Questions we get asked most

DMARC is a DNS record that tells the world’s mailbox providers two things: how to check whether an email claiming to come from your domain really did, and what to do with it when it did not. It builds on SPF and DKIM, and it sends you reports showing every server that is sending email using your domain.

Anyone can send email with your exact address in the From line, and receiving servers have no instruction from you about what to do with it. Some will filter it on their own judgement, many will deliver it. That is how most invoice fraud and supplier impersonation reaches its victims.

DMARC depends on them. A message passes DMARC when it passes SPF or DKIM and the domain that passed matches the domain in the visible From address. Part of our work is making sure each service you use has SPF and DKIM set up correctly for your domain.

No, and anyone who says it does is overselling it. DMARC stops criminals from sending email that uses your exact domain. It does not stop lookalike domains, it cannot help if a real mailbox is compromised, and it does not fix delivery problems caused by content or sender reputation. It closes one specific and very common door, which is why it matters, but it is one control among several.

No. Businesses add new email services all the time: a new CRM, a payroll system, a marketing platform. Each one has to be authenticated before it can send as your domain under an enforced policy. Ongoing monitoring is what keeps enforcement from breaking legitimate mail.

A policy published too early can. If you move straight to reject before every legitimate sender is authenticated, messages from services you forgot about will be blocked. That is the reason we start with monitoring, build the sender inventory from the report data, fix alignment first, and step up the policy in stages with your approval.

You do, in writing. We recommend each step with the evidence behind it: which services are passing, which are failing and why. Nothing moves to quarantine or reject until your nominated contact has approved it.

Your domain names, confirmation of who manages your DNS, and the name of a contact who can approve changes. It helps if you can list the services you know send email for you, but you do not need a complete list. The reports will show us the ones nobody remembers.

If we manage your DNS, we do. If your registrar, hosting company or IT provider manages it, we give them the exact records and confirm they are live. We do not ask for broad access to DNS we do not need to manage.

Parked and unused domains are a favourite for impersonation because nobody watches them. They should carry a reject policy and an SPF record that authorises no senders. We include them in the assessment and lock them down.

A small South African team at MailMarq in Johannesburg, whose people have looked after business websites, domains and email since 2016. You get plain-language updates by email and a real person to talk to during South African business hours.

MailMarq is sold in annual packages: Vortex at R3,290 a year for one domain, Velocity at R6,490 a year for up to 10 domains, and Corporate from R12,990 a year, all excluding VAT and with no setup fees. The free assessment tells you which package fits your domains and email set-up.

Annually and upfront. We activate your package once payment is received, and packages renew automatically each year unless you give written notice before your renewal date. There is no monthly option.

Yes. Agencies and IT providers who bring several client domains get partner rates. See the partners page or get in touch to talk through your client base.

Annual fees are not refundable once a package has been activated. You can choose not to renew at the end of the year by giving written notice before your renewal date. If the Consumer Protection Act applies to your business, you can also cancel during the year on 20 business days’ notice, as set out in our service terms.

Yes. We review your domain’s current records, identify the obvious services sending as you, and give you a plain-language summary with what it would take to reach enforcement. There is no obligation to sign up.

Aggregate reports list the IP addresses that sent email using your domain, message volumes, and whether each source passed SPF, DKIM and DMARC. They do not contain the content of your email.

We process only what the service needs, keep it secure, and limit access to the people doing the work. Our privacy policy sets out what we collect, why, how long we keep it, and your rights.

No. The checker runs in your browser and queries public DNS directly. The domain you type is not sent to us.