Is your domain being used to scam your customers right now?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS-based standard that tells receiving mail servers what to do when an email claiming to come from your domain fails authentication. Without DMARC enforcement, anyone can send email from your domain — your customers, suppliers and bank cannot tell a real message from a scam. With DMARC at p=reject, those forged messages are blocked at the receiving server before they reach the inbox. It is now the baseline expectation for any business that sends invoices, contracts or payment instructions over email.

SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send for your domain. DKIM (DomainKeys Identified Mail) digitally signs each outgoing message so the receiver can verify it was not altered in transit. DMARC ties the two together: it tells the receiver which check must pass, what to do if both fail (none, quarantine, or reject), and where to send aggregate reports. SPF and DKIM alone are not enforced — DMARC is the policy layer that makes the system useful in practice.

Run the free domain scanner on this page — it checks your SPF, DKIM and DMARC records in about ten seconds and shows the gaps. For a deeper view, ClearEdge sets up DMARC monitoring with aggregate reports from EasyDMARC, which lists every IP address sending email claiming to be your domain over the last 30 days. If you see IPs you do not recognise (often from Eastern Europe, Asia or anonymising services), those are spoofing attempts. Most Pacific business domains we scan show active spoofing activity their owners did not know about.

Only if you skip the monitoring phase. The risk is real — moving directly to p=reject without first verifying every legitimate sender (Microsoft 365, marketing platforms, payroll systems, accounting tools, the CEO's mobile mail app) will silently block your own mail. ClearEdge runs DMARC in monitor mode (p=none) for several weeks first, identifies every legitimate sender from the aggregate reports, fixes their SPF and DKIM alignment, then moves through p=quarantine to p=reject in measured stages. Done this way, the transition is invisible to your team.

A typical Make Email Safe engagement runs 6 to 10 weeks from kick-off to p=reject enforcement. The first week is discovery: inventorying every legitimate sender (rarely fewer than a dozen for a Pacific business). Weeks 2 to 5 are monitor mode, watching aggregate reports to verify the inventory is complete. Weeks 6 to 8 move policy to p=quarantine. The final stage is p=reject. Faster timelines are technically possible but materially raise the risk of blocking real mail. Slower is fine and sometimes warranted for complex environments.

No. Microsoft 365 sets up the basics so you can send and receive mail, but it does not configure DMARC enforcement, monitor authentication failures, or maintain SPF and DKIM as you add third-party senders over time. The default DMARC policy on a fresh Microsoft 365 tenant is p=none — meaning failed messages are still delivered. Make Email Safe is the layer on top of Microsoft 365 that gets you to enforcement and keeps you there as your sending environment evolves.

SPF, DKIM and DMARC configuration and validation, EasyDMARC monitoring dashboard access for your team, a monthly email security report in plain English, managed progression to DMARC enforcement, ongoing DNS record management as you add or change senders, and an escalation path to full Microsoft 365 hardening if you want to extend protection beyond email. New mail providers, marketing tools or payroll changes do not require you to reopen DNS — we manage that change as part of the service.