Reduce direct domain spoofing with a careful DMARC rollout.

What DMARC does

DMARC checks whether a message passes SPF or DKIM with a domain aligned to the address shown in the From field. Your published policy tells participating receiving systems how you would like messages that fail those checks handled. Receiving systems apply their own delivery decisions.

From discovery to enforcement

1. Identify legitimate senders. Include your main email provider, website forms, invoicing tools, CRM and marketing platforms.
2. Check authentication. Review SPF and verify DKIM with the relevant provider and test messages. A public domain scan alone cannot confirm every DKIM selector or sending path.
3. Arrange reporting. Agree where aggregate reports will go and who reviews them. A monitoring policy without a reporting destination does not itself deliver reports to you.
4. Review evidence. Separate authorised services from unknown traffic. Investigate forwarding and other indirect sending paths before changing policy.
5. Strengthen the policy when appropriate. Move towards quarantine or reject once legitimate sending is understood, then test and review the outcome.

What the policies mean

Scope and limitations

The standard offer covers one domain. We confirm the sending systems, required changes and completion criteria before work begins; complex remediation is quoted separately. Enforcement timing depends on the evidence and provider access, not a guaranteed deadline.

DMARC does not stop lookalike domains, every display-name impersonation, compromised accounts or every phishing attack. It does not guarantee inbox placement or eliminate financial loss.

Discuss your domain

Start with your domain and the services you use. We confirm the scope before making changes.