In short
Managed DMARC means a hosted platform that collects your DMARC reports, names every sender and lets you change DMARC, SPF and DKIM records from one place, with a record of each change. We supply EasyDMARC, Valimail and Check Point's DMARC Management add-on, help you set them up and plan each policy move, with terms confirmed at quote.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What DMARC management involves
A DMARC record at p=none tells you who is sending as your domain. Getting from there to an enforced policy, and staying there, is a series of practical jobs. The DMARC standard itself, RFC 9989 section 5.1.7 (opens in a new tab), warns that it "may take many months of consuming DMARC aggregate reports" before a domain owner is sure all of its mail is properly authenticated. A DMARC management platform does most of the heavy lifting:
| Job | What it involves | How a DMARC platform helps |
|---|---|---|
| Collect reports | Receiving XML aggregate reports, usually daily, from the mailbox providers that send them, at the address in your rua tag | Hosts the reporting address, publishes the authorisation record and keeps months of history |
| Identify senders | Working out which service is behind each sending IP address | Names the services (Microsoft 365, your CRM, your payroll provider) and groups them by source |
| Fix SPF | Adding each legitimate sender while staying within SPF's 10 DNS lookup limit (opens in a new tab) | Hosted SPF: EasySPF flattening, Valimail Instant SPF or Check Point SPF Management |
| Fix DKIM (opens in a new tab) | Publishing selector records for each service and keeping them current | Hosted DKIM through a one-time _domainkey delegation |
| Move the policy | Stepping each domain from none to quarantine or reject when its senders pass | Policy changes from a dashboard, with validation, history and rollback |
| Stay at enforcement | Catching new senders, broken records and reports that stop arriving | Alerts, change logs and recommendations per domain |
The end state is not the same for every domain. RFC 9989 section 7.4 (opens in a new tab) says general-purpose mailbox domains whose users may post to mailing lists should not publish p=reject, while the NCSC calls a reject policy on all of your domains (opens in a new tab) the best way to prevent spoofing. Good DMARC management settles which policy suits each domain, using the evidence in your reports. Our DMARC policy guide covers the options.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
How each platform manages your records
The three platforms we supply take different routes to the same job: changing your records without a DNS ticket for every sender or policy step. This is how each one handles the management side, from its vendor's own material:
| Platform | Your DMARC record | Policy changes and change control | Hosted SPF and DKIM |
|---|---|---|---|
| EasyDMARC | Managed DMARC (opens in a new tab): one CNAME at _dmarc, then the record is hosted by EasyDMARC | Changed in the dashboard, with pre-save validation, versioned history and one-click rollback | EasySPF through one TXT record; Managed DKIM through a _domainkey delegation |
| Valimail | _dmarc delegated to Valimail by NS (or CNAME) and managed in Enforce (opens in a new tab) | Policy, subdomain policy, np, testing mode (t) and alignment set in Enforce | Instant SPF macro record; DKIM through a _domainkey NS delegation |
| Check Point DMARC Management | Stays in your own DNS; Check Point hosts the reporting mailbox | Recommendations (opens in a new tab) per domain and a DNS Change-Log (opens in a new tab) of SPF and DMARC changes | SPF Management through an include; DKIM Management through an NS delegation |
For free options, data location and which platform tends to suit which team, see EasyDMARC vs Valimail. The editions we supply are on the EasyDMARC pricing and Valimail Core and Pro pages.
Change control: how policy moves are managed
Moving a domain from p=none to enforcement is a series of controlled changes, not one edit. On a managed platform each change is made, checked and recorded in one place:
- Count every domain you own, including parked and unused ones; the NCSC says all of your domains, including parked domains (opens in a new tab), should have DMARC records
- Hand the record to the platform: publish EasyDMARC's Managed DMARC CNAME or Valimail's _dmarc delegation once, or keep your TXT record and add the platform's reporting address, which is how Check Point's add-on works
- Authorise each legitimate sender in the platform, using hosted SPF and DKIM where that saves DNS work
- Make each policy step from the dashboard, one domain at a time, so the change is validated and logged rather than typed into DNS
- Check the reports after each step and roll back if genuine mail starts failing; a versioned history or change log shows exactly what changed and when
- Keep changes under control: alerts for record errors, new failing sources and reports that stop arriving catch changes made outside the platform
How long to spend at each stage is covered in our DMARC policy guide, and how to set up DMARC covers the first record.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
DMARC for MSPs and multi-site organisations
If you look after domains for several clients, schools, brands or subsidiaries, you need one console with each organisation kept separate. All three platforms we supply handle many domains:
- EasyDMARC offers multi-tenant client management (opens in a new tab), roles and SSO, white-label reports and alerts routed into PSA, SIEM, Slack or Teams, with domains grouped by client, region or tag (DMARC for MSPs (opens in a new tab))
- Valimail Core has native multi-tenancy (opens in a new tab) with strict data separation and role-based access for MSP teams and customer users; Valimail Pro adds API access and advanced alerting
- Check Point creates a dedicated hosted reporting mailbox for every tenant (opens in a new tab) of Check Point Email Security (opens in a new tab)
Multi-academy trusts, charity groups and businesses with several trading names often have more domains than they realise. A DMARC MSP console, or a multi-domain plan, keeps every one of them visible. We can help you count them and pick the edition that fits; see Valimail Core and Pro and EasyDMARC pricing.
UK points that shape DMARC management
We help businesses, schools, charities and public sector bodies across the UK. A few UK points shape most projects:
- NCSC Mail Check has gone. It was retired on 31 March 2026 (opens in a new tab); our DMARC compliance page covers what that means
- Public sector rules. gov.uk's Securing government email (opens in a new tab) guidance requires public sector domains to have DMARC, DKIM and SPF records, to set up DMARC and TLS reporting and to review the data regularly
- Mailbox provider rules. Google, Yahoo and Microsoft require DMARC from bulk senders: Google and Microsoft at 5,000 or more messages a day to their consumer mailboxes (Google (opens in a new tab), Microsoft (opens in a new tab)), and Yahoo at what it calls a significant volume (opens in a new tab)
See DMARC compliance for the UK picture and DMARC sender requirements for the mailbox provider rules.
How we help with DMARC management
We act as your DMARC advisor and supplier: we help you choose the platform and get it working, and your team or your IT provider stays in control of your DNS and email. We can:
- Review your domains: check your DMARC, SPF and DKIM records and list the domains and subdomains you own, including parked ones
- Recommend a platform: compare EasyDMARC, Valimail and Check Point's DMARC Management against your senders, your team and where you want report data processed
- Onboard your domains: the first step is a change to the rua tag, which only changes where reports are sent; EasyDMARC describes this as the only DNS-level change required (opens in a new tab), with mail flow unchanged
- Plan the policy path with you: agree which domains go to quarantine or reject, and in what order
- Help with hosted SPF and DKIM: set up the include, macro or delegation records each platform uses
- Licensing in one place: we supply EasyDMARC and Valimail through the Pax8 cloud marketplace and can bill monthly, with terms confirmed at quote
Contact us for free advice on which DMARC solution fits your domains.
What to have ready when you contact us
A short list helps us give you useful advice straight away. None of it is essential, and we can help you find what you do not have:
- The domains you own, including any you have bought but do not use for email
- Who hosts your DNS (for example your registrar, Cloudflare, Azure DNS or AWS Route 53) and who makes changes to it
- Your main email service, such as Microsoft 365 or Google Workspace
- Other systems you know send email as you: marketing, CRM, finance, HR, ticketing and website forms
- Your current DMARC record, if any: run our DMARC checker and paste the result
- Any deadline, such as a public sector requirement, an insurer's question or a mailbox provider rejecting mail
EasyDMARC, Valimail and Check Point guides
Frequently asked questions
What is managed DMARC?
Managed DMARC is a hosted service that collects your DMARC reports, identifies the services sending as your domains and lets you change DMARC, SPF and DKIM records from a dashboard rather than editing DNS each time. EasyDMARC, Valimail and Check Point's DMARC Management add-on all work this way. We help you choose one, set it up and plan the move to enforcement.
Are there free DMARC services?
Yes. Our free DMARC checker and DMARC generator check and build records. Valimail offers Valimail Monitor (opens in a new tab) free, with a weekly DMARC report, and EasyDMARC offers free public tools (opens in a new tab) and a 14-day trial. Paid platforms add hosted records, alerts and longer history; ask us for a quote.
How is managed DMARC priced?
It depends on the platform: EasyDMARC prices by plan, domains and monthly email volume, Valimail Core and Pro are priced per domain, and Check Point's add-on is licensed per user. Ask us for a quote for your domains and we will compare the options.
Does a DMARC platform sit in our mail flow?
No. DMARC platforms read reports and manage DNS records; your mail keeps flowing through your own email service. EasyDMARC says it runs alongside your mail flow, not inside it (opens in a new tab), and Valimail says pointing your rua tag at Monitor causes no change to your email flow (opens in a new tab).
Can you work alongside our existing IT provider?
Yes. We can supply the platform and help with set-up and the policy plan while your IT provider carries on running your DNS and email. The multi-tenant consoles in EasyDMARC and Valimail let several teams share access with their own roles, so everyone sees the same reports.
How long does it take to reach DMARC enforcement?
It depends on how many domains and senders you have. The NCSC says many organisations move from none to quarantine after about 6 to 8 weeks (opens in a new tab) and from quarantine to reject after about 3 months (opens in a new tab). Domains that send no email can usually be set to reject straight away.
Still have a question about managed DMARC?
Ask us and a member of our team will get back to you.