DMARC for Agencies: Turn Email Authentication Into Recurring Revenue

If you run marketing, web, or IT services for clients, you already own the two things DMARC (Domain-based Message Authentication, Reporting and Conformance: the DNS policy that stops strangers from sending email as a domain) touches: the client's DNS and their sending tools. When a client's newsletter lands in spam or their invoices bounce off Gmail's authentication requirements, the ticket comes to you regardless of whether anyone is paying you to handle it.

The choice, then, isn't whether to deal with clients' email authentication: it's whether to do it reactively for free or proactively for revenue. Since Gmail and Yahoo made authentication mandatory in 2024, every client domain has a compliance reason to need this, and most small businesses have no idea the requirement exists until something bounces. That gap between mandatory and unknown is exactly where a productized agency service lives.

The security pitch writes itself, because the threat is concrete. Business email compromise (most visibly, fake invoices sent from a spoofed company domain asking a customer to pay into a new bank account) consistently ranks among the costliest cybercrimes tracked by the FBI's Internet Crime Complaint Center, with reported losses in the billions of dollars each year. Small businesses are preferred targets precisely because they rarely have DMARC enforced: their domains can be spoofed freely.

Walk a client through what p=none means (anyone on the internet can currently send email as their domain, to their own customers, and it will be delivered), and the conversation stops being about deliverability plumbing and becomes about protecting their name. A domain at p=reject makes that spoofed invoice bounce instead of reaching the customer. Few line items on an agency invoice map that directly to 'we stopped someone impersonating you'.

Run it as a productized service with a fixed motion per client, not bespoke consulting. The recurring workload per domain after the initial rollout is minutes per month, which is what makes the economics work.

The clean model is a flat monthly fee per domain, bundled into the retainer or listed as a security line item. Market rates for managed DMARC among agencies and MSPs (managed service providers) run $50-100 per domain per month, with the initial none-to-reject rollout either included at the top of that range or billed as a one-time setup project. Against agency-tier tooling (DMARCPath's agency plan is $39 per month covering your whole portfolio), the margin math is straightforward:

'Can't the client just set this up once themselves?' Publishing a record is a one-time task; DMARC isn't. New sending tools appear and fail alignment, SPF records drift past the 10-lookup limit, marketing hires sign up for platforms without telling anyone. Monitoring is the product, and the monthly report is what makes the ongoing value visible.

'Is this really our lane?' You configured their Mailchimp, their CRM (customer relationship management system), their website forms: every one of those is a sender in their DMARC reports. Nobody else has the access or the context to keep those aligned. And a white-label report with your logo on it makes the point better than any pitch: start with your five most email-dependent clients, run them to p=reject, and put the before-and-after in next month's client pack.