Managed DMARC and Email Deliverability Monitoring

A full cycle per monitored domain: reading the DMARC aggregate reports and classifying every source, investigating failing and unknown senders, authenticating new platforms raised through the intake (DKIM, SPF within the lookup limit, alignment verified), holding the domain at its agreed policy, triaging deliverability incidents against the providers' published requirements, watching MTA-STS and TLS-RPT where you have them, and delivering a per-domain report with a short review. It costs $95 per monitored domain per month with no long-term commitment.

Two groups. Organizations that completed DMARC implementation — with us or with anyone — and have nobody reading the reports since. And marketing-heavy senders whose mail volume puts them squarely under Google, Yahoo, and Microsoft's bulk-sender rules, where a single unauthenticated platform or a policy that drifts can cost a campaign. If your DMARC record has a rua address and nobody has opened a report in months, this is the missing role.

Because reject is a policy, not a state of nature. The implementation authenticated every sender that existed on handoff day; the runbook we left you covers adding the next one safely — if someone remembers to use it. In practice, new platforms get connected by well-meaning teams, vendors change their infrastructure, and each change silently fails alignment until the reports are read. This service is the discipline of reading them every month and acting, so the enforcement you paid for keeps protecting you instead of quietly blocking your own mail.

Yes — that is what the onboarding baseline is for. We review the published records, rebuild the sending-service inventory from report data if no runbook exists, and flag in writing what is already broken. Ordinary cleanup is absorbed into the first cycle. If the baseline shows a domain still at p=none with unidentified senders and no inventory, that is an implementation project — we will say so plainly and route you to it rather than charge a monthly fee to watch a policy that protects nothing.

Ideally, they tell us first through the intake — then we enable DKIM with the platform, add it to SPF without breaching the 10-DNS-lookup limit, publish the DNS changes (or hand them to your DNS owner ready to paste), and verify alignment in the next report before the first campaign goes out. If they do not tell us first, the reports tell us within a day or two: the platform shows up as a failing source, and the same work happens — just after some mail has already been quarantined. The monthly allowance in your service order covers a defined number of these; a wave of new platforms is quoted as a small project.

We can find out why, quickly, and fix it if it is an authentication problem — which it often is: a platform signing with the wrong domain, an SPF record over the lookup limit, alignment failing after a vendor change. Microsoft rejects non-compliant high-volume mail to Outlook.com, Hotmail, and Live mailboxes outright with a 550 5.7.15 error, and Google applies its bulk-sender rules similarly. If the finding is that authentication passes and the problem is reputation, spam-complaint rate, list quality, or missing one-click unsubscribe, we say so in writing and tell you what to change on the platform side — that repair is yours or a separately quoted program, not something we pretend the monthly fee covers.

No, and we would distrust anyone who does. Mailbox providers decide placement using signals nobody outside them fully sees: authentication, alignment, reputation history, complaint rates, engagement, content. What we guarantee is the part that is knowable and fixable — that your domains stay properly authenticated, aligned, and enforced, and that every incident gets a written, honest finding. Authentication is the floor the providers demand; we keep you standing firmly on it.

Per domain: every sending source seen and its volume, SPF and DKIM pass and alignment rates, unknown and spoofing sources identified, the policy state and any changes with reasons, new senders authenticated, incidents raised and their findings, MTA-STS and TLS-RPT status where applicable, and recommendations. It is written so a cyber-insurance questionnaire, an auditor asking for evidence of email-spoofing controls, and a marketing lead asking why the campaign bounced can all read the same document.

The allowance is the number of new sending services the monthly fee authenticates, agreed in your service order at onboarding and sized to how often you add platforms. It is what makes a flat per-domain price honest. When a month brings more — a marketing reorganization that connects four tools at once — we queue the rest to the next cycle or quote the wave as a small project, and we tell you which at intake.

Not for this service. Report collection and parsing are provided as part of the service — your DMARC records point their rua address at the reporting destination we operate, and we do the reading. If you already pay for a DMARC analytics platform and want to keep it, we can work from it by agreement; the price does not change either way.

If your domains have them, we watch them: the policy file and its expiry, the certificate behind it, and the TLS reports from providers that send them, so transport encryption does not silently fall back. Exchange Online supports MTA-STS for inbound mail once you publish the policy, and enforces it outbound on its own. If your domains do not have MTA-STS yet, implementing it is a small separately quoted project — worthwhile for organizations that handle sensitive correspondence, and not required by the Google, Yahoo, or Microsoft sender rules.

Direction. Those services protect your users from other people's mail — inbound filtering, anti-phishing, anti-spoofing, safe links and attachments. This service protects the world from mail pretending to be you, and keeps your legitimate mail deliverable — outbound authentication, enforced and maintained. Most organizations need both; they solve different problems and are deliberately priced apart.

Monthly, at $95 per monitored domain in the agreed scope, with domains added or removed by a service-order change. There is no long-term contract: stop any month, and all we ask is payment of previously approved invoices. Everything the service produced stays yours — the reports, the inventory, and every record we published. Your DMARC records can point their reports anywhere you like the day after.

The first monthly cycle is the onboarding: GDAP access, the record review, inventory confirmation, report routing, and the service order. From the second cycle the service is in steady state. If we performed your implementation, onboarding is mostly a handover to ourselves and the inventory already exists; if not, the first report reading sets the pace, and any structural problems are named in writing before we promise anything against them.