DMARC Onboarding Checklist for MSP Clients

Introduction

A standardized DMARC onboarding checklist turns the chaos of a new client engagement into a repeatable workflow. This article is the checklist — what to verify, configure, and document in the first 30 days of every new MSP/DMARC engagement.

Why this topic matters

Without a checklist, every onboarding becomes bespoke. The first week is spent rediscovering the same client patterns: who manages DNS, where SaaS senders live, who needs to approve changes. A standard checklist compresses this from days to hours.

Week 1: Discovery and access

[ ] DNS provider access — confirmed working, credentials documented.
[ ] Client point-of-contact — named technical and approval contacts.
[ ] Existing authentication audit — SPF, DKIM, DMARC current state documented.
[ ] Sender inventory — initial list of known sending platforms.
[ ] Initial audit report — delivered to client.

Week 2: Foundation

[ ] SPF gaps identified and fixed. Under 10 lookups, includes every sender.
[ ] DKIM enabled where missing. Custom DKIM at each platform.
[ ] DMARC published at p=none with rua= reporting to your platform.
[ ] TLS-RPT published for future MTA-STS.

Weeks 3-4: Monitoring and baseline

[ ] Aggregate reports parsing — confirm receipt within 24-72 hours.
[ ] Sender list refined — each row attributed to a known platform.
[ ] Remediation plan for any failing senders.
[ ] First monthly report delivered to client.
[ ] Calendar for next milestones — when to move to p=quarantine, then p=reject.

Step-by-step approach to standardizing

Build a template SOW with these milestones.
Create a checklist in your PSA. Every new client gets the workflow.
Document client-specific details — DNS provider quirks, approval cadence.
Automate where possible. Alert when reports arrive, when senders appear.
Review monthly. Where did the checklist fail; update.

Best practices

Hand off proactively. Don't make clients chase you for status.
Document everything. Future engineers and renewal conversations both benefit.
Communicate milestones. Each completed week's box is a status update opportunity.
Standardize the deliverables. Same audit format, same monthly report template.
Track time per client. Discover which clients are profitable.

Recommended next step

If you don't have an onboarding checklist today, write one this week. The standardization gain on the next engagement pays for the work immediately.

FAQ

Should the client see the checklist?

A simplified version, yes. Builds confidence in the process.

What if a step gets stuck?

Most stuck steps are DNS access or sender attribution. Both have known workarounds.

How long should the full rollout take?

8-12 weeks for a typical SME from start to p=reject.

What if a client has multiple domains?

Each domain runs the checklist independently. Parallelize if you have the capacity.

Should the audit be free?

Many MSPs offer the audit free as a sales tool. The rollout and monitoring are paid.

Final thoughts

A standardized onboarding checklist is the difference between a service that scales and a service that depends on heroic individual effort. Build the checklist once; benefit on every engagement.

The MSPs running 50+ client DMARC services all have a version of this checklist. It's that fundamental.