1. p=none, visibility
Publish reporting and inventory every legitimate sender. The policy does not request DMARC based rejection or quarantine, so it is primarily a phase for learning and correction.
All services
DMARC, stop spoofed email from your domain.
Without DMARC, anyone can send email that looks like it comes from your domain. We implement SPF, DKIM and DMARC in a structured way, from initial reporting to full enforcement (p=reject), and keep monitoring so no legitimate flow breaks.
Check DMARC for your domain
Enter a domain and we'll fetch the published DMARC record straight from DNS and explain each tag.
SPF / DKIM / DMARC
Report analysis
Anti-spoofing
Sender inventory
Stepwise enforcement
p=reject as goal
What's included
- Review of existing SPF, DKIM and DMARC records
- Inventory of every legitimate sender (CRM, billing, marketing)
- Correct SPF setup without exceeding the 10 DNS lookup limit
- DKIM signing with key rotation
- Stepwise tightening of DMARC policy: none → quarantine → reject
- Ongoing analysis of aggregate (RUA) and forensic (RUF) reports
- Alerts on new unknown sender sources or delivery issues
How it works
A clear process from inventory to ongoing protection.
- 1
Inventory
We map every system that sends email on your behalf and review your current DNS records.
- 2
Baseline
DMARC is published with p=none so we can collect reports without affecting delivery.
- 3
Tuning
We fix SPF/DKIM for legitimate flows and shut out unknown senders.
- 4
Enforcement
Policy is tightened stepwise to p=quarantine and finally p=reject with full monitoring.
From reporting to enforcement
The path from p=none to p=reject
The right pace is determined by representative report data and actual sending cycles, not a fixed number of days. SPF or DKIM also needs to align with the visible From domain before the policy is tightened.
2. p=quarantine, controlled tightening
When report data shows that legitimate SPF and DKIM flows are aligned, failed messages can be requested for quarantine. Continue reviewing delivery and new senders.
3. p=reject, enforcement
At p=reject, recipients are asked to reject messages that fail DMARC for the exact domain. Keep monitoring because legitimate systems and sending patterns change over time.
p=reject is a policy to receiving systems, not a guarantee against every kind of impersonation. Lookalike domains require other controls.
Read the DMARC guideWhy DMARC is business-critical.
Phishing and CEO fraud almost always start with a spoofed sender. Without DMARC you have no control over who sends email in your name, and no protection for your customers, partners or staff. With DMARC at p=reject, spoofing becomes technically impossible while your own legitimate email gets better delivery at Gmail, Outlook and Yahoo.
Spoofing
Stopped at the recipient.
Brand safety
No one can impersonate you.
Visibility
Reports on all email.
Better delivery
Fewer end up in spam.
Vanliga frågor