Guide · For MSPs
DMARC for MSPs: getting 50+ client domains to enforcement
Doing one domain is a weekend project. Doing fifty means a system: one place for the reports, a clear order of work, and a standard way to handle the senders that always break.
Start with a triage sheet
List every domain you manage, including the parked ones and old brand names, and record four things for each: DMARC policy, whether rua is set, SPF lookup count, and whether DKIM is on for the main mail platform. You can check each one in seconds with the free checker. Then sort them into three groups:
- Parked or no-mail domains. Take them to
p=rejectwithv=spf1 -alltoday. That's the fastest win, with no risk. - Simple senders (only M365 or Workspace). Turn on DKIM, check the reports for two weeks, then step up.
- Busy senders (marketing, accounting, a CRM, a copier). These need the full p=none to p=reject process.
Send every report to one place
Point every client's rua at one address you control. Reports for 50 domains can easily run to hundreds of XML files a week, so plan to parse them, not read them. If that address is on your own domain, publish the external-destination authorisation record for each client domain, or a wildcard (*._report._dmarc.yourmsp.com).
The senders that break most often
| Sender | Usual fix |
|---|---|
| Copier / scan-to-email | Relay through M365 or Workspace with authenticated SMTP |
| Marketing platform | Publish its DKIM CNAMEs on the client domain |
| Accounting or invoicing | Enable custom-domain DKIM, or send from the platform's own domain |
| Website contact form | Send through an authenticated SMTP service, not the web host |
| SPF over 10 lookups | Drop unused includes; rely on DKIM for the rest |
What to tell clients
Keep it short. Anyone can currently send mail that looks like it's from their domain, and the big mailbox providers increasingly junk or reject mail from domains without DMARC. You'll find every legitimate sender first, so nothing they use gets blocked. Each step is reversible. Most clients approve that in one email.
Make it a line item
Once a domain is at reject, it needs monitoring: new tools appear, keys rotate, and SPF creeps back past 10 lookups. That ongoing watch is easy to bill as part of a security bundle, and it's what stops the support tickets.
ReachReject does this for MSPs. One dashboard for all your client domains, showing every failing sender and the safe next step for each domain. $3 per domain per month, $49 minimum. Send me 5–10 domains and I'll send back a free readiness check within 48 hours.