When you need it
Anyone can send mail that looks like it comes from your domain, and your DMARC record is at p=none or missing. Gmail, Yahoo and Outlook.com now reject or junk bulk mail without SPF, DKIM and DMARC, and nobody knows every service that sends mail as you.
What sets the quote
- Up to 5 sending domains and 10 third-party senders, such as your CRM, helpdesk or newsletter tool.
- Up to 20 parked domains that send no email.
- 8–12 weeks elapsed, with about 4 days of hands-on work spread across the rollout.
- More domains or senders are quoted after sizing.
What changes
- Receiving servers that apply DMARC reject mail that falsely claims to come from your domains.
- Every legitimate sender passes SPF or DKIM aligned with your domain, confirmed in the DMARC reports before each policy step.
- Servers that support MTA-STS deliver mail to you only over verified TLS, and TLS reports show where delivery fails.
- Parked domains tell receiving servers to reject all mail that claims to come from them.
What you get
- Sender inventory built from DMARC reports, listing every service that sends as your domains and its owner
- SPF records within the 10-lookup limit for each sending domain
- DKIM signing for your mail platform and each third-party sender, with 2048-bit keys where the sender supports them
- DMARC moved from none to quarantine to reject, with a go or no-go check at each step
- MTA-STS policy hosted with a valid certificate and moved to enforce mode, plus TLS-RPT reporting
- Parked domains locked down with null MX, SPF -all and DMARC reject
- Runbook for adding a new sender, and a handover session
Most of the 8–12 weeks is waiting. Each DMARC step needs a few weeks of reports to show every legitimate sender before the policy tightens. The hands-on work is about 4 days, spread across that time.
Not included
- The DMARC reporting service, which is your cost (we help you choose one)
- Inbound email filtering and anti-phishing settings
- BIMI logos and the mark certificates they need
What we need from you
- Access to change DNS records for the domains, or a DNS admin who applies agreed changes within two working days.
- An admin who can switch on DKIM signing: Exchange Administrator in Microsoft 365, or a super admin in Google Workspace.
- Admins for the third-party senders, who can set up DKIM and a custom return path.
- A place to host the MTA-STS policy file over HTTPS, and a named owner who approves each DMARC step.
How it works
Free 30-minute call, then a written fixed quote.
Publish DMARC at p=none with reporting, and build the sender inventory from the first reports.
Fix SPF and DKIM for each sender, lock down parked domains and publish MTA-STS in testing mode.
Move DMARC to quarantine and then reject, and MTA-STS to enforce, each after the reports show all legitimate mail passing.
Hand over the runbook and the reporting service.
At a glance
- Duration
- 8–12 weeks
- Price
- Fixed quote after a free 30-minute call
- Delivered by
- Our lead architect
Related services
PKI review
A one-week review of your PKI and certificates, covering the CA hierarchy, certificate inventory, TLS settings and revocation, rated red, amber or green, with an expiry risk list and a roadmap.
Domain and external attack surface check
A one-week, non-intrusive check of your domains, DNS, email authentication and internet-facing endpoints, with every finding tied to evidence and a fix. It is not a penetration test.
Microsoft 365 security baseline
Conditional Access, phishing-resistant MFA and just-in-time admin rights for Microsoft 365, plus Intune policies, Defender for Endpoint and disk encryption for Windows and macOS, designed and rolled out in 1–3 weeks.