It never steps backwards
The record we host starts no weaker than the one you already have.
Managed DMARC
Stop anyone sending email as your business.
We host your DMARC record, name every service sending as you, and take your domain from watching to refusing fakes in approved steps. Real email keeps arriving throughout.
£99 a month · 3 domains · 5 users14 days before the first payment
What happens, in order
One DNS change. Then we do the rest.
- 01
One DNS change, once
You point your DMARC record at us with a single record. From then on we host it and change it for you, so nobody edits DNS again.
_dmarc CNAME → hosted by OuterMark - 02
Reports start arriving
Google, Microsoft, Yahoo and others send daily reports on the mail that claims to come from you. We read them all.
reports: daily, from every receiver - 03
Every sender gets a name
Each system sending as you is listed with its organisation, network and country. Well-known services are recognised automatically. Our engineers place the rest.
sender: named, never just an address - 04
Fix what would break
Each real sender that fails gets step-by-step SPF or DKIM guidance. A sender counts as fixed once 98% of its recent mail passes.
fixed at: 98% passing - 05
Tighten one step at a time
Quarantine starts at 25% of failing mail, then 50%, then 100%, then reject. A person approves every step.
approved by: an engineer - 06
Stay there
Your live DNS is checked every day against what we host. You get a notice when a step is proposed and when it goes live, and a PDF report every month.
checked: daily
The walk to reject
About four months. On purpose.
We could set reject tomorrow. We will not, because that is how invoices go missing.
- Day 0Observep=none. Reports start arriving.
- About day 30Quarantine 25%Needs 30 days and 100 real messages of evidence.
- About day 60Quarantine 50%At least 30 days after the last step.
- About day 90Quarantine 100%At least 30 days after the last step.
- About day 120RejectNeeds 60 days, 500 messages and mail on 20 separate days.
Reject is never automatic
A rule-based reviewer checks each proposed step. No AI decides anything. Then a person approves it.
Thin evidence means we wait
If your real email is not ready, the step waits. Too little evidence is a refusal, not a guess.
What you see
Who is sending as you, and whether it passes.
The portal answers three questions: are we protected, who is sending as us, and is anyone faking us. Each has its own page.
- Every sender, with how much of its mail passed
- Fake campaigns grouped together, not listed row by row
- An alert only when there is real exposure
- A monthly PDF report, and one on demand
Top sending sources
Microsoft 365
229 messages✓ Legitimate
229 messages✓ Legitimate
Newsletter service
17 messages✓ Legitimate
17 messages✓ Legitimate
Accounts software
13 messagesNeeds a fix
13 messagesNeeds a fix
Also included
The rest of the email stack.
SPF
Managed SPF
We host a flattened record and keep it under the ten-lookup limit as your senders change.
DKIM
DKIM monitoring
Every signing key every sender uses for you, checked every day. We never hold your keys.
MTA-STS
MTA-STS and TLS reporting
Mail delivered to you over an encrypted, verified connection, and a report when it cannot be.
BIMI · Scale plan
Managed BIMI
Your logo beside your emails, once DMARC is enforced.
The 90-day guarantee
If we have not got your domain enforcing DMARC (p=quarantine) within 90 days of onboarding, for reasons within our control, your subscription is free from day 91 until we have.
Quarantine starts after about a month. Reject takes about four months, on purpose, so real email keeps arriving.
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.