Managed DMARC Service

Managed DMARC Monitoring & Enforcement

For businesses with no IT team: we read your DMARC reports every month, fix each service that sends email as you, move your domain to p=reject without losing real mail, and keep it there as you add new tools.

$99/mo

Per domain, billed annually

Monthly

Report review

1 business day

Alert response

p=reject

Reached and kept

Get a Managed DMARC Quote Check Your Domain Free

DMARC Status

acme-corp.com

p=reject ✓

SPF

pass

DKIM

pass

DMARC

pass

Last 30 DaysEmail Volume

142K

Total Emails

98.4%

Aligned

2.3K

Blocked

DMARC Alignment98.4%

Top SendersAll aligned

Google Workspace

89,234

SendGrid

32,156

Salesforce

18,432

HubSpot

2,178

p=reject

Policy

Aligned Senders

Spoofing Attempts

Need p=reject within 30 days for an insurer or auditor? The one-time sprint starts at $2,500.

See the DMARC Enforcement Sprint

Built for Businesses With No One Watching DNS

Managed DMARC is designed for businesses of 10 to 200 people with no in-house IT, where email goes out through a mailbox provider plus third-party tools nobody tracks.

Medical and dental clinics

Who sends as you: Appointment reminders, patient-portal notices and billing statements, often sent by vendors using your domain.

A spoofed billing email to patients looks exactly like yours. Enforcement blocks it, but only after every reminder and portal tool is aligned, or real patient mail goes to spam.

Law firms

Who sends as you: Practice-management notices, e-signature requests, client intake forms and the firm's own mailboxes.

Fake wire or settlement instructions are easiest to pull off from your exact domain. DMARC at p=reject closes that route. Lookalike domains need other controls, and we tell you so.

Accounting, finance and insurance

Who sends as you: Client portals, invoicing and payment reminders, newsletters and policy or tax-season mailings.

If you take card payments, PCI DSS now expects anti-phishing controls. Cyber-insurance forms often ask whether DMARC is enforced. You need a yes you can prove.

Funded SaaS startups

Who sends as you: Transactional mail (SendGrid, Postmark, Amazon SES), product marketing, the support desk and the CRM.

A product with real users can pass the 5,000-a-day bulk-sender line quickly. New sending tools appear every quarter, and each one can quietly fail alignment.

What We Do Every Month

Managed DMARC is a recurring job, not a one-off setup. This is the work included in every plan.

Report review

Your aggregate (rua) reports come to a reporting address we host. Each month we review them and send a short written summary: mail volume, pass rate by sender, what failed and what we changed.

Sender inventory

A living list of every service that sends as your domain, who owns it on your side, and whether it passes SPF and DKIM. Unknown sources get flagged and identified, not ignored.

Alignment fixes

When a legitimate sender fails, we fix it: DKIM keys or CNAMEs, a custom return-path, or an SPF include. You get the exact DNS records to paste, or we apply them if you delegate DNS access.

Policy progression

We move your policy from p=none to p=quarantine to p=reject only when the reports show every legitimate sender passing. Once you reach reject, we keep you there.

SPF lookup budget

SPF allows at most 10 DNS lookups (RFC 7208). Every new tool adds one or more. We remove includes you no longer use before the record breaks and SPF fails for all of your mail.

Alerting

We watch for failure spikes, new sources sending as you, and changes to your SPF, DKIM or DMARC records. Alerts are handled within one business day.

BIMI readiness

BIMI, the logo next to your name in Gmail and other inboxes, only works with DMARC at quarantine or reject. We keep you eligible. Hosted BIMI and MTA-STS records come with the DDMARC Growth plan.

Quarterly evidence report

A dated report showing your policy, pass rates and changes for the quarter. Hand it to a cyber insurer, an auditor or a PCI assessor when they ask how you stop spoofing.

Why DMARC Needs Ongoing Work

Publishing a DMARC record takes five minutes. Keeping it at p=reject without losing real email is the hard part, because the list of services sending as you keeps changing.

A domain left at p=none gives you reports but blocks nothing. Managed DMARC exists to get you to enforcement and keep you there.

What Usually Breaks It

Marketing signs up for a newsletter tool and starts sending as your domain before anyone sets up DKIM.
A vendor moves to new sending servers or rotates its DKIM keys, and its mail starts failing.
Your SPF record creeps past 10 lookups and fails for every message, including Microsoft 365 or Google Workspace.
The person who set up DNS leaves, or the domain moves to a new DNS host, and records are dropped in the move.
Someone lowers the policy to p=none to fix a delivery problem and never raises it again.

Timeline

Your First 90 Days

A typical path for a domain starting with no DMARC or stuck at p=none. We only step up the policy when the reports show legitimate mail passing, so a domain with many sending tools can take longer.

Week 1

Onboarding and baseline

Current policy, or p=none if you have no record

Point your DMARC reports to our reporting address
Record the current SPF, DKIM and DMARC setup per domain
Agree how DNS changes get made: you paste them or we apply them

Weeks 2–4

Sender inventory and first fixes

p=none

Build the sender inventory from real report data
Fix alignment for your main mailbox provider and largest senders
First monthly summary

Month 2

Move to quarantine

p=quarantine

Fix the remaining senders, including low-volume ones
Switch to quarantine once legitimate mail passes
Watch for anything real landing in spam

Month 3

Enforce

p=reject

Switch to reject when the data stays clean
Set a subdomain policy so unused subdomains can't be spoofed
First quarterly evidence report

After month 3 the monthly cycle continues: report review, new senders, alerts and a quarterly evidence report. Already at p=reject, for example after our DMARC Enforcement Sprint? Onboarding takes the first week and we go straight to the monthly cycle.

Managed DMARC Pricing

Flat monthly pricing by number of domains. Need p=reject by a deadline? Start with the one-time sprint.

Managed DMARC

$99

per domain per month · billed annually

For any number of domains, priced per domain. It runs on a DDMARC plan, including the free one.

A named specialist, the same one month to month
Monthly report review and written summary
Sender inventory kept current
Alignment fixes and new senders authorized
Policy moved to p=reject and kept there
Alerts handled within 1 business day
Forensic samples reviewed and spoofing alerts triaged
Quarterly evidence report

Get a Quote

DMARC Enforcement Sprint

$2,500

per domain · one-time · 30 days

For a deadline: an insurer, auditor or customer wants p=reject this month.

Fixed scope, agreed before day one
p=none to p=reject in 30 days
Evidence pack and handoff plan
Optional move to Managed DMARC afterwards

See the Sprint

Not sure where you stand? The free DMARC, SPF and DKIM check shows your current policy and what is failing. Already on a retainer? DMARC is part of the Email Security Suite add-on on our pricing page.

Sprint or Managed DMARC?

Both end at p=reject. The difference is speed and who looks after it afterwards.

Compare	Enforcement Sprint	Managed DMARC
What it is	A one-time project	An ongoing monthly service
Price	$2,500 per domain, fixed	$99 per domain per month, billed annually
Time to p=reject	30 days	Usually about 3 months, paced by your report data
After p=reject	Handoff plan; you maintain it	We keep you there as tools change
Reporting	One completion and evidence report	Monthly summary plus quarterly evidence report
Best for	A deadline, or a team that will run DMARC itself	Businesses with no one to watch DNS and reports

Who Now Expects DMARC

None of these rules require p=reject. A p=none record satisfies the mailbox providers. Enforcement is what actually stops someone sending as you.

Since February 2024

Gmail and Yahoo

Senders of more than 5,000 messages a day to personal Gmail or Yahoo accounts must publish DMARC (p=none is enough) and align the From domain with SPF or DKIM.

Google sender guidelines

Since May 2025

Outlook.com

Microsoft set the same bar for Outlook.com, Hotmail and Live addresses: SPF, DKIM and at least p=none DMARC for senders above 5,000 messages a day.

Microsoft announcement

Mandatory since March 31, 2025

PCI DSS v4.0, requirement 5.4.1

Businesses that handle card data need processes and automated mechanisms to detect and protect staff against phishing. Enforced email authentication is a common way to show the anti-spoofing part.

PCI SSC document library

Senders We Align

Any service that sends as your domain needs SPF or DKIM aligned with it. Typical examples, plus the industry tools your reports turn up:

Google Workspace

Microsoft 365

Mailchimp

HubSpot

Salesforce

Zendesk

SendGrid

Postmark

Amazon SES

Related Services

DMARC covers your exact domain. These cover the rest of your email risk.

Emails Going to Spam?

Why business email lands in spam and how to check your SPF, DKIM and DMARC

MTA-STS

Force TLS for mail sent to your domain so it can't be read in transit

BIMI Certification

Show your verified logo in the inbox once DMARC is enforced

Managed Email Security

Phishing and malware blocked before staff see them

Managed DNS

Keep the DNS records your email authentication depends on correct

Common Questions

Managed DMARC FAQ

The Gmail, Yahoo and Outlook.com bulk-sender rules only apply above 5,000 messages a day, so a small firm usually isn't forced to publish DMARC. But spoofing doesn't depend on how much you send. Attackers impersonate small firms to reach their clients, and without an enforced DMARC policy nothing tells the receiving server to block mail that fakes your domain. A p=none record with reporting costs nothing; reaching p=reject is what stops the spoofing.

Only mail that fails both SPF and DKIM alignment gets rejected. The real risk is a legitimate sender nobody knew about, such as a scheduling or invoicing tool. That's why we don't move to quarantine or reject until the reports show every legitimate source passing. Some forwarded mail and mailing-list traffic can fail SPF; DKIM signatures usually survive forwarding, and we watch for these cases before each policy change.

The DMARC Enforcement Sprint is a one-time, fixed-scope project at $2,500 per domain that takes your domain to p=reject in 30 days and hands it back to you. Managed DMARC is a monthly service: we review your reports, authorize each new sending tool and keep you at p=reject. If you have a deadline, start with the sprint. If you have no one to watch DNS afterwards, add Managed DMARC.

$99 per domain per month, billed annually. It runs on top of a DDMARC plan, and the free plan works; hosted MTA-STS and BIMI come with DDMARC Growth. The free domain check costs nothing and shows where you stand before you commit.

On Managed DMARC, usually about three months: a few weeks at p=none to build the sender inventory, a month at quarantine, then reject. Domains with many sending tools can take longer, because we only move when the data is clean. If you need p=reject sooner, the sprint gets there in 30 days.

We never need mailbox access. DMARC reports go to a reporting address we host. For DNS changes, we either send you the exact records to paste or you give us delegated access to your DNS host, and every change is logged with a way to roll it back.

Tell us and we set up its DKIM and SPF before it starts sending as you. If someone signs up without telling us, it shows up in the reports as a new source and we follow up within one business day, before it hurts deliverability.

No. DMARC stops mail that fakes your exact domain. It doesn't stop lookalike domains (for example a swapped letter), compromised mailboxes or phishing aimed at your staff from other domains. Those need filtering and training, which our phishing protection service covers.

Yes, if someone on your team is comfortable editing DNS and reading reports. DDMARC, our self-serve DMARC platform, has a free plan. Managed DMARC is for businesses that would rather have the work done for them.