A step-by-step guide to configuring SPF, DKIM, and DMARC for your MSP clients — from the first DNS record to full enforcement — plus how to monitor all of them automatically.
Audit Client Email Security Free →DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with emails that fail authentication. Without it, anyone can send email that appears to come from your clients' domains — a trivially easy phishing attack that's becoming the entry point for ransomware.
For MSPs, DMARC is a compliance requirement, an insurance condition, and increasingly a cyber insurance prerequisite. PCI DSS 4.0 references email security controls. HIPAA risk assessments routinely flag missing DMARC. CIS Controls v8 includes email domain protection in Control 9. If your clients are missing DMARC, they're failing compliance requirements they may not even know about.
DMARC enforcement requires two other records to be in place first. Here's what each does and why all three are required:
SPF tells receiving servers which IP addresses are authorized to send email for your domain. Without SPF, anyone can claim to send from your domain and pass basic delivery checks.
DKIM adds a cryptographic signature to outgoing emails. Receiving servers verify the signature against a public key published in your DNS. DKIM proves the email was sent by an authorized server and hasn't been modified in transit.
DMARC references SPF and DKIM and adds a policy: what should receiving servers do with email that fails both checks? DMARC also sets up reporting so you can see who's sending on behalf of your domain.
Never jump straight to p=reject. Doing so before you've identified all your email senders will block legitimate email. The correct progression takes 4-8 weeks per client and looks like this:
| Phase | Policy | What Happens | When to Move On |
|---|---|---|---|
| 1. Discover Weeks 1–2 |
p=none | No email is blocked. Reports flow in showing who's sending on behalf of the domain. Audit the report to find all legitimate senders. | Once you've identified and configured DKIM/SPF for all legitimate senders and DMARC alignment is passing for each. |
| 2. Quarantine Weeks 3–4 |
p=quarantine pct=25 | 25% of failing emails go to spam. Start with low pct and increase. Monitor for legitimate email hitting spam folders. | When quarantine rate is stable with no legitimate email impacted. Increase pct to 100 before moving to reject. |
| 3. Enforce Week 5+ |
p=reject | All emails failing DMARC authentication are rejected at the receiving mail server. Phishing from your domain domain stops. | This is the target state. Monitor reports weekly for any new legitimate senders that need to be added. |
Once DMARC is at p=reject, three additional email security records significantly strengthen your client's email posture and are increasingly required by compliance frameworks:
Requires that incoming mail to your domain is delivered over encrypted TLS, preventing downgrade attacks on email in transit. Published via a policy file at a specific URL and a TXT record at _mta-sts.yourdomain.com.
Reports delivery failures caused by TLS negotiation issues. Pair with MTA-STS for visibility into your inbound encryption. Add a TXT record at _smtp._tls.yourdomain.com.
Displays your client's logo in supported email clients (Gmail, Yahoo, Apple Mail) when DMARC passes at p=reject. A powerful visual signal to recipients that the email is authentic. Requires a VMC (Verified Mark Certificate) for full Gmail support, though basic BIMI works without one in some clients.
The real challenge for MSPs isn't configuring DMARC for one domain — it's maintaining it across 50+ clients. Records drift. Third-party senders get added without updating SPF. DKIM keys expire or get rotated without updating DNS. Clients move to new mail providers and nobody updates the records.
Without automated monitoring, you find out about DMARC failures when a client calls to say their email is bouncing, or worse, when a client's customer gets phished from a spoofed domain.
Automated monitoring for every domain on every scan — no manual DNS lookups
SBCMSP scans all 10 DNS security checks — DMARC enforcement level, SPF, DKIM, MTA-STS, BIMI, and more — automatically for every domain you monitor. Get notified when records change.
Start Free Trial — No Credit Card14-day trial · All features · Up to 3 domains free forever