Reference

DMARC for MSPs: running DMARC monitoring for client domains, and what the platforms offer

The per-client DMARC routine, DemiSignal affiliate and agency-partner routes, what four other platforms offer MSPs, and an onboarding sequence.

By Updated Last verified

On this page
  1. What the job is, per client domain
  2. Two ways to work with DemiSignal
  3. What the other MSP programmes say
  4. A client onboarding sequence
  5. What to tell the client
  6. Sources

For an MSP, DMARC is the routine RFC 9989 (opens in a new tab) describes for a domain owner, set up a mailbox for aggregate reports, start at p=none, read the reports, fix the legitimate senders that fail, then enforce, repeated for every client you look after, so the platform question is who holds the domains, who reads the reports and who bills. DemiSignal's partner page offers two routes: an affiliate route where the client buys directly and you earn 30% of their payments for 12 months, and an agency-partner route where you bill the client and run DemiSignal under your own brand. A later section covers what EasyDMARC, dmarcian, URIports and Sendmarc say to MSPs on their own pages. This page sets out the job per client, the routes, and an onboarding sequence you can reuse.

What the job is, per client domain

RFC 9989 (opens in a new tab) describes what a domain owner does with DMARC reports, and an MSP does it for each client. Set up a mailbox to receive aggregate reports, because their proper consumption and analysis is essential to any successful deployment and they show the sources of mail using the domain. Start at p=none, so that nothing is missed in the initial SPF and DKIM deployments, and use the reports to audit the client's mail streams; the reports are formatted so that machine parsing is recommended, and many third-party services exist to process them. Then remediate: the reports can reveal mail streams that use the domain but fail DMARC, which may be spoofing or may be a legitimate sender the client forgot, and legitimate streams must be fixed before an enforcement policy is published.

The first step is knowing what the client's domain publishes today. DemiSignal's free check reads the public DNS records of any domain you enter, with no account needed, and runs four checks: SPF, DMARC, DKIM and MX. For DMARC it flags a missing record, a policy of none, no reporting address, a policy that covers only part of the email, and subdomains left at none; for SPF it flags a missing record, a rule that lets anyone send, a soft fail, and a record close to or over the 10 DNS lookup limit. Each check comes back as pass, warning, fail or error, and you get a link to share with whoever manages the client's DNS.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

Two ways to work with DemiSignal

DemiSignal's partner page describes two routes, and you can refer some clients and manage others.

Refer clients (affiliate) Manage clients under your brand (agency partner)
Who pays DemiSignal Your client You
Who supports the client DemiSignal You, with DemiSignal supporting your team
What you earn 30% of payments for 12 months The margin on what you charge clients
Upfront cost None Partner package subscription
Client-facing brand DemiSignal Your agency on reports and messages
How to join Create a free account and get your link straight away; no fee, no application Create an account and submit an agency application with your agency details and the clients you support

The affiliate route is described as best for consultants, bloggers and agencies that recommend tools; the agency route is for MSPs, IT providers and web agencies. For agency applications, DemiSignal checks that you provide client services and follows up with next steps.

If a client would rather hold their own subscription, the plans on DemiSignal's pricing page are sized by domain count: Starter at $19 a month for one business domain, Pro at $49 for a small group of five, Business at $99 for ten, with 100,000, 500,000 and 2,000,000 DMARC-passing messages a month respectively. Every paid plan includes DMARC report monitoring, scheduled email checks and change alerts, and failed or potentially spoofed traffic does not use the message allowance. The pricing page's line for agencies is keeping client domains together, with a clear next step for each one.

What the other MSP programmes say

EasyDMARC's MSP page (opens in a new tab) describes a recurring DMARC service line for MSPs: multi-tenant management with per-client permissions, XML reports turned into readable dashboards, white-label reports under your brand, pay-as-you-go MSP volume tiers, alerts that create tickets in your PSA, and a free 14-day trial. It also names the problems MSPs bring to it, among them that aggregate reports are unreadable raw and need to be visualised, alerted on and tagged to the right client, and that clients keep adding senders that break SPF.

dmarcian's pricing page (opens in a new tab) offers special partner pricing and asks partners to get in touch for pricing options. URIports (opens in a new tab) describes itself as suited to MSPs and security teams that manage DMARC, SPF, DKIM and MTA-STS monitoring for multiple clients from a single account, with client domains grouped by labels and clients invited as team members with access scoped to their own domains; its Stone plan adds 10 domains for USD 12 a month. dmarc.org's products and services list (opens in a new tab) records that Sendmarc offers a white-label service that messaging service providers can offer their customers.

A client onboarding sequence

This is the sequence DemiSignal's tools page lays out: check first, then build what is missing.

  1. Check the domain. Run the free check on the client's domain and send them the shareable link. The results page explains what each result means and what to fix first.
  2. Publish SPF and DMARC. If either is missing, the free DMARC record generator builds a record one step at a time, starting by monitoring with a reporting address, and the free SPF record generator turns the client's sending services into an SPF record with an estimate against the 10 DNS lookup limit. Nothing entered in either tool is saved. See also our guide to the DMARC policy not enabled warning.
  3. Connect reports. On a paid plan, add the client's private reporting address to their DMARC record. Their policy stays the same, and the first report commonly arrives within 24 to 48 hours; each receiving provider controls its own schedule. Our guide to DMARC reports reads one aggregate report line by line.
  4. Review the senders. As reports arrive, review sending IPs, message counts and SPF and DKIM results, and find the services sending as the domain, including ones nobody remembers setting up.
  5. Enforce with evidence. Move from none to quarantine, then reject, once the reports show the client's real senders pass; moving too early can block legitimate email.
  6. Keep watching. DNS records change when someone adds an email tool, moves providers or edits a record by hand; the paid plans check records on a schedule and alert you when something changes.

What to tell the client

DemiSignal's pricing page answers the questions clients ask before they let you touch their DNS. Adding the reporting address does not change enforcement: collect a baseline at p=none, review legitimate senders and fix problems before considering quarantine or reject. Standard DMARC aggregate reports contain no email bodies or recipient addresses, only summarised authentication results, and the reporting address uses a private token rather than the account or customer name. Only messages that pass DMARC through aligned SPF or DKIM count toward the plan; failed or potentially spoofed traffic stays visible and does not use the allowance. Subscriptions are cancelled in billing settings and monitoring continues until the end of the paid period.

Sources

Tools for this

Frequently asked questions

Can I bill clients myself?

Yes. DemiSignal's agency-partner route is for MSPs, IT providers and web agencies that bill their clients and handle day-to-day support; DemiSignal sets you up with partner packages for the client domains you look after. The affiliate route is the alternative: the client pays DemiSignal directly and you earn 30% of their payments for 12 months.

Do I need DNS access to a client's domain?

For the free check, no: it only needs a domain name. For report monitoring, someone with DNS access must add the private reporting address to the rua tag of the client's DMARC record.

Does adding a reporting address change the client's DMARC policy?

No. Adding the reporting address does not change enforcement. Collect a baseline at p=none, review legitimate senders, and fix problems before considering quarantine or reject.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account