DMARC for MSPs & agencies

Every client you manage has at least one domain, and the odds are good that most of them are stuck at p=none or have no DMARC record at all. That is no longer a quiet technical detail. Since the Google and Yahoo bulk-sender rules landed in February 2024, with Microsoft tightening for high-volume senders to Outlook.com, Hotmail and Live through 2025, an unauthenticated domain is a deliverability problem and a fraud problem at the same time. You are already the person those clients call when email stops arriving. This page is about turning the fix into something you can offer, as part of your own managed service or quietly behind the scenes, without becoming a DMARC specialist yourself.

The opportunity sitting in your client base

Walk your client list and run a scan across their domains. You will find the same pattern almost everywhere: a domain that publishes p=none if it publishes anything, an SPF record that may or may not be valid, DKIM that was set up once for one platform and forgotten, and no aggregate reports being read by anyone. Each of those domains is exposed on two fronts.

The first is deliverability. The mailbox providers now expect genuine authentication from any sender of volume, and they are increasingly applying the same scrutiny to ordinary business mail. A client whose invoices, appointment reminders or marketing suddenly start landing in spam will assume the problem is yours to solve, because you run their IT. The second is fraud. A domain at p=none can be spoofed today: a forged invoice from accounts@theirdomain.com reaches their customers' inboxes and there is nothing stopping it. When that happens, the client looks to you to explain why their email let a criminal wear their name. We cover that attack in detail on our invoice and CEO fraud page.

So the demand is already there. It is latent, it is recurring, and it maps cleanly onto the relationship you already have. The only thing missing is a way to deliver the fix reliably across dozens of domains without it eating your engineers' time.

How the partner model works

The arrangement is deliberately simple. We do the enforcement and the monthly reporting; you keep the client relationship and the margin. You can present it as part of your own managed service, or run it entirely behind the scenes and simply tell the client their email is now protected. Either way, the client deals with you, not with us.

It works on a per-domain basis, so you bring domains in as it suits you, one at a time or in batches, and the commercials scale with you rather than locking you into a tier you have to grow into.

Because you set what the client pays, the partner rate is a floor, not a ceiling. If you wrap enforcement and monitoring into an existing managed-services bundle, the margin is yours to structure. If you bill it as a standalone line item, you decide the markup. We do not contact your clients, and we do not appear on their invoices unless you want us to, so the relationship and the credit stay with you.

Why outsource rather than build it yourself

Any competent engineer can write a DMARC record. That is genuinely the easy part, and it is also the part that fools people into thinking the whole thing is a five-minute job. The record is one line of DNS. The work that actually protects a domain, and the work that can break a client's email if you get it wrong, is everywhere else.

The hard part is the staged rollout. Taking a domain from p=none to p=quarantine to p=reject without bouncing a single legitimate message means discovering every system that sends mail in the client's name, confirming each one aligns, holding at each stage until the reports prove it is safe, and only then tightening. A typical business mails through more services than anyone remembers: a CRM, a help desk, a payroll provider, an events tool, two marketing platforms nobody documented. Miss one, jump to p=reject, and you have blocked your client's own mail. The full sequence is laid out on our guide to reaching enforcement.

The other hard part is reading the reports, month after month. Aggregate (RUA) reports arrive as compressed XML from dozens of receivers. Someone has to ingest them, deduplicate sources, distinguish a newly added legitimate sender from genuine spoofing, and notice when a client adds a marketing tool that is about to start failing. That is not a one-off setup task; it is an ongoing watch. Across one client it is tedious. Across forty it is a job nobody on your team wants, and the kind of job that quietly gets dropped until something breaks.

Building this in-house means owning all of that: the staged-rollout discipline, the per-receiver report parsing, the hosting for DMARC, SPF, DKIM, MTA-STS and BIMI, and the on-call attention when a client's pass rate moves. Outsourcing it to us means you own the client conversation and we own the machinery. You are choosing not to staff a specialism that only pays off at scale you may not have yet.

What we actually do for each client domain

For each domain you bring us, the process is the same one we run for any direct client, paced so there is no email outage at any point.

1. We audit the current state: existing DMARC, SPF and DKIM, every sending source we can see in the reports, and where the domain is exposed today. This mirrors our audit step.
2. We publish or correct the record at p=none and begin ingesting aggregate reports, building a complete picture of who sends mail as the client.
3. We align each legitimate source, fixing SPF and DKIM so real mail passes cleanly, then move to p=quarantine only once the reports show it is safe.
4. We hold at quarantine until the legitimate pass rate is consistently high and only unauthenticated mail is still failing, then move the single word to p=reject. From that point, mail forging the client's domain is refused before it reaches an inbox.
5. We host the supporting records (DMARC, SPF, DKIM, MTA-STS and BIMI) and keep ingesting reports, sending alerts when something changes.

The rollout is reversible at every step, because the policy lives in a single TXT record. If anything legitimate were ever caught, the policy loosens in minutes while the underlying source is fixed. In a well-run rollout that safety net is never needed, but it is always there, which is what makes enforcing rather than hiding at p=none a reasonable thing to do on a client's live domain.

What the client gets

From the client's point of view, the outcome is concrete and easy to explain, whether they hear it from you in your words or never hear the mechanics at all.

For clients with multiple domains, the reporting consolidates across the whole estate, so you can show a single coherent view rather than juggling a separate report per domain. That consolidated picture is exactly the kind of artefact that justifies a recurring monitoring line on an invoice, because it is visibly ongoing work rather than a one-off setup. More detail on the reporting itself sits on our products overview, and the prerequisites are listed under requirements.

The record is yours to take credit for. The machinery is ours to run. The client sees protected email and a partner who clearly has it handled.

Who this suits

This model fits IT MSPs and managed service providers who already hold the DNS or email administration for their clients, agencies who manage domains and want to add a security and deliverability line to what they offer, and any partner whose clients are now being squeezed by the mailbox-provider mandates. If you have a handful of clients it works; if you have hundreds it works better, because the per-domain economics and the consolidated reporting were built for exactly that scale.

It suits you particularly well if you would rather not hire or train a DMARC specialist, do not want to own the monthly report-reading grind, and would prefer to keep the client relationship entirely yours while a partner runs the part that needs sustained expertise. You stay the trusted face; we stay invisible unless you want us named.

Become a partner

The fastest way to see what this looks like is to run a scan across a few client domains and find out how many are sitting at p=none right now. Our free tools will show you each domain's policy, whether SPF and DKIM are aligned, and whether the record is even being found. That gives you a concrete list of exposed clients before you commit to anything.

When you are ready to bring domains in, create an account and get started. If you want to discuss partner pricing, how the service is presented to your clients, or onboarding a larger estate, get in touch and we will set up the partner arrangement around how you actually work. Either route starts the same way: pick a domain, let us take it from p=none to p=reject with no outage, and decide for yourself whether it is something you want to put your name on. If you still have questions, our FAQ covers the common ones.

The mandates are not loosening, and the gap between a protected domain and an exposed one only widens from here. Your clients are going to need this. The only question is whether they get it from you, with the margin in your pocket, or from someone else who noticed first.