Mail that bounces
Messages rejected with codes like 550 5.7.26, 550 5.7.515 or 554 5.7.9 start getting through again.
MainSail Managed DMARC
Get your email delivered. Stop the fakes.
Gmail, Yahoo and Microsoft now turn away email that can't prove where it came from. We fix the DNS records that prove it (SPF, DKIM and DMARC) and keep them right, so your invoices arrive and criminals can't send email as you.
★★★★★ 5.0 on Google (34 reviews) · Serving the Treasure Coast for 20+ years
What it fixes
One set of records, four problems solved
Mail that lands in spam
Authenticated mail is far more likely to reach the inbox at Gmail, Yahoo and Outlook.com.
Criminals sending as you
Once DMARC is enforced, fake invoices and phishing using your exact domain are blocked before they reach your customers.
Not knowing who sends as you
You see every service sending mail with your name on it, including the ones nobody remembered.
Repair or managed
Two ways to fix it
Both start with the same repair. The difference is whether anyone keeps watching after.
| One-time DNS repair | MainSail Managed DMARC | |
|---|---|---|
| What it is | We correct your SPF, DKIM and DMARC records once | The repair, plus ongoing management every month |
| SPF, DKIM and DMARC set up correctly | Yes | Yes |
| Every sending service found and authorized | The ones in use today | Yes, and new ones as they appear |
| New tools you add set up for SPF and DKIM | No | Yes, included |
| DMARC reports read and acted on | No | Yes |
| Moved safely to full spoofing protection (p=reject) | Yes | Yes, watched through each stage and enforced only after a thorough review |
| SPF kept under the 10-lookup limit | At the time of the repair | Automatically |
| Alerts on new or failing senders | No | Yes |
| Reports sent to you | No | On your schedule, if you want them |
What managed means
Managed means watched, not just records
Your DNS records look static, but your email isn't. Every day, Gmail, Microsoft, Yahoo and other mailbox providers send reports on every message that used your domain: which servers sent it, and whether it passed or failed. With MainSail Managed DMARC, those reports come to us, and we act on what they show.
Your policies also stop being fixed text in your DNS. After setup, your records point to our platform, so we can authorize a new sender, adjust SPF or tighten your DMARC policy without anyone editing your DNS again. You get the results without having to read a single report.
Month to month
What happens after setup
The repair is the start. This is the part that keeps going.
| When this happens | What we do |
|---|---|
| You add a tool that sends email (newsletter, invoicing, CRM) | We authorize it in SPF and set up its DKIM signing. That's included. |
| A service changes its mail servers | Managed SPF picks up the change automatically and stays under the 10-lookup limit. |
| An unknown server sends as you | We're alerted, find out what it is, and authorize it if it's yours. If it isn't, it stays blocked. |
| Your real mail starts failing | We see it in the reports and fix the record or the sender's setup. |
| Someone tries to send as you | Once your policy is at reject, mailbox providers refuse it, and the attempt shows up in your reports. |
| Mail to you can't be sent encrypted | MTA-STS TLS reports show it, so the problem can be traced. |
| You want to see it yourself | We send reports on the schedule you choose. If you'd rather not get them, we're still watching. |
Managed DMARC
What's in MainSail Managed DMARC
DMARC report monitoring
Every mailbox provider sends reports about mail using your domain. We collect them, turn them into readable dashboards and act on what they show.
Sender discovery and alerts
Every service sending as your domain is identified, and you're alerted when a new or unfamiliar one appears.
Hosted DMARC policy
Policy changes happen in our console, not your DNS, with a full change history and a staged move from monitoring to quarantine to reject.
Managed SPF
Automatic flattening keeps your SPF record under its 10-lookup limit, so adding one more service never silently breaks it.
Managed DKIM
DKIM signing set up for Microsoft 365 or Google Workspace and each of your other senders, then watched in every report.
MTA-STS and TLS reporting
Hosted policies that tell other mail servers to deliver to you over an encrypted connection, with reports when they can't.
BIMI brand logo
Your logo next to your messages in inboxes that support it, hosted for you. Some providers also require a logo certificate, bought separately.
Reports, if you want them
A plain-English report on who sent as you, what passed, what failed and what we changed, sent on the schedule you choose.
Step by step
How it works
Check
We look at your current records and the bounces or spam problems you're seeing.
Repair
SPF, DKIM and DMARC are corrected for Microsoft 365 or Google Workspace and every other service that sends as you.
Watch
DMARC starts in monitoring mode, so nothing legitimate gets blocked while we learn who sends as you. Valid senders nobody knew about turn up often, such as the industry software a business runs on.
Enforce
After a thorough review shows every real sender passing, the policy moves to quarantine, then reject. Spoofed mail stops.
Keep it right
Managed clients stay covered: new tools set up, problems fixed as the reports show them, and reports sent if you want them.
Questions
Questions we hear a lot.
What do you actually do after the records are set up?
We act on the DMARC reports mailbox providers send every day, authorize new senders, set up any new tool you start using, fix anything that starts failing, and move your policy through quarantine to reject, watching each stage and enforcing only after a thorough review. Your records point to our platform, so these changes don't require editing your DNS.
Do I have to read the DMARC reports?
No. That's our job. If you'd like to see them, we'll send reports on the schedule you choose.
Will this get my email out of spam?
It removes the most common reason mail is rejected or filtered: failed authentication. Content, sending volume and complaint rates also matter, and we'll tell you plainly if something else is going on.
Can DMARC block my own email?
Only if it's enforced before every legitimate sender is set up. It's very common to find valid senders a business didn't know about, such as industry software (practice management, dispatch or property management systems) that emails customers in its name. That's why we start in monitoring mode, watch each stage and enforce only after a thorough review.
Do I need this if I'm a small business?
Yes. Gmail requires every sender to authenticate, and without an enforced DMARC policy anyone can send email that appears to come from your domain.
What does it cost?
The DNS repair is a one-time price; Managed DMARC is a monthly subscription. Both are quoted free after we look at your domain.
Email bouncing, or worried someone's sending as you?
Tell us your domain and what you're seeing. The quote is free.