Before DMARC can stop spoofing, your CRM, billing, HR, ticketing and marketing tools all have to sign mail with your domain. See what your DNS authorises, which services still lack a DKIM key and whether SPF breaks the 10-lookup limit, then send each vendor a request that says exactly what to fix.
We'll email you about early access, at most twice. No spam; reply STOP to opt out.
Guide: Moving DMARC to p=reject: getting every third-party sender aligned first
Services in your SPF record and DKIM keys at the selectors 35 vendors use, with your MX and policy alongside. Runs in your browser.
RFC 9989 (May 2026) retired pct, rf and ri and added t, np and psd. See what your record should drop or change.
For each service that isn't aligned: a message to its support with what to set up and a link to its own setup page, ready to send.
“It’s a niche service and they are the only worthwhile game in town, and they know it.” (public Spiceworks post on third-party senders and DMARC, Aug 2026)
“we won’t lower our security standards for them” (public Spiceworks post, same thread, Aug 2026)
Had this happen recently? Tell us what happened (4 questions, about 10 minutes, no sign-up).
MSPs: $99/month for 50 client domains, with DMARC reports read for you and vendor follow-ups tracked. The sender check stays free.
We'll email you about early access, at most twice. No spam; reply STOP to opt out.