Stop your domain being used to scam your own customers.
SPF, DKIM and DMARC being present in your DNS isn't the same as your domain being protected. Monitored DMARC takes a domain from 'technically configured' to actively enforced — with someone watching the reports and tightening the policy as it's safe to do so.
Getting DMARC switched on is easy. Getting it enforced safely is the actual work.
DMARC tells receiving mail servers what to do with email claiming to be from your domain that fails authentication: let it through, quarantine it as spam, or reject it outright. Set the policy too aggressively without watching the reports first, and you can silently break legitimate mail from your CRM, invoicing platform or marketing tool. Set it too loosely, and a scammer can keep sending convincing fake email as you indefinitely.
Monitored DMARC is the middle path: start in monitoring mode, read the reports to see who's actually sending mail on your behalf, fix or confirm each legitimate sender, then move the policy toward quarantine and reject with confidence rather than guesswork.
Already had SPF/DKIM/DMARC set up?
If Suburban Secure configured your Microsoft 365 or Google Workspace tenant, the records exist — this service is the ongoing monitoring and policy enforcement layer on top.
See managed email hostingWhat a monitored DMARC service actually does.
Every email claiming to be from your domain is checked against your DMARC policy and either passed, quarantined or rejected. Reports on that activity are compiled and reviewed so nothing drifts quietly out of enforcement.
- Preventing spoofing and impersonation. Blocks unauthorised use of your domain in phishing and invoice fraud attempts sent as if they came from you.
- Trusted delivery. Confirms every legitimate sender — your own mail platform, marketing tool, invoicing system — is properly authenticated so your own email keeps landing in the inbox, not spam.
- Enforced quarantine and reject. Moves your policy from monitor-only to actually directing receiving mail servers to quarantine or reject unauthenticated mail, once the reports show it's safe to do so.
- MTA-STS for transport security. Requires encrypted transport between mail servers where supported, reducing exposure to interception in transit.
- Catching misconfigured third-party senders. Identifies marketing platforms, CRMs or invoicing tools sending on your behalf with weak or missing authentication, before they become the gap.
- Staying ahead of mailbox provider requirements. Google, Yahoo and Microsoft continue to tighten what they'll accept from bulk and business senders — enforced DMARC keeps you ahead of that rather than scrambling when a threshold changes.
- Ongoing DNS and policy monitoring. Unexpected changes to your email-related DNS records get noticed and flagged, not discovered months later.
Who this is for.
Any organisation that sends email — or whose domain could be impersonated even if it barely sends any — benefits from this. That covers Microsoft 365 and Google Workspace mailboxes as well as the marketing, CRM and invoicing platforms sitting alongside them: tools like Mailchimp, Xero, or whatever your fundraising or CRM platform happens to be. Suburban Secure works with both businesses and charities on this, and the setup conversation covers whatever's actually sending mail as your domain, not just the inbox.
Straightforward pricing, scoped to what's actually sending your mail.
Exact cost depends on how much mail your domain sends and how many domains and sending services need to be covered, confirmed after a short discovery conversation. As a guide:
- Ongoing monitoring: around $30 per month per domain, covering report review and policy management as it moves toward enforcement.
- Initial setup: typically 2–3 hours, covering a check of your existing email platform (Microsoft 365, Google Workspace, or another mail/marketing platform), plus coordinating with your website provider where DNS access sits with them.
- Additional domains or sending services added after the initial setup are usually around an hour each to bring under monitoring.
We monitor using reputable DMARC reporting tools — starting with free-tier options where they genuinely fit, and recommending paid, enterprise-grade platforms for larger organisations or anyone sending significant mail volume. Which tool fits is part of the discovery conversation, not a fixed choice.
Confirmed before anything starts
These are guide prices, not a quote — the actual scope is confirmed once we've seen what's sending mail as your domain today.
Request DMARC setupNot sure if your domain is already exposed?
The free cyber security check looks at your domain's current SPF, DMARC and DKIM signals — an instant, plain-English starting point before any conversation about monitoring or enforcement.
Prefer a no-signup domain-only check? Use Can They Email As Me?, our dedicated SPF, detectable-DKIM and DMARC checker, then review its public methodology.
Common question
What are DKIM, DMARC and SPF, and why do they matter? They're DNS records that prove an email claiming to be from your domain actually came from a system you authorised. Without them properly configured and enforced, it's straightforward for a scammer to send a convincing fake email that appears to come from your business — and your own outgoing mail is more likely to land in spam.
See all frequently asked questionsWeb developer or agency untangling a client's DNS or email delivery? See technical help for agencies.