Managed DMARC for UK Domains

A platform ingests aggregate reports, parses them and shows you what they say. A managed service adds the person who reads the output on a schedule, decides what it means, drafts the record change and writes the report you can table at a management meeting.

The distinction matters because the platform is the easy half. Most organisations that stall on DMARC are not stuck on a technical problem — they published a record, collected reports for a fortnight, and then nobody looked again. Buying managed is buying the second half.

You do. A managed service should recommend the move, show the pass-rate history behind the recommendation and name the residual risk, but the change itself belongs to a named approver on your side with a change window agreed in advance.

That matters more since DMARCbis. RFC 9989 removed the pct= tag, so a policy applies to all of your mail or none of it — there is no partial ramp to soften an incomplete sender inventory. The sequence is p=none, then p=quarantine, then p=reject, with a gate before each step and a rollback window after it.

No. Delegating the record, or the whole zone, means fixes can be applied the day they are identified rather than queuing behind a change board. Plenty of organisations do it for exactly that reason.

The alternative works too: we draft the exact record, before and after, and your team publishes it. It is slower, and slow rollouts are where sender inventories go stale, but it keeps every change inside your own change process. What cannot work is nobody having practical DNS access at all — that is the single most common reason a rollout stops.

Aggregate reports usually begin arriving within 24 to 48 hours of publishing a record with a reporting address, because most large receivers send on a daily cycle.

The rollout itself runs longer. Expect a few weeks at p=none to build a sender inventory you would bet on, then remediation for each legitimate sender, then escalation one domain at a time. Estates with many third-party senders — a marketing platform, a payroll provider, a fundraising tool, a survey system — take longer than an estate that only sends from one mail service. Domains that should never send mail are the exception: they can go straight to enforcement with a null MX record, and on most UK estates that covers the majority of domains.

No, and it is worth being clear about this before anyone buys it as inbound protection. DMARC governs mail sent claiming to be your domain. It does not inspect mail arriving at your mailboxes, so it does nothing about a phishing message sent from a lookalike domain or a compromised third-party account.

What it stops is someone spoofing your exact domain at people who trust it: your customers, your suppliers, your residents, your own staff. That is a real and common attack, and enforcement closes it. Inbound filtering is a separate control that sits alongside it, not underneath it.

You keep the domains, the DNS and the published records — none of that is ours. Three things should happen on the way out: the rua= reporting address is repointed to wherever you want reports to go next, any delegation or verification records we relied on are removed, and the current policy state of every domain is documented in writing so the next owner does not roll enforcement back by accident.

Ask for the sender inventory as a static document as well. It is the most valuable artefact of the engagement, it took weeks of report data to build, and you should not have to rebuild it because you changed supplier.