Enforcement without the fallout
See everything first, fix what is legitimate, then enforce in steps you approve. Your email never changes without your sign-off.
- AssessFree, before you commit.
- ObserveVisibility, no delivery change.
- RemediateReal senders authenticated.
- ProgressStaged, approved by you.
- WatchFor the rest of the year.
How managed DMARC works: we assess your domains for free, observe the reports mailbox providers send across a normal business cycle, remediate every legitimate sender so it passes SPF or DKIM alignment, progress your policy to p=quarantine and then p=reject only with your written approval, and watch for new or failing senders for the rest of the year.
What happens at each step
Who does what, in two lines.
Assess
No record change- We
- Check your records, mail platform, DNS host and parked domains.
- You
- Tell us your domains and who approves changes.
Observe
p=none- We
- Publish monitoring and collect reports from mailbox providers worldwide, across at least one full business cycle so month-end invoicing, payroll and newsletters all show up.
- You
- Nothing. Your email flows exactly as before.
Remediate
Built from report data- We
- List every service sending as you and set up SPF and DKIM for each real one.
- You
- Confirm which senders are yours and give access where needed.
Progress
quarantine then reject- We
- Recommend each step with the evidence behind it, never on a Friday, and with a clear way back to the previous policy.
- You
- Approve in writing. Nothing moves without it.
Watch
All year- We
- Catch new and failing senders, align the real ones and investigate anything odd.
- You
- Let us know when you add a new email service. We will usually spot it first.
A few short check-ins, not a project
You do not need to learn DMARC. You need to tell us what your business uses, approve the steps that matter, and occasionally point us to the right person.
- One nominated approver
You choose who signs off policy changes. It does not have to be the owner.
- Questions in plain language
“Does your payroll system send email?” rather than a page of DNS jargon.
- Nothing changes without a yes
Every step to quarantine or reject waits for written approval.
No mailbox access
DMARC runs on public DNS and provider reports. We never need a password.
DNS access only if needed
We apply records where we manage DNS. Otherwise your provider gets the exact records.
Your IT provider stays in
We work alongside them, so nobody is surprised by a change.
Switching from another provider?
Moves are where protection usually slips. Ours keeps your policy in place the whole way.
- Receive firstOur reporting is ready before anything changes.
- Switch reportingYour reports move to us, delegated records included.
- Confirm, then cancelA domain at p=reject stays at p=reject throughout.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.