DMARC agent that does the work for busy IT Teams

DMARC is an email authentication standard that protects the domain in the visible From address. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the From domain. The domain owner can ask receivers to monitor, quarantine, or reject failures and send aggregate reports. Read the complete DMARC guide.

Email authentication is the set of technical checks receiving mail systems use to verify a message's sending domain and authorized infrastructure. SPF authorizes sending servers, DKIM verifies a domain's cryptographic signature, and DMARC connects those results to the visible From domain. Together, they reduce direct domain spoofing and identify legitimate mail. Learn how email authentication works.

SPF authorizes sending servers, DKIM verifies a cryptographic signature, and DMARC checks whether either result aligns with the visible From domain. DMARC also publishes a policy for failed mail and enables reporting. Most business domains use all three because each standard solves a different part of email authentication. Compare SPF, DKIM, and DMARC.

An SPF record is a DNS TXT record that identifies the mail servers authorized to send for a domain. A receiving server compares the message's sending IP address with that policy. SPF authenticates the envelope-from domain, not the visible From address, and forwarding can break the check. Learn how SPF works.

DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to an outgoing email. The receiving server retrieves the sender's public key from DNS and verifies that the signed content has not changed. A valid signature also shows that the signing domain accepts responsibility for the message. Learn how DKIM signatures work.

Check the public DNS records for your domain, then inspect headers from real messages to confirm that SPF, DKIM, and DMARC pass and align. Palisade provides free SPF, DKIM, and DMARC checkers. A DNS lookup validates the published record, but only message tests reveal sender-specific failures.

Yes—Palisade is built for scale. IT teams, MSPs, and enterprises use our multi-tenant platform to manage anywhere from a handful of domains to thousands from a single dashboard. You can deploy DMARC across your entire portfolio or client base, generate white-label reports, and use our prospecting tools to identify new opportunities. IT teams pay a flat monthly price based on email volume, while MSPs pay per client domain at a rate that improves as their portfolio grows.

Gmail and Yahoo require bulk senders to use SPF, DKIM, and a DMARC record with at least p=none. Microsoft requires domains sending more than 5,000 messages per day to Outlook.com consumer addresses to pass SPF, DKIM, and DMARC. Each provider also sets rules for alignment, spam rates, DNS, and one-click unsubscribing.

Yes, DMARC at enforcement can stop direct spoofing of a protected domain when receiving systems honor the published policy. It does not stop lookalike domains, compromised accounts, or display-name impersonation because those attacks do not directly spoof the protected From domain. See how to prevent email spoofing.

DMARC can support email deliverability by helping mailbox providers authenticate legitimate mail and by exposing configuration problems. It does not guarantee inbox placement; reputation, complaints, list quality, content, and sending patterns still matter. Enforcing DMARC before every legitimate sender is aligned can cause delivery failures. Learn how DMARC affects delivery.

Yes—Palisade has a free plan for one domain you own, with up to 1,000 emails a month. MSPs also get a free NFR (Not For Resale) domain for their own business, so they can test the platform before rolling it out to clients.