Navigating DMARC mandates: What MSPs & MSSPs should know

DMARC: A global mandate & industry standard

DMARC, Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) have shifted from being best practices to globally mandated or highly recommended standards.

Key regulatory & industry drivers

1. PCI DSS v4.0 compliance: The Payment Card Industry Data Security Standard (PCI DSS) v4.0 highlights email authentication mechanisms such as DMARC, SPF, and DKIM as recommended best practices.Starting 31 March 2025, companies will need to implement a similar solution to detect and protect against phishing attempts to meet mandatory requirements for compliance. For MSPs and MSSPs with clients who manage payments, meeting these mandates is a must.
2. Google and Yahoo bulk email requirements: As of February 2024, Google and Yahoo required businesses that send over 5 000 emails daily to authenticate their domains with Transport Layer Security (TLS), DKIM, SPF, and a DMARC policy of at least p=none.In Q4 2023, Neil Kumaran, Group Product Manager at Google’s Gmail Security & Trust group, said, “Many bulk senders don’t appropriately secure and configure their systems, allowing attackers to easily hide in their midst. To help fix that, we’ve focused on a crucial aspect of email security: the validation that a sender is who they claim to be.”
3. Government & regional mandates:
   • The U.S. government’s Binding Operational Directive 18-01 mandates DMARC with a p=reject policy for federal agencies
   • Government agencies in Canada must implement SPF, DKIM, and a DMARC policy of p=quarantine at a minimum
   • Government departments in the UK must have a published DMARC policy of p=reject
   • Public service bodies in Ireland need to enforce SPF, DKIM, and DMARC for inbound emails
   • Denmark has mandated that all authorities enforce a DMARC policy of p=reject
   • In the Netherlands, SPF, DKIM, and DMARC are required under the “Comply or explain” principle
   • New Zealand government agencies are required to adopt a DMARC policy of p=reject
   • National organizations in Saudi Arabia must implement DMARC, SPF, and DKIM
4. Cyber insurance policies: Increasingly, cyber insurance providers request implemented email authentication protocols, including DMARC, as requirements for coverage. Due to the rising cost of data breaches, which increased by 10% in 2024, these are becoming standard.

For a deeper dive into email regulations related to DMARC, be sure to visit our regulators page for in-depth information and more resources.

Why MSPs & MSSPs should adopt DMARC

Gain a competitive edge

MSPs can stand out by offering DMARC services. By staying ahead of these trends, your business can position itself as a proactive, trusted expert in the cybersecurity industry.

Reduce client risk

Email spoofing and phishing are leading cyberthreats. By providing a DMARC solution to your clients, you reduce the chance of them experiencing successful attacks, which could result in financial and reputational damage.

Build customer trust

MSPs and MSSPs that prioritize email security are more likely to gain and maintain customer trust. This trust can lead to higher client satisfaction and loyalty, as these organizations feel confident that their data, as well as that of their customers, is secure.

Address compliance requirements

Many clients now need a solution such as DMARC to comply with legal standards or secure a cyber insurance policy. By adding DMARC to your company’s offerings, you simplify compliance for clients and enhance the value of your services by joining the thriving DMARC market, expected to be worth $1.72 billion by 2028.

Effective DMARC implementation

Implementing DMARC can be challenging, particularly for organizations with large or complex email systems, but the long-term benefits are worth it.

MSPs and MSSPs can partner with a DMARC provider to support their clients throughout this process, from assessing domains to enforcing policies and providing ongoing monitoring.

Practical steps for MSPs and MSSPs