How to build a managed DMARC service for your clients
A practical playbook for MSPs: what to offer, how to price it, how to onboard clients and how to take every domain to enforcement safely.
Every partner protects their own domain free.
[ In detail ]
Why every client needs DMARC now
Google, Yahoo and Microsoft now require bulk senders to authenticate mail with SPF, DKIM and a DMARC policy. Clients without DMARC see more mail land in spam, and their domains are easy to spoof in invoice and payment fraud.
DMARC is now defined by RFC 9989, which replaced RFC 7489. SPF (RFC 7208) and DKIM (RFC 6376) remain current. For MSPs this is a clear, standards-backed reason to start the conversation with every client.
[ How it works ]
Package your service in three tiers
- 01
Essentials
DMARC monitoring at p=none, a monthly report and alerts for new or failing senders.
- 02
Protect
Full remediation to p=reject, hosted SPF with flattening, DKIM key management and quarterly reviews.
- 03
Complete
Everything in Protect plus BIMI logo display, MTA-STS and TLS-RPT, lookalike-domain monitoring and compliance evidence.
[ In detail ]
Onboarding checklist for each client
Use the same checklist for every new client so delivery is predictable:
- List every domain the client owns, including parked and unused domains
- Publish a DMARC record at p=none with a reporting address
- Collect two to four weeks of aggregate reports
- Identify every legitimate sender: mail platform, CRM, billing, marketing, helpdesk
- Align SPF and DKIM for each sender; keep SPF under 10 DNS lookups
- Protect parked domains with a reject policy and an empty SPF record
- Agree the enforcement timeline with the client in writing
[ How it works ]
A safe enforcement timeline
- 01
Weeks 1–4 · Monitor
p=none while every sender is discovered and aligned.
- 02
Weeks 5–8 · Quarantine
Move to p=quarantine once aligned mail is consistently above target and unknown sources are understood.
- 03
Weeks 9–12 · Reject
Move to p=reject and keep monitoring for new senders. Under RFC 9989 there is no percentage roll-out; use subdomain policies and the testing flag to stage changes.
[ In detail ]
What to put in the monthly report
Clients renew services they can see. Keep each report short:
- Current policy and enforcement status per domain
- Share of mail passing DMARC, and any new senders found
- Spoofing attempts blocked this month
- Changes made, who approved them, and why
- Recommended next steps and add-ons
[ In detail ]
Pricing your service
Most MSPs combine a one-off remediation fee with a monthly per-domain fee. Price on the value of preventing spoofing and protecting deliverability rather than on hours. Because EmailAuth partner pricing is per domain with unlimited email volume, your costs stay predictable as clients grow.
Tier 1 platform, partner pricing below every other Tier 1 provider. Got a quote? We'll beat it.
[ FAQ ]
Questions MSPs ask
What is a managed DMARC service?
A recurring service where an MSP sets up, monitors and maintains DMARC, SPF and DKIM for a client's domains, takes them to enforcement and reports on the results each month.
How long does it take to reach p=reject?
For most small and mid-sized organisations, eight to twelve weeks is realistic once every legitimate sender is identified and aligned.
Should I still use the pct tag to roll out DMARC?
No. RFC 9989 removed the percentage tag. Stage enforcement with subdomain policies and the testing flag instead.
What should an MSP charge for DMARC?
Typical models are a one-off remediation fee plus a monthly fee per protected domain, often bundled into an email security package with BIMI and MTA-STS as add-ons.
[ More for MSPs ]
Become an EmailAuth partner
Tell us how many clients you look after. We'll set up your partner tenant and your first client scan the same week.