A DMARC setup service puts your domain's email authentication in order so that receivers can tell your real messages from forged ones. We list every service that sends mail as your domain, configure SPF and DKIM for each, publish a DMARC record and move its policy step by step to quarantine or reject. Your invoices and website mail pass authentication, and receivers that apply DMARC can reject messages forged with your domain.
Why mailbox providers now ask for DMARC
The large mailbox providers made authentication a condition of delivery in 2024. Google's sender guidelines took effect on 1 February 2024: every sender to Gmail needs SPF or DKIM, and senders of more than 5,000 messages a day need SPF, DKIM and a published DMARC record, with the From domain aligned. Yahoo's sender requirements, in force from February 2024, ask bulk senders for the same and state that DMARC must pass.
The second reason is fraud. A domain without an enforced DMARC policy can be used in fake invoices and payment-change requests that look like they come from your accounts team.
SPF, DKIM and DMARC in plain terms
Each of the three records answers a different question for the receiving server. Together they decide whether a message claiming to be from your domain is accepted.
| Record | Question it answers | Source |
|---|---|---|
| SPF | Is this server allowed to send mail for the domain? | Google sender guidelines |
| DKIM | Was the message signed by a key the domain published? Google asks for keys of at least 1024 bits and recommends 2048 | Google sender guidelines |
| DMARC | Does SPF or DKIM pass for the same domain shown in From, and what should the receiver do if not? Policy values are none, quarantine and reject | RFC 9989 (May 2026) |
| One-click unsubscribe | Required by Gmail and Yahoo for bulk marketing and subscribed mail | Google; Yahoo |
| BIMI | Logo display; Gmail requires an enforced DMARC policy and a VMC or CMC | Google Workspace Admin Help |
DMARC itself was updated this year. RFC 9989, published in May 2026 as a Proposed Standard, replaces RFC 7489. It removes the old pct tag and adds a test-mode flag, so records copied from older guides may carry settings the new standard no longer uses.
How we move a domain to an enforced policy
The safe path to quarantine or reject starts with the list of senders and ends with real messages checked at each step. Skipping the inventory is how companies block their own invoices.
- Inventory. We list every system that sends as your domain: the mail host, the website and its forms, newsletter and CRM tools, invoicing, helpdesk, booking and payment systems.
- Authentication per sender. Each service gets DKIM signing with your domain and, where needed, a place in SPF within the lookup limit. Website mail goes through an authenticated service.
- Monitoring policy. DMARC is published with p=none while we send test messages from every sender and read the authentication results in the headers.
- Enforcement. The policy moves to quarantine, then to reject, once every legitimate sender passes.
- Subdomains and parked domains. Domains that never send mail get records that reject all mail claiming to come from them.
What you receive
You get configured records, a list of your senders and a record of what changed.
- Configured SPF, DKIM and DMARC records on each domain in scope, with the final policy agreed with you.
- The sender register: every service that sends as your domain, how it authenticates, and who owns it on your side.
- A before-and-after report of authentication results.
- Mailbox recommendations: multi-factor sign-in, forwarding rules, external forwarding alerts.
- On request, BIMI preparation: logo file in the required format and the DNS record, once you hold the certificate.
What we need from you
We need access to DNS for each domain, administrator access to the mail host (Google Workspace, Microsoft 365 or another), a contact for each sending service, and a signed scope letter listing the domains.
Boundaries
The work covers authentication of your domains and the services that send as them. Delivery rates also depend on your sending reputation, list quality and content, which stay under your control and your senders' control. Mailbox providers make the final decision on each message. The VMC or CMC for BIMI is issued by a certificate authority to your company directly.
Risks of copying a record from a forum or a chatbot
A DMARC record copied from an example often arrives with p=reject on day one, or with tags from the replaced RFC 7489. The first visible result is usually missing invoices or a newsletter bouncing.
An SPF record grown by each new tool can exceed the DNS lookup limit set in RFC 7208 and fail for every message. A freelancer who sets the records once rarely knows which department added a sending tool last month. We work from the full sender inventory, test each step and hand over the register so the next change does not break mail.
Who does the work
The contract is with INNOVA CONSULT LTD., Ottawa, Ontario (Corporations Canada, Corporation Number 1522612). The team set up DMARC, DKIM and SPF on the group's own domains and keeps its own servers and more than 80 websites under daily vulnerability checks.
Cost
A fixed price is set in the scope letter after a 30-minute call. It depends on the number of domains and sending services.
Related services
- Website security audit includes a DNS and mail review.
- Website security monitoring watches DNS records for changes.
- Hacked website repair if your server was used to send spam.
- Mail hosting and servers from scratch: turnkey IT infrastructure. All cybersecurity services.
Sources (checked 2026-10-23)
- Google Workspace Admin Help, Email sender guidelines.
- Yahoo Sender Hub, Sender best practices and requirements.
- IETF, RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) and RFC 7489 (obsoleted).
- IETF, RFC 7208: Sender Policy Framework (SPF), section 4.6.4 on DNS lookup limits.
- Google Workspace Admin Help, Set up BIMI.
Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.