Your DMARC policy, written for you
A dmarc record with your policy, report address, and subdomain rule, published at _dmarc on your domain.
The Problem
Someone Is Sending Invoices as You, and Nothing Stops Them
It usually comes to light when a client replies to an email you didn't send, or when a mail provider tells you your domain has no DMARC policy.
Spoofed invoices
Fake emails from your exact domain reach your clients' inboxes.
Spoofed invoices
A reject policy tells receivers to refuse mail that fails DMARC for your domain.
Unread reports
Reports go to a mailbox nobody has opened in years.
Unread reports
Reports flow into a tool you own, and we read them weekly during rollout.
Stuck policy
Your policy sits at p=none because nobody dares tighten it.
Stuck policy
Each real sender gets aligned first, so a tighter policy blocks only the spoofers.
Forgotten senders
The payroll tool sends as you but fails alignment.
Forgotten senders
We find it in the reports and fix its SPF or DKIM before enforcement.
A client calls to ask about the bank change in your last email. You didn't send it. Someone used your exact domain in the From line, and it reached their inbox because your domain has no DMARC policy. Or there is one, set to p=none since a consultant added it years ago, sending reports to a mailbox nobody reads. You'd tighten it, but nobody knows whether the CRM, the payroll tool, or the website forms would start bouncing.
We start by publishing a DMARC policy at p=none, with reports going to a tool you own. For a few weeks, those reports show every server sending as your domain. We align SPF or DKIM for each real sender, then step the policy to quarantine and finally reject. From then on, receivers refuse the spoofers, not your own payroll tool.
Reports read, not just collected
Aggregate reports show every sender, and we read them weekly until the domain is clean.
Every sender aligned
SPF or DKIM for each real sender matches your From domain before the policy tightens.
Policy stepped up in stages
None, then quarantine, then reject, with each step checked against the reports first.
Our DMARC Setup Process
From First Record to Reject Policy in Five Clear Steps
You see the sender list from real reports, approve each policy step, and get a weekly note while the domain moves from monitoring to enforcement.
We read your current SPF, DKIM, and DMARC setup and look at how your mail platform signs today. You get a fixed price and a plain note on the risk. If your domain already sits at reject and passes, we'll tell you before we quote.
What's Included
What You Get With DMARC Implementation From Record to Reject
A published policy, a report tool in your name, every real sender aligned, a staged rollout to reject, and a sheet that shows exactly who sends as you.
Compare Options
DeveloperLook vs Report tool alone vs Generic IT provider
A DMARC report tool alone gives you good data, and a general IT provider can publish the record. The gap is who reads the reports and fixes each sender before enforcement.
| Feature | DeveloperLookBest fit | Report tool alone | Generic IT provider |
|---|---|---|---|
| Reading the reports | Weekly, by an engineer | Your team reads them | Rarely read after setup |
| Sender alignment | Fixed for every sender | Shown, not fixed | Main mailbox only |
| Reaching reject | Staged, report-checked steps | Up to you | Often left at p=none |
| Data and dashboards | Report tool in your name | Strong dashboards and alerts | Varies by provider |
| Ongoing cost | One-time project price | Low monthly fee | Hourly or retainer |
| Microsoft 365 and Google | Both, plus every app | Shows both clearly | Usually the main platform |
| Spoofing explained | Weekly plain-language note | Raw data and charts | On request |
| Cost predictability | Fixed price after the check | Predictable subscription | Open-ended hours |
DeveloperLook
Report tool alone
- Reading the reports
- DeveloperLook: Weekly, by an engineerReport tool alone: Your team reads them
- Sender alignment
- DeveloperLook: Fixed for every senderReport tool alone: Shown, not fixed
- Reaching reject
- DeveloperLook: Staged, report-checked stepsReport tool alone: Up to you
- Data and dashboards
- DeveloperLook: Report tool in your nameReport tool alone: Strong dashboards and alerts
- Ongoing cost
- DeveloperLook: One-time project priceReport tool alone: Low monthly fee
- Microsoft 365 and Google
- DeveloperLook: Both, plus every appReport tool alone: Shows both clearly
- Spoofing explained
- DeveloperLook: Weekly plain-language noteReport tool alone: Raw data and charts
- Cost predictability
- DeveloperLook: Fixed price after the checkReport tool alone: Predictable subscription
Projects We've Built
SaaS and Finance Platforms We Have Built
These are SaaS and finance builds, not DMARC projects. Each one sends account, billing, or alert email that its users need to trust.
Oasic Finance SaaS Web Design & Development
- Finance
- SaaS Platform
- Dashboard
Saasmo Recruiting Software Web Design & Development
- Technology
- HR & Staffing
- SaaS Platform
Envitis Investment Website Design & Development
- Finance
- Dashboard
- Website
CognifyHR AI Recruitment Website and HR Dashboard
- HR & Staffing
- Technology
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why IT Teams Trust Us With DMARC Configuration
Tightening DMARC too early blocks your own mail, so our habits are about patience and proof. This is how we keep real mail flowing during a rollout.
No reject without proof
We move to reject only when the reports show every real sender passing. If one can't pass yet, the policy waits and you hear why.
Weekly report notes
You get a short note each week on new senders, failures, and spoofing attempts. You see the rollout move forward instead of guessing.
Your tool, your data
Reports go to a tool registered in your name, not ours. If we part ways, the history and the dashboards stay with you.
Subdomains for stubborn senders
A tool that can't sign with your domain moves to a subdomain with its own policy. Your main domain still reaches reject on schedule.
Spoofing called out plainly
When reports show someone sending as you, we say where it comes from and what reject will do to it. You get a sentence, not raw XML.
Honest about cheaper routes
If a monthly report tool and a few fixes would cover your domain, we'll say so. Some teams only need the data and a short call.
Overview
How does a DMARC setup move a domain from monitoring to reject?
DeveloperLook handles DMARC setup for businesses on Microsoft 365 or Google Workspace, including the CRM and payroll tools that send in their name. We publish a monitoring record, read the reports to find every sender, align SPF and DKIM, and step the policy to quarantine and reject. Projects start at $650, one domain takes 5 to 8 weeks, and reports go to a tool you own.
DEVELOPERLOOK
Project facts · DMARC Setup Services
- Service
- DMARC Setup Services (record, report reading, sender alignment, staged policy)
- Typical timeline
- 5 to 8 weeks for one domain, 8 to 12 weeks for up to 10
- Platforms
- Microsoft 365, Google Workspace, CRMs, payroll, and marketing tools
- Built with
- DMARC aggregate reports (rua), SPF, DKIM, and a DMARC report tool
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of report checks after enforcement
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $650 USD, fixed scope after a free domain check
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
Businesses being spoofed
Your clients received fake invoices from your exact domain, and you want receivers to refuse that mail from now on.
Office 365 tenants stuck at none
Your domain on Office 365 has sat at p=none for years, and you want the DMARC setup on Office 365 finished, not postponed again.
Google Workspace companies
Your team runs on Google Workspace and needs a Google Workspace DMARC setup that also covers the CRM and invoicing tools.
IT teams with many sending tools
You have a long list of apps sending as your domain and need someone to align each one before enforcement.
Agencies handling client domains
You manage several client domains and want DMARC rolled out the same way on each, under your agency's name.
Not a fit
SPF and DKIM fixes only
You only need SPF and DKIM records cleaned up, with no policy work. SPF and DKIM Setup costs less and covers exactly that.
Logo is the goal
Your domain already passes DMARC at enforcement and the goal is a logo in Gmail. BIMI Setup Services picks up from there.
Spoofing became fraud
Money already moved or a mailbox was taken over. Business Email Compromise Response handles the incident first, and DMARC comes after.
Budget under $650
You need help below $650. Many DMARC report tools have a free tier and a setup guide that can get one simple domain to p=none.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for DMARC Setup Services
These are starting points in USD. Your final price depends on your domain and sender count and the weeks of report reading, and you get a fixed proposal after a free domain check.
For Agencies
White-Label SPF/DKIM/DMARC Setup for Agencies and MSPs
You own the client relationship. We supply the rollout: record changes, weekly report reading, and sender fixes, all under your brand. Your client gets a domain at reject, and you keep the account and the credit.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the domains
Send the client domains, their mail platform, and DNS access or an admin contact.
- Client needs
- You share the details
- Details received
We monitor and align
We publish monitoring, read reports weekly, and fix each sender under your brand.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Enforce and hand off
We step each domain to reject and hand you the record sheet for the client.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the domains
Send the client domains, their mail platform, and DNS access or an admin contact.
- Client needs
- You share the details
- Details received
We monitor and align
We publish monitoring, read reports weekly, and fix each sender under your brand.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Enforce and hand off
We step each domain to reject and hand you the record sheet for the client.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
DMARC runs on DNS and the reports receivers send back, so the stack is your DNS host, your mail platforms, and a report tool in your name.
- Microsoft 365
- Google Workspace
Amazon SES
HubSpot
Cloudflare- GoDaddy
- Amazon Route 53
- Namecheap
- DMARC report tool
- Aggregate reports (rua)
Google Sheets
Slack alerts
- Gmail Show original
- Message headers
- dig and nslookup
- Outlook test mailbox
01 / 04
Related Services
DMARC sits on top of SPF and DKIM and opens the door to BIMI. These services cover the steps before, after, and around a rollout.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
SPF and DKIM Setup
DeveloperLook provides SPF and DKIM setup for businesses on Microsoft 365 and Google Workspace. We merge SPF into one entry under the 10-lookup limit, publish a DKIM record for every tool that sends as you, and test real messages before handover.
BIMI Setup Services
DeveloperLook provides BIMI setup services for brands that email their customers. We get DMARC to enforcement, rebuild your BIMI logo as an SVG Tiny PS file, help you apply for a VMC or CMC, and publish the record that Gmail and Yahoo read.This page
DMARC Setup Services
Pairs with the 6 services around it
Business Email Compromise Response
DeveloperLook runs business email compromise response for companies on Microsoft 365 and Google Workspace. We lock attackers out of hijacked mailboxes, run the business email compromise investigation, and add the checks that stop the next fake invoice.
Email Security Services
DeveloperLook provides email security services for teams on Microsoft 365 and Google Workspace. We tune phishing and malware filters, block risky forwarding, enforce MFA, and give staff a report button. It's business email security set up once, then handed to your IT.
Real Estate and Title Company Cybersecurity
DeveloperLook provides real estate and title company cybersecurity built around wire fraud prevention. We map the money path of a closing, protect mailboxes and your domain, and write a wire procedure with callbacks and dual approval for escrow and settlement teams.FAQ
Frequently Asked Questions
Straight answers on DMARC tags, policies, Office 365 and Google Workspace rollouts, cost, and timing.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
DMARC setup starts at $650 for one domain with up to 4 sending services, from the first record to reject. Up to 3 domains and 12 senders costs $1,350, and portfolios of up to 10 domains start at $2,450. Each price includes weekly report reading, sender fixes, the staged rollout, and 30 days of report checks after enforcement.
A single domain takes 5 to 8 weeks from the first record to reject, and up to 10 domains take 8 to 12 weeks. Most of that time is waiting for reports: receivers send them daily, and we want clean weeks at each step. Publishing a record takes minutes, but rushing enforcement is how real mail gets blocked.
Fix SPF and DKIM first, publish a DMARC policy at p=none, read the reports, then tighten the policy in steps. The order matters, because DMARC passes only when SPF or DKIM passes and matches your From domain. Skipping the report stage is how a new policy ends up blocking your own invoices or password resets.
Add a TXT record at your DNS host with the host name _dmarc. A starting value looks like v=DMARC1; p=none; rua=mailto:reports@example.com. Put your report tool's address in the rua tag. Keep a single DMARC entry per domain, and confirm it resolves with dig or a lookup tool before relying on the reports.
The p tag in your DMARC entry sets it: p=none monitors, p=quarantine sends failing mail to spam, and p=reject refuses it. Move one step at a time, after the reports show every real sender passing. Some teams use the pct tag to apply quarantine to part of the failing mail first.
Treat it as a sender project, not a DNS edit. Reports show every service using your domain, and each real one needs SPF or DKIM aligned with your From domain. Marketing and payroll tools often need their own signing records, and anything that can't sign as you moves to a subdomain with its own policy.
To prevent email spoofing domain-wide, SPF/DKIM/DMARC setup goes in that order: SPF, then DKIM, then DMARC. Publish one SPF record with every sender included, switch on DKIM signing in each tool, then add DMARC at p=none. If only the first two need work, SPF and DKIM Setup is the cheaper project.
Office 365 needs three things in order: DKIM enabled for your domain, SPF that includes Microsoft, and a DMARC policy at your DNS host. DKIM uses two CNAME records plus a switch in the Microsoft Defender portal, and the SPF include is spf.protection.outlook.com. The DMARC TXT record goes in your own DNS, wherever the domain is hosted.
Start with the domain in your From addresses, then cover the rest: subdomains through the sp tag, and parked domains with their own reject record. A domain you don't send from can go straight to p=reject with an SPF record of v=spf1 -all. Your main domain takes the slower route, through monitoring first.
Yes, if you send email from your domain: Gmail and Yahoo require one from bulk senders, and receivers use it to judge spoofed mail. Smaller senders benefit too, because without a policy receivers guess what to do with fake mail in your name. A record at p=none breaks nothing and starts the reports flowing.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.