DMARC monitoring for MSPs

For years, DMARC was something security-minded companies did voluntarily. That ended in February 2024, when Google and Yahoo began requiring bulk senders (roughly 5,000+ messages a day) to authenticate with SPF, DKIM, and a published DMARC policy. Mail that failed the new requirements started bouncing or landing in spam, and it kept working fine for everyone who had done the setup.

Microsoft followed in 2025 with matching requirements for its consumer Outlook domains. Bulk mail from domains without proper authentication now comes back with 550 5.7.x rejections. You can check any domain against those requirements with the free Microsoft compliance checker.

Here is why that matters to you specifically: when a client's invoices stop arriving or their marketing blasts bounce, they don't call Google. They call their MSP. Email authentication quietly became part of the managed-services baseline, the same way backup and patching did, and unlike a one-off project, DMARC is an ongoing responsibility across every domain in your book. If you want the protocol fundamentals first, start with What is DMARC? and come back.

DMARC monitoring is built on aggregate reports. When a domain publishes a DMARC record with a rua= tag, every participating mail receiver (Google, Microsoft, Yahoo, and hundreds of others) sends a daily XML report to that address describing every message they saw claiming to come from the domain: the sending IP, whether SPF and DKIM passed, and whether the results aligned with the visible From address.

Reading those reports is how you answer the two questions that matter per domain: which senders are legitimate (the client's mail platform, their CRM, their invoicing tool, the marketing SaaS somebody signed up for last quarter), and who else is out there sending as the domain: misconfigured systems, forwarders, or someone actively spoofing it.

In practice, monitoring means parsing gzipped XML from dozens of receivers per domain per day, resolving IPs to actual services, and tracking per-source alignment over time. For one domain that's a chore. Across an MSP book, it's a data pipeline, which is why nobody does this in a mailbox.

Here is the honest seam in every DMARC conversation: monitoring shows you the problem, and only enforcement fixes it. A domain at p=none delivers spoofed mail exactly as if DMARC weren't there; receivers just tell you about it afterward. Protection starts at p=quarantine, where failing mail is diverted to spam, and is complete at p=reject, where it's refused outright.

The ladder below is the whole rollout in one picture. Monitoring is step one: the listening post where you gather evidence. The value your client is paying for lives at step three.

MSP requirements are different enough from single-company requirements that a great admin tool can be a poor MSP tool. Five criteria do most of the sorting:

• Multi-tenancy: one dashboard for every client, with real per-client separation for reporting and access.
• Per-domain pricing you can quote: published rates you can build into a service price, rather than a custom quote per client.
• Hosted records: SPF, DKIM, and DMARC served from the platform, so changes don't require touching each client's DNS host.
• PSA integration: client and domain import from the system you already run your business on.
• White-label reporting: client-facing reports under your brand, ready for QBRs.

We've compared the major platforms on exactly these criteria (with every vendor claim cited to the vendor's own site) in our roundup of the best DMARC monitoring tools for MSPs. Most established platforms have some MSP answer; they differ widely on which of the five criteria they actually meet.

DMARC management is unusual among security services in that the underlying platform cost is small, published, and per-domain, which makes the service economics easy to model. Palisade's published rate is $9 per domain per month, dropping to $7 from 100 domains and $5 from 1,000, with your own MSP's domain free forever as an NFR (see pricing).

The service-price side is yours to set: there's no standard market rate, and how you package it (a line item, part of a security bundle, included in a premium tier) matters more than the number. But to make the arithmetic concrete: if you charge, say, $25 per domain per month for managed email authentication across a 100-domain book, revenue is $2,500/month against a platform cost of about $700: roughly $1,800/month of gross margin on a service the platform mostly runs. At, say, $15/domain, the same book still contributes about $800/month. These are hypothetical service prices, not market statistics; plug in your own.

The structural point holds regardless of what you charge: because the platform is priced per domain with unlimited email volume and report retention on paid plans, your cost doesn't step up when a client's sending grows, so a fixed-fee service price doesn't get eroded underneath you.