Smart DMARC
DMARC tells receiving mail servers what to do with mail that fails authentication. The hard part was never the record — it is knowing when you can safely enforce it.
Publishing a DMARC record takes five minutes. Almost every organisation gets that far. Then the aggregate reports start arriving as compressed XML from a dozen mail providers, and progress stops.
The reason is rational caution. Somewhere in your organisation a system sends legitimate mail that nobody has documented — a billing platform, a recruitment tool, a monitoring alert, a regional office that set up its own campaign account. Move to reject before that source is aligned and you break real business mail. So the policy sits at p=none, collecting data nobody has time to read, and the domain stays spoofable.
DMARCS parses every report you receive and resolves the sending IPs back to named services, so instead of a list of addresses you get a list of senders: this is your CRM, this is your payroll provider, this is something in Vietnam you have never authorised.
From there the path is concrete. Each unaligned source is flagged with what is failing and what fixing it requires. When nothing legitimate is failing any more, the platform tells you the domain is ready — and you tighten the policy knowing what will happen.
No parsing required
Sender visibility
The actual goal
The same three questions come up on every rollout.
Who is sending as us right now? Every source appears in one inventory with volume, pass and fail rates, and whether it aligns on SPF, DKIM, or neither. Shadow IT tends to surface in the first week.
What breaks if we enforce today? Before any policy change, the platform models it against your live traffic and names the senders that would start failing — so the decision is made on data, not on a change-freeze calendar.
Are we still safe next quarter? Enforcement is not a finish line. New vendors get added, records drift, and subdomains appear. Continuous monitoring flags regressions and alerts you when a new unaligned source starts sending.
Something not covered here? Talk to our team.
No, and you should not. The sequence that works is p=none while you build a complete picture of your senders, p=quarantine once the legitimate ones are aligned, then p=reject. Skipping the middle step is how organisations end up rolling back after a support queue fills with missing invoices.
It stops one specific and very common attack: mail sent from your exact domain by someone who does not control it. It does not stop lookalike domains, which are registered elsewhere, and it does not stop mail sent from a genuinely compromised mailbox. Both need separate controls, and we will tell you that rather than oversell.
Subdomains inherit the organisational policy unless you set sp= explicitly. Forgotten subdomains are a favourite route for attackers precisely because teams enforce the parent domain and stop there. Every subdomain that reports traffic appears in your inventory.
For a single domain with a handful of senders, a few weeks. For a portfolio with many business units, longer — the constraint is how quickly you can reach the owners of each sending system, not the platform.
