One of three services built on your Senders list
Managed DMARC
Stop publishing
a DMARC policy you're afraid to enforce.
Managed DMARC keeps your record published and advances it from monitoring to enforcement when your Senders are passing — not on a made-up schedule. The Advisor watches your real mail traffic, surfaces senders you never added, and tells you the one next step. You still own the record; reclaim it anytime.
Why DMARC enforcement stalls
The DMARC standard offers three policies: none, quarantine, and reject. Only the last two actually protect your domain. The first one just tells you what's happening.
Most teams ship p=none and stop. Aggregate reports start arriving. They're noisy, hard to read, and any move toward enforcement risks breaking legitimate mail. So the policy sits at none forever.
The fix isn't more reports. It's a clear answer to one question: are my senders ready for enforcement? Managed DMARC answers that — and acts on it when the answer is yes.
Two ways to use mxio for DMARC
It's not all or nothing. Hand the record to us, or keep it yourself—either way you see every sender and get a clear path to enforcement.
Managed
We keep your DMARC right
You point your _dmarc record at mxio once. We keep it published and advance it from monitoring toward enforcement as your senders come into alignment. You still own the record and can reclaim it anytime.
Guided / self-managed
You keep the pen
Keep managing your own _dmarc record. mxio's DMARC Reporting and the Advisor show you every sender, flag what's failing alignment, and tell you exactly what to publish and when it's safe to enforce. You make the DNS changes. See DMARC Reporting →
How Managed DMARC works
Add your domain
When you add a domain on Pro or Business, we build the managed DMARC record automatically. Pre-populated with p=none + an rua= pointer to our parser. No wizard, no copy-paste TXT strings.
Publish one CNAME
Replace your existing _dmarc TXT (or add it if you don't have one) with a CNAME pointing at <token>.dmarc.mxdns.io — a hostname unique to your domain. One DNS change on your end. We control everything behind it.
We watch. You approve. We deploy.
Reports come in. When authorized senders are reliably aligning, we propose tightening from p=none → quarantine → reject. You see the projection, the senders that would be affected, and the friction tier. One click to approve. We publish.
What's included
Record managed for you
The same delegation pattern as Managed SPF. You point one DNS record at mxio. We publish the actual DMARC record, rotate rua= addresses as needed, and keep tags in sync with policy decisions.
Aggregate reports parsed + classified
Every DMARC report we receive is parsed, deduplicated, and classified into authorized passing, authorized failing, forwarded, recognized unauthorized, and unknown — the same five buckets you see in DMARC Reporting.
Enforcement readiness scoring
We track alignment rate, authorized-message volume, forwarding signal, and anomaly history. Policy tightening is gated on real readiness — never a calendar timer. The Advisor tells you exactly which gate isn't ready yet.
Friction-tiered policy changes
Moving from p=none to quarantine is a small step. Going to reject with pct=100 is a big one. Every policy change ships with a friction tier; the biggest ones require typed-domain acknowledgement before deploy.
Subdomain-aware
Organizational-domain DMARC inheritance is handled correctly per RFC 7489 §6.6.3. Subdomains can have their own policies, or inherit. The Advisor walks you through which policy applies where.
Change history + provenance
Every DMARC record write logs timestamp, deployer, rationale, and the resulting record hash. When a customer asks why their DMARC policy changed last Tuesday, the answer is one click away.
Available on Pro and Business
Managed DMARC is included in Pro and Business. No add-on, no per-domain billing — the plan price covers it.
- 10 domains
- DMARC Reporting included (150k/mo)
- Managed SPF + Managed DMARC, every 30min checks
- 25 domains
- DMARC Reporting included (500k/mo)
- Managed SPF + Managed DMARC, every 5min checks
If you're already on Pro for Managed SPF, Managed DMARC is included — no upcharge. Compare all plans →
Not sure if you need this?
Check your current DMARC record. We'll show you the policy, the rua= destinations, and flag any record-level issues — no account needed.
Check your DMARC record →Related guides
Three services, one Senders list
Every mxio managed service is built on the same registry of who sends mail as your domain.