DMARC, SPF & DKIM consulting and support for secure email delivery.
Design, implement and troubleshoot DMARC, SPF and DKIM to improve email security, reduce domain abuse and support reliable email delivery across your organization.
Email authentication diagnostic
An illustrative authentication result showing successful authentication but failed alignment.
Domainexample.comSPFPASSv=spf1 include:spf.protection.outlook.com ~allSPF AlignFAILsmtp.mailfrom does not align with header.fromDKIMPASSselector1._domainkey.example.netDKIM AlignFAILd=example.net does not align with header.fromDMARCFAILp=quarantine; pct=100FindingFAILNeither authenticated mechanism aligns with the RFC5322.From domain.What we help you achieve
Practical consulting and support to design, implement, troubleshoot and maintain your email authentication framework.
DMARC strategy and implementation
Design and implement a phased DMARC approach aligned with your domains, legitimate sending sources and business requirements.
Authentication alignment and policy enforcement
Review SPF and DKIM authentication and alignment, then support appropriate DMARC policy decisions for your organizational domains.
SPF design and record management
Review SPF records for authorized senders, unnecessary includes, DNS lookup constraints and configuration issues, then design an appropriate structure for legitimate sending services.
Reporting and monitoring
Configure and review available DMARC reporting, including aggregate reporting, to identify sending sources, alignment failures and policy impact.
DKIM configuration and validation
Configure and validate DKIM signing for supported platforms, selectors and sending domains, including Microsoft 365 and applicable third-party senders.
Third-party sender management
Review authentication for marketing platforms, business applications and other authorized third-party senders that use your domains.
Troubleshooting and issue resolution
Investigate SPF, DKIM, DMARC, alignment and authentication-related deliverability issues using DNS, headers and reporting evidence.
Ongoing support and policy tuning
Review aggregate reporting, identify changes in sending sources, adjust authentication configuration and support controlled policy progression toward stronger enforcement where appropriate.
How email authentication fits into your environment
A simplified view of how SPF and DKIM authentication feed into DMARC alignment and policy evaluation before delivery.
Our DMARC, SPF & DKIM consulting process
A structured approach to design, implement and optimize your email authentication framework.
Understand
Review your domains, sending sources, business requirements and current authentication state.
Analyze
Evaluate SPF, DKIM and DMARC configuration, reporting evidence and potential gaps.
Design
Develop the target authentication design, policy approach and implementation plan.
Configure & Deploy
Implement agreed SPF, DKIM and DMARC configuration changes in a controlled manner.
Validate
Confirm authentication, alignment and expected DMARC policy behaviour.
Monitor & Optimize
Review reporting, tune policy and adapt authentication as your sending environment changes.
Example: DMARC analysis and resolution
An illustrative example showing how authentication evidence can be used to investigate a third-party sender alignment issue.
- Environment
- Microsoft 365 with an authorized third-party marketing platform
- Issue
- DMARC aggregate reporting shows alignment failures for external campaigns
- Investigation
- Reviewed aggregate-report evidence, SPF authorization, DKIM signing domain and representative message headers
- Finding
- Messages authenticated successfully but neither SPF nor DKIM aligned with the organizational From domain
- Resolution
- Updated third-party sender authorization and DKIM configuration, validated alignment with the organizational domain and confirmed the expected DMARC result
<record>
<row>
<source_ip>203.0.113.10</source_ip>
<count>1250</count>
<policy_evaluated>
<disposition>quarantine</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
</record>Domain: example.com SPF: v=spf1 include:spf.protection.outlook.com include:marketing.example ~all Authentication: PASS Alignment: FAIL Reason: envelope domain differs from RFC5322.From domain
Selector: mktg1 Signing domain: vendor.example.net Authentication: PASS Alignment: FAIL Reason: d= domain does not align with RFC5322.From domain
From: Campaign Team <campaign@example.com> Return-Path: bounce@vendor.example.net DKIM-Signature: d=vendor.example.net; s=mktg1; Authentication-Results: spf=pass; dkim=pass; dmarc=fail
Finding: SPF and DKIM authenticated but did not align Action: sender authorization and DKIM signing configuration updated Validation: aligned authentication confirmed for representative messages Result: expected DMARC evaluation achieved
What you receive
Clear findings, practical recommendations and hands-on support appropriate to the scope of the engagement.
Detailed findings
Current-state authentication analysis, identified gaps, evidence and recommended actions.
Configuration guidance
Practical guidance for agreed SPF, DKIM and DMARC configuration and policy changes.
Validation results
Confirmation that agreed authentication and alignment behaviour is operating as expected.
Knowledge transfer
Walkthrough of findings, configuration decisions and operational considerations with your team.
Ongoing support options
Assistance with agreed monitoring, report analysis, policy tuning and future authentication changes where required.
Frequently asked questions
Common questions about our DMARC, SPF and DKIM consulting services.
What is DMARC and why is it important?
DMARC uses SPF and DKIM authentication results together with domain alignment and a published policy. It can help domain owners understand sending activity and define how participating receivers should handle messages that fail DMARC evaluation.
What DMARC policy do you recommend: none, quarantine or reject?
There is no single policy that is appropriate for every domain. The right progression depends on your sending inventory, authentication coverage, alignment, reporting evidence, business risk and readiness for enforcement.
Do you help with SPF and DKIM configuration?
Yes, within the agreed scope. This can include SPF sender authorization and record design, DKIM configuration and validation, selector review, alignment analysis and related troubleshooting.
How is a DMARC, SPF & DKIM engagement scoped?
The scope depends on the number of domains and sending sources, current authentication state, reporting availability, third-party senders, target policy and the level of implementation or ongoing support required.
Can you analyze and interpret DMARC reports?
Yes. Aggregate-report data can be reviewed to identify sending sources, authentication results, alignment failures and trends that inform remediation and policy decisions.
Do you provide ongoing support and monitoring?
Ongoing support can be considered where it forms part of the engagement, including agreed report review, authentication changes, sender onboarding and policy tuning.
Do you assist with third-party and application senders?
Yes, where supported and within scope. We can review how authorized third-party platforms and applications authenticate mail using your domains and help address SPF, DKIM or alignment requirements.
Can you help with deliverability issues related to authentication?
Yes. We can investigate authentication and alignment evidence alongside DNS, message headers and relevant mail-flow information to determine whether SPF, DKIM or DMARC configuration contributes to a delivery issue.
Secure your domain and improve email delivery.
Whether you are implementing DMARC for the first time, troubleshooting authentication issues or strengthening an existing configuration, we can help you understand the evidence and implement an appropriate path forward.
Discuss Your Requirement