DMARC Enforcement Sprint from p=none to p=reject, safely
A fixed-scope 30-day sprint that takes one domain and up to 5 sending services to enforced DMARC (p=reject) without blocking legitimate mail — a staged rollout, a clean handover, and the proof your insurer and auditors now require.
$1,500 fixed
One domain, up to 5 senders
p=reject in 30 days
Staged, monitored rollout
Enforcement evidence pack
For insurers & auditors
2 sprint slots open per month. If this month is full, we'll confirm next availability on the call.
What you get from the sprint
Built for teams stuck at p=none: enforced DMARC without lost mail, and the proof your insurer wants.
From p=none to p=reject — safely
We take your domain to enforced DMARC with a staged rollout that protects your real mail. Every sender is verified first, then policy is tightened in stages while we watch the report data.
Every legitimate sender mapped
Using your live DMARC (RUA) data we inventory every service sending as you — M365, marketing, billing, helpdesk — and fix SPF/DKIM alignment for up to 5 supported senders before tightening policy.
Insurer/auditor-ready proof
A completion report documenting enforced DMARC, aligned SPF/DKIM, and optional MTA-STS/BIMI — the email-authentication evidence cyber-insurers and auditors increasingly ask for.
Deliverables
Best for
If you just need a DMARC reporting tool to self-serve, that's our DDMARC platform. This sprint is the done-for-you version when you want enforcement handled and proven.
How the 30 days work
You'll always know what we're doing, why we're doing it, and what the impact is.
Access + sender discovery
Days 1–4
- Read-only DMARC report access (or we host your DMARC reporting)
- Establish current policy + SPF/DKIM alignment baseline
- Begin the sender inventory from live RUA data
Audit + alignment plan
Days 5–14
- Identify every legitimate sender and its SPF/DKIM status
- Flag misaligned / unauthorized senders and lookalike domains
- Agree the rollout plan and per-sender fixes upfront; anything beyond 5 senders is quoted before work starts
Fixes + move to quarantine
Days 15–24
- Fix SPF limits/flattening and DKIM signing per sender
- Move policy none → quarantine and monitor for legitimate-mail impact
- Daily async monitoring of report data
Enforce + handoff
Days 25–30
- Move policy to p=reject once the data is clean
- Optional MTA-STS / BIMI setup (quoted separately)
- Completion + evidence report delivered
- 90-day Managed DMARC plan to prevent drift
“A company had DMARC at p=none for two years, afraid enforcing it would block billing and marketing email. We inventoried their sending services, fixed alignment on the ones that were failing, and moved them to p=reject in stages — with no legitimate mail lost. They cleared their cyber-insurance renewal the same month.”
— Composite case study (anonymized; details representative of a typical enforcement engagement)
Ready to enforce DMARC — without breaking your email?
Book a 30-minute scoping call and we'll confirm fit, scope, and access approach. If a sprint isn't the right move, we'll tell you directly.
FAQ
Will moving to p=reject break our email?
No — avoiding that is the entire point of doing it in stages. We don't tighten policy until every legitimate sender is verified and aligned, then move none → quarantine → reject while watching report data at each step. If anything looks off, we hold and fix before continuing.
What does “fixed scope” mean in practice?
Before Day 1 we agree on a written checklist: the one domain in scope, the up to 5 senders we'll align, and the rollout milestones. The 30-day window starts once DNS and report access are in place. If we find something outside that scope, we document it — it doesn't become absorbed work or an invoice surprise.
What happens after the 30 days?
Enforcement drifts — new tools start sending as you, records change. Most clients move onto Managed DMARC ($99 per domain per month, billed annually) so we monitor, add new senders safely, and keep you at reject with ongoing reporting. If you'd rather run it in-house, the handoff plan is yours.
Do you need access to our DNS?
Read-only DMARC report access is enough to start. For fixes we provide the exact DNS records for your team to apply, or you delegate a subdomain and we host the records. Your call — no full DNS control required.
What does the $1,500 cover?
One active domain and up to 5 supported sending services, taken to p=reject in stages, with handover and the completion report. Extra domains or more senders get a fixed quote after scoping, before work starts. A single successful invoice-fraud (BEC) email typically costs far more than the sprint.
How is this different from a DMARC SaaS tool?
A tool shows you reports — you still have to interpret them and risk flipping to reject yourself. This is done-for-you: a senior engineer takes you to enforced DMARC safely and hands you the proof. We run our own DMARC platform under the hood, so you're not paying for a dashboard you have to operate.
Related Articles
Guides and resources to help you go deeper
DMARC Implementation: From p=none to p=reject in 90 Days
DMARC p=reject: 10 Mistakes That Break Legitimate Email
The Complete Email Security Stack: SPF, DKIM, DMARC, and Beyond
Email Security for Law Firms: A Complete Guide to Protecting Client Communications