Email Trust Center
Monitor DMARC and plan email authentication improvements
Understand how your sending sources align with your domain’s email authentication policy. Use the information to investigate failures and plan a controlled path towards appropriate DMARC enforcement.
Before you enforce
Review legitimate mail before changing policy
An enforcement change should reflect the services authorised to send for your organisation. Review alignment, investigate unexpected sources and monitor the effect of each change.
What happens when
- DMARC aggregate reports
- Sent by receiving mail systems on their own schedule, usually once a day. They describe how your mail was authenticated; they do not block anything themselves.
- Enforcement
- Applied by receiving mail systems, according to the DMARC policy your domain publishes.
- Processing in PhishSheriff
- Reports are processed after they arrive. Processing time is separate from when receivers send them.
What it does
DMARC management on the platform
Hosting, migration, progression and audit, from a one-time CNAME to the enforcement level that suits your domains.
Hosted policy
Publish a CNAME once and PhishSheriff can host your DMARC policy. Later policy changes are made on the platform instead of in your DNS.
- One-time CNAME delegation
- Policy served from a managed zone
- Changes made on the platform
- Fewer DNS edits while you iterate
DMARCbis migration
Modernise legacy records
Your record can be updated to the DMARCbis format: obsolete tags removed, a policy for non-existent subdomains added, and subdomain policy made explicit. Changes are validated before they publish and do not weaken enforcement without review.
Guided progression
Move towards enforcement in controlled steps
Advance from none to quarantine to reject when reports show your legitimate senders are aligned, and review the effect of each change.
The enforcement journey
Monitor p=none
Collect reports and identify legitimate sources. Receivers take no action on failing mail.
Test t=y
Optional: validate safely — receivers apply p=none behaviour.
Quarantine p=quarantine
Failing mail routed to spam. Partial enforcement.
Reject p=reject
Failing mail rejected. Full enforcement.
Blind-reject block
Enforcement requested without reporting visibility is held until reporting is in place.
Stale test mode
t=y left on with an enforcement policy beyond 14 days is flagged so you actually enforce.
Prolonged monitor
Stuck at p=none too long? A nudge to review reports and progress toward enforcement.
Weaker subdomain
A subdomain sp or np less restrictive than the parent p is surfaced for review first.
DNS monitoring
DNS records checked for changes
SPF, DKIM, DMARC, BIMI, MX, NS and related records, with alerts for drift, expiry, key rotation, MTA-STS, TLS-RPT and subdomain-takeover risk. Example records below.
Plan your path to DMARC enforcement
Explore the platform with a walkthrough focused on your organisation's priorities, users and email environment.
FAQ
Frequently asked questions
- Does DMARC stop every impersonation attempt?
- No. DMARC helps receiving systems evaluate messages that claim to use a domain based on aligned email authentication. It does not address every lookalike domain, display-name impersonation or compromised-account message.