DMARC setup and email deliverability services
Stop people spoofing your domain and help your real emails reach the inbox.
- Records
- SPF · DKIM · DMARC
- Transport
- MTA-STS · TLS-RPT
- Platforms
- M365 · Workspace · Zoho
- Goal
- p=reject
Who our DMARC setup service is for
Our DMARC setup service stops your domain being spoofed and helps your email reach inboxes instead of spam folders. That means correct SPF, DKIM and DMARC records, a staged move to DMARC enforcement and monitoring afterwards.
- Companies whose emails land in spam or are rejected by Gmail and Outlook
- Organisations whose domain has been used for phishing or invoice fraud
- Teams sending outreach or transactional email from several tools
- Businesses asked by customers or auditors to prove DMARC enforcement
Before
- Invoices and alerts landing in spam
- Anyone can send email as your domain
- No visibility of who sends on your behalf
After
- SPF, DKIM and DMARC set up correctly
- Spoofed mail rejected at the gate
- Regular reports on who sends as you
Emails going to spam?
When genuine emails land in spam, the cause is usually one of a handful: SPF missing a sending service or over its 10 DNS lookup limit, DKIM not turned on for your mail platform, no DMARC record, or a marketing tool sending as your domain without alignment. Gmail, Yahoo and Outlook now expect bulk senders to have all three in place.
Start with our free email security check to see your MX, SPF, DKIM and DMARC records in seconds. If something is wrong, we find every service that sends as your domain, fix the records and watch the reports until your mail is delivered reliably.
MTA-STS and BIMI
MTA-STS tells other mail servers to deliver to you only over encrypted, verified TLS connections, so mail cannot be quietly downgraded in transit. It needs a DNS record and a small policy file on a web server; TLS reporting (TLS-RPT) then sends you daily reports of delivery failures. We publish both, start in testing mode and move to enforce once reports are clean.
BIMI shows your logo next to messages in supporting inboxes. It requires DMARC at quarantine or reject, an SVG logo in a specific format and, for Gmail and Apple Mail, a mark certificate (VMC or CMC). We tell you honestly whether it is worth it for your brand.
What you get from DMARC setup
Named documents and outcomes you keep. Scope is agreed per engagement.
- 01
Sender inventory
Every service that sends email as your domain.
- 02
SPF, DKIM and DMARC records
Correct DNS records for each domain and sender.
- 03
DMARC rollout plan
Staged move from p=none to quarantine to reject.
- 04
MTA-STS and TLS reporting
Enforced encrypted delivery to your domain.
- 05
DMARC report reviews
Who is sending as you and whether it passes.
- 06
Deliverability notes
What was changed and why, documented.
How a DMARC rollout runs
Open each phase to see what it produces and who does what.
Sample DMARC deliverable
An illustrative sample with placeholder names and data, not a real client document.
| Source | SPF aligned | DKIM aligned | Result |
|---|---|---|---|
| Microsoft 365 | Yes | Yes | Pass |
| Billing platform | Yes | No | Pass |
| Newsletter tool | No | Yes | Pass |
| Unknown sender | No | No | Fail |
- Stage 1
p=none
Monitor
- Stage 2
p=quarantine
Spam folder
- Stage 3
p=reject
Blocked
DMARC engagement formats
Fixed-scope project
- When it fits
- You have a defined outcome: a migration, a test, a certification or a rollout.
- Included
- Agreed deliverables, a named lead, progress updates and handover.
- How it is priced
- Quoted after a scoping call; the price depends on the number of users, sites, applications or controls in scope.
Ongoing support retainer
- When it fits
- You want someone to run, monitor and improve things month after month.
- Included
- Monitoring, changes, reviews and a monthly report within an agreed scope.
- How it is priced
- A monthly fee quoted after a scoping call, based on users, devices and systems covered.
Advisory hours
- When it fits
- Your team does the work and wants expert review or answers.
- Included
- Calls, document and design reviews, and written recommendations.
- How it is priced
- A block of hours agreed in advance; the rate is quoted after a short call.
DMARC tools we use
- SPF
- DKIM
- DMARC
- MTA-STS
- GoDaddy
- Hostinger
ITCCS is an independent consultancy. Product names and logos are trademarks of their respective owners, shown only to identify the platforms we work with. No partnership, certification or endorsement is implied.
Standards for DMARC
- ISO/IEC 27001Information security, certification-ready ISMSLearn moreRead about ISO/IEC 27001
- NIST CSF 2.0Security programme baselineLearn moreRead about NIST CSF 2.0
- CIS Controls v8.1Practical hardening prioritiesLearn moreRead about CIS Controls v8.1
We implement and prepare organisations for these standards. Certification is issued by accredited bodies.
Related certifications
All certificationsSPF lists the servers allowed to send for your domain. DKIM signs each message so receivers can confirm it came from your domain and was not altered in transit. DMARC tells receivers what to do when a message fails those checks, and sends you reports.
Not if it is staged. We start in monitoring mode, identify every legitimate sender from the reports, fix them, and only then enforce.
Common causes are missing or failing authentication, a poor domain or IP reputation, or content and link issues. We check headers and records to find the actual cause.
Yes, for bulk senders. Google and Yahoo have required SPF, DKIM and a DMARC record from bulk senders since 2024, and Microsoft Outlook.com since May 2025.
Records can be published in a day. Reaching full enforcement usually takes four to eight weeks of reviewing DMARC reports.
The number of domains, the number of services that send on your behalf and whether you want ongoing report monitoring.
We use named accounts with the least access needed, prefer your own admin tools over shared passwords, move files only through encrypted channels and remove our access at handover. For DMARC work we usually need only DNS access, plus read access to your mail platform's admin console to turn on DKIM. Our full practices are on our Trust page.
We keep reviewing DMARC reports so new senders are authorised before they break, either as advisory hours or a retainer.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal