Introduction
The DMARC question for most organizations isn't "should we do DMARC" — it's "should we run it ourselves or use a managed service." This article covers the decision framework.
Why this topic matters
The wrong choice creates either gaps (under-tooled in-house) or wasted spend (over-managed for a simple setup). Knowing where the threshold sits compresses the decision.
DMARC monitoring (self-service)
You publish DMARC, point rua= at a platform, read reports yourself. Suitable when:
- Sender estate is simple. Microsoft 365 or Google Workspace, a couple of SaaS senders.
- Internal expertise exists. Someone can read the reports.
- Steady-state changes are infrequent. New senders added rarely.
Total cost: $0-500/year for the platform.
Managed DMARC (vendor or MSP)
A vendor or MSP runs the monitoring, remediation, and policy progression for you. Suitable when:
- Sender estate is complex. 10+ SaaS platforms.
- No internal expertise. Email security isn't your specialty.
- Frequent changes. Marketing or product teams add tools regularly.
- Compliance pressure. Auditors want documented monitoring.
Total cost: $1,000-5,000+/year per domain.
The decision factors
Three primary axes:
- Sender complexity. More senders → more value from managed.
- Internal expertise. Less expertise → more value from managed.
- Compliance overhead. More compliance → more value from managed.
Step-by-step approach
- Assess sender complexity. Count senders.
- Assess internal expertise. Honestly.
- Assess change cadence. How often does sender estate change?
- Calculate cost difference.
- Decide; commit.
Best practices
- Don't oversimplify. Even simple estates benefit from managed at compliance-heavy orgs.
- Don't overspend. A 3-sender estate doesn't need a $5k/year managed service.
- Re-evaluate annually. Complexity drifts.
- Test managed services with a pilot. 90-day trial.
- Don't lock into multi-year contracts without confidence.
Recommended next step
Score yourself on the three factors above. The recommendation follows from the scores.
FAQ
Can I start with managed and move to self-service?
Yes — common path. Managed during rollout; self-service in steady state.
Can I start self-service and move to managed?
Also common. Many organizations realize the complexity during rollout.
What about hybrid?
Possible. Managed during transitions, self-service in steady state.
Does company size matter?
Less than sender complexity. A small company with 20 SaaS senders has more complexity than a large company with M365 only.
How long do contracts typically run?
Annual. Multi-year discounts exist.
Final thoughts
The monitoring vs. managed DMARC choice is about where complexity lives. More complexity in the sender estate or compliance landscape favors managed; less favors self-service.
Choose deliberately; re-evaluate annually.