Client overview
Sonitek is a precision manufacturing company that specializes in heat staking, ultrasonic welding, and industrial automation equipment. It relies on email and DNS for order processing, customer communication, internal operations, and B2B outreach.
A DNS migration that became incident response
Sonitek hired us to support a DNS migration and website transition. Early on, we found that DNS, email authentication, and security controls were spread across multiple platforms. That created unnecessary risk for any migration.
As the cleanup began, the company was hit by a live, malicious email flood. The planned work turned into active incident response.
What we found
- SPF, DKIM, and DMARC were misaligned and inconsistent across Microsoft 365, eCommerce systems, and third-party senders
- DNS was hosted in a way that made changes fragile and easy to get wrong, which made the migration riskier
- Monitoring existed but gave no useful visibility, so failures could happen without anyone noticing right away
Before the cleanup was complete, Sonitek was hit with a high-volume inbound email attack. It flooded mailboxes with thousands of messages per minute. Legitimate email was delayed, mailboxes slowed down, and operational risk rose quickly.
Stopping the email flood
We switched right away from planned migration work to defense and containment.
- Rapid inbound defense. Deployed Proofpoint as a first-layer email security gateway to absorb and block malicious traffic before it reached Microsoft 365.
- Attack containment. Stopped the flood, brought mailbox performance back to normal, and restored legitimate email flow without disrupting users.
- Employee protection. Put controls in place to prevent follow-on threats. These included business email compromise (BEC) and the credential-harvesting attempts that often come with these attacks.
DNS and email authentication cleanup
Once the environment was stable, we completed the original scope on a hardened setup.
- DNS cleanup and alignment. Standardized SPF, DKIM, and DMARC across all sending sources and domains.
- DNS migration. Migrated DNS to the new provider with zero email downtime.
- Website transition. Supported the website move as part of the DNS cutover, and confirmed the new records were live and services kept running.
- Ongoing visibility. Set up monitoring and alerting so authentication issues, delivery failures, and anything unusual get caught early.
Outcome
- The email flooding attack was stopped quickly, with no data loss and no ongoing user impact
- DNS and email authentication are now fully aligned and stable
- The DNS and website migration finished cleanly and safely
- Layered defenses prevented a potential business email compromise
- Sonitek can now rely on its DNS and email infrastructure
The client’s review
John did an exceptional job helping me improve our email security and manage complex conditional access policies. He provided clear explanations, proactively identified potential issues, and quickly implemented effective solutions—significantly reducing spam while ensuring legitimate emails weren't blocked unnecessarily. John was responsive, knowledgeable, and proactive in addressing problems, clearly communicating technical details and best practices. He consistently took initiative to troubleshoot, confirm configurations, and provide actionable recommendations, greatly enhancing the efficiency and security of our infrastructure. I highly recommend working with him.