidents take longer than the initial four hours.
Yes. Urgent investigations carry a 50% premium, with an engineer response within two business hours Monday–Friday or six coverage hours at weekends, between 08:00 and 18:00 UK time. See the response-clock terms below.
We can scope email investigation and containment, and coordinate wider incident-response specialists where needed.
£1,425 for the initial investigation
Includes the same four engineering hours, with a 50% urgent-support premium. Additional urgent hours are £262.50 each.
All times use Europe/London, including seasonal clock changes. Urgent coverage follows these daily windows, including bank holidays.
Urgent support: engineer response within two business hours Monday–Friday, or six coverage hours Saturday–Sunday, between 08:00 and 18:00 UK time (Europe/London), including bank holidays. The clock starts once the terms are agreed and we have received the deposit specified in your order, provided the incident has been reported through the agreed support route. For an incident reported later, it starts on receipt of that report. Time outside 08:00–18:00 is paused. The two- or six-hour allowance is set by the day the clock starts; outside coverage, it starts at 08:00 the next day using that day’s allowance. Any remaining hours carry into the next coverage window. Response means an engineer contacts you with an initial assessment or a request for the information needed to proceed. An automated acknowledgement does not count. Resolution depends on the incident. Submitting an enquiry does not start the response clock; booking and deposit must first be confirmed.
If terms are agreed, the deposit is received and the incident is reported by 17:00 on Friday, the response is due by 09:00 on Saturday. If the last of those conditions is met at 16:00 on Saturday, it is due by 12:00 on Sunday.
A successful send is only one part of the evidence. We investigate deliverability through message traces, authentication results and available recipient evidence, including forwarding where the route changes.
We link the investigation to your incident record, coordinate suppliers and use your approved change route for remediation.
Alongside your IT team · Read the Email Resolution agreement
See the scope and estimated cost before you speak to us.
Build an investigation →