What DMARC and Email Authentication Tools Are
Written by MSP Outpost.
In Short
Email authentication proves that mail claiming to come from a client's domain really did. SPF lists the servers allowed to send, DKIM signs each message, and DMARC tells receivers what to do when a message fails and sends back reports. Tools in this category collect those reports, make them readable and help move each domain safely to enforcement.
What It Does
- Report collection. Receives the DMARC reports receivers send and turns them into a view of who is sending as the domain.
- Sender discovery. Shows which services send mail for the domain, so legitimate ones can be fixed and unknown ones investigated.
- Guided enforcement. Helps move a domain from monitoring to quarantine to reject without blocking real mail.
- Record management. Some host the DNS records so SPF, DKIM and DMARC changes are made in one place, and help with SPF lookup limits.
- Extras. BIMI to show a logo in supporting inboxes, and MTA-STS or TLS reporting to protect mail in transit.
- Alerts. Notice when a new sender appears, a record breaks or a domain stops passing.
When You Need One
Publish a DMARC record in monitoring mode for every client domain and read the reports. Even a free or low-cost report viewer shows you who is sending as the client.
Dozens of domains make manual report reading impossible. Look for a multi-tenant console, a repeatable path to enforcement, and hosted records so a change does not need DNS access each time.
Enforcement across the whole base becomes a service you sell and report on. Expect to manage third-party senders, BIMI requests and MTA-STS, and to want branded client reports.
How It Is Priced
Pricing is usually per domain each month, or per volume of mail analysed, with tiers that add hosted records, more history or white-label reports. Watch for minimum domain counts, extra charges for high mail volume, and whether parked domains that send no mail still count.
Switching
Moving report collection is simple: change the reporting address in the DMARC record. The harder part is hosted records, because your DNS may point at the vendor, so plan to bring those records back before you cancel. Keep a copy of the sender inventory, since that work is the real asset.
Questions to Ask a Vendor
- Is it priced per domain or by mail volume, and do parked domains count?
- Can I host the records so changes do not need DNS access, and how do I take them back?
- How does it handle the SPF ten lookup limit?
- How long are reports kept, and can I export them?
- Can I white-label reports and give each client read-only access?
- How do you help me reach enforcement without blocking real mail?