Email security · DMARC, SPF and DKIM · Dubai, Muscat and Doha
DMARC setup and monitoring
We find every service that sends mail as your domain, fix SPF and DKIM, and move your DMARC policy to reject without losing a single legitimate invoice email.
Why set up DMARC with us
Since 2007in the Middle East, 1,500+ active cloud customers, offices in Dubai, Muscat and Doha.
Microsoft Solutions Partner for Modern Workand Google Cloud Premier Partner: we set up DKIM signing inside Microsoft 365 and Google Workspace as part of the same work.
We design, deploy and supportMimecast and Proofpoint, both of which include DMARC reporting tools.
English and Arabicsupport, on GCC working hours.
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks, and sends you reports on who is using your domain. Gulf Infotech, serving businesses across the Middle East since 2007, sets up SPF, DKIM and DMARC and monitors the reports until your domain reaches p=reject.
- p=nonereports start
- Map sendersevery service found
- Fix SPF and DKIMeach sender aligned
- p=rejectspoofing refused
What does DMARC protect you from?
DMARC stops mail that uses your exact domain. It does not stop lookalike domains such as yourcornpany.com. For those you need email security with impersonation detection.
Exact-domain spoofing
a fraudster sends "from" accounts@yourcompany.com to your customers with new bank details.
CEO and supplier fraud inside your company
fake mail from your own managing director asking finance for an urgent transfer.
Phishing that uses your brand
messages to your customers that look like your invoices or delivery notices.
Poor deliverability
your own invoices and newsletters landing in spam, or being refused by Gmail, Yahoo and Outlook.com, because your domain is not authenticated.
How does DMARC stop spoofing?
Every email carries a "From" address that anyone can type. DMARC lets the owner of a domain publish a rule in DNS that receiving mail servers check on every message: does this email really come from a server the domain owner authorised (SPF), and is it signed with the domain's own key (DKIM)? If neither check passes for your domain, the receiver follows your DMARC policy: deliver it and report it (p=none), send it to spam (p=quarantine) or refuse it (p=reject). At p=reject, a fraudster can no longer send mail that shows your exact domain, and the daily reports show you every server that tried.
DMARC data is also useful beyond email. The reports and authentication results can feed a SIEM (security information and event management) tool, so a spoofing campaign or an attack on your email infrastructure is spotted early and contained before it spreads to other systems or critical platforms.
Do you need a separate DMARC tool?
Not always. If you want an email platform with DMARC built in, Zoho Workplace Professional includes DMARC functionality and reporting in the package, with no additional solution to buy. If you use another platform, such as Microsoft 365 or Google Workspace, we provide DMARC as a standalone service or through a DMARC tool that fits your requirements, and we can run it for you as a managed service.
What do Gmail, Yahoo and Outlook.com require from senders?
All three large mailbox providers now require authentication. If your domain sends more than 5,000 messages a day to their users, the rules are stricter.
| Requirement | Gmail (Google) | Yahoo | Outlook.com, Hotmail, Live (Microsoft) |
|---|---|---|---|
| All senders | SPF or DKIM, valid forward and reverse DNS, TLS, spam rate below 0.3% | SPF or DKIM, valid forward and reverse DNS, spam rate below 0.3% | Not stated separately |
| Bulk threshold | More than 5,000 messages a day to Gmail accounts | Bulk senders | More than 5,000 emails a day |
| SPF and DKIM | Both | Both | Both must pass |
| DMARC | Required, policy can be p=none | Required, at least p=none | Required, at least p=none |
| Alignment | From domain aligned with SPF or DKIM domain | Aligned with SPF or DKIM (relaxed is fine) | Aligned with SPF or DKIM, preferably both |
| Unsubscribe | One-click for marketing mail, plus a visible link | One-click, honoured within 2 days | Recommended: a clearly visible unsubscribe link |
| In force since | 1 February 2024 | February 2024, phased | 5 May 2025; non-compliant mail rejected with error 550 5.7.515 |
Takeaway: p=none satisfies the minimum, but it does not stop spoofing. Only quarantine or reject does that. Google also asks for DKIM keys of at least 1,024 bits and recommends 2,048.
What do p=none, p=quarantine and p=reject mean?
Reaching p=reject takes care, and the usual blockers are forgotten senders: the ERP that emails invoices, the HR system, the website contact form, a marketing platform, a scanner in the office.
p=none (monitor): receivers deliver mail as usual and send you reports. Use it to discover every service sending as your domain.
p=quarantine: mail that fails DMARC goes to the recipient's spam or junk folder.
p=reject: mail that fails DMARC is refused. This is the goal, and the only policy that fully protects your domain.
How do we take your domain to p=reject?
Parked domains get SPF and DMARC records that refuse all mail from day one. Microsoft recommends authentication for unused domains as well, because attackers spoof them too.
Domain check
review current SPF, DKIM, DMARC, MX and reverse DNS for each of your domains, including parked domains that never send mail.
Publish p=none with reporting
start collecting aggregate reports from receivers.
Map your senders
identify every service in the reports and decide which are legitimate.
Fix SPF and DKIM
enable DKIM in Microsoft 365 or Google Workspace and in each third-party sender, and align each sender with your domain.
Quarantine, then reject
tighten the policy in stages, typically over several weeks (an indicative estimate that depends on your senders and requirements), checking reports at each step.
Monitor (managed service)
health checks for new senders and spoofing attempts, record updates when you add a new system, and a quarterly report with what to fix.
Can you set up BIMI and the verified logo in Gmail?
Yes, end to end. BIMI shows your logo next to your emails, but it is not a one-click fix. SPF, DKIM and DMARC must first be aligned and at enforcement; then a Verified Mark Certificate (VMC) is issued for your registered logo, the BIMI record is published, and everything is checked. We arrange the VMC and do the configuration and deployment. Registering the trademark is done by your company. See the blue verified checkmark in Gmail.
Which requirements does DMARC help with?
Requirement: Gmail, Yahoo and Outlook.com sender rules
How DMARC, SPF and DKIM help: Mandatory for senders above 5,000 messages a day; keeps your mail out of spam and out of rejection
Requirement: Customer and bank security questionnaires
How DMARC, SPF and DKIM help: DMARC at reject is a common question in vendor reviews
Requirement: Cyber insurance and audits
How DMARC, SPF and DKIM help: Shows a documented control against domain spoofing
How much does DMARC setup cost?
DMARC itself is a free DNS record. You pay for the work and, if you want it, a reporting tool. We price the implementation per domain. We recommend our managed DMARC service: health checks and quarterly reports, with guidance on fixing any issue we find, so spoofing stays in check. The work is usually larger for companies with many third-party senders or many domains. As a dmarcian partner, we run DMARC reporting with dmarcian, and reporting tools are also available in Mimecast (DMARC Analyzer) and Proofpoint (DMARC Manager in 365 Total Protection, and Email Fraud Defense for larger companies). We quote in OMR, AED or QAR (USD for Saudi Arabia, Kuwait and Bahrain), with VAT shown separately (Oman and UAE 5%, Saudi Arabia 15%, Bahrain 10%, Qatar and Kuwait none).
DMARC support in your country
Frequently asked questions
Not sure what your domain publishes today? We check it for you.
What is DMARC setup and monitoring?
DMARC setup means publishing a DMARC record and making SPF and DKIM pass and align for every service that sends mail as your domain. Monitoring means reading the daily reports receivers send back, spotting new senders and spoofing, and moving the policy from p=none to quarantine and then reject. Gulf Infotech does both for companies across the Middle East.
How much does it cost per user/device?
DMARC is not priced per user or device. The DNS record is free, and we price the implementation per domain. We recommend adding our managed service, with health checks and quarterly reports that show what to fix. The effort depends on how many systems send mail as your domain, such as your ERP, CRM and marketing tools. We quote in your local currency with VAT shown separately.
Do you manage it for us?
Yes. We publish and update the records, read the DMARC reports, add new senders when you adopt new systems, and alert you when someone tries to spoof your domain. You keep control of your DNS, and we make changes with your approval. If your IT team prefers to run it, we hand over a documented sender list and record set.
Which compliance frameworks does it help with?
DMARC, SPF and DKIM are required by Gmail, Yahoo and Outlook.com for senders of more than 5,000 messages a day. They are also standard questions in bank, insurer and enterprise customer security reviews, where DMARC at p=reject is the expected answer.
Is p=none enough to stop spoofing?
No. A p=none policy only asks receivers to send you reports; spoofed mail is still delivered. It meets the minimum Gmail, Yahoo and Microsoft require from bulk senders, but protection starts at p=quarantine and is complete at p=reject. We use p=none only for the first weeks, to find every legitimate sender before tightening the policy.
Will DMARC stop our own emails from being delivered?
Not if it is done in stages. Moving straight to p=reject without mapping your senders can block legitimate mail from your ERP, website forms or marketing tools. That is why we start at p=none, fix SPF and DKIM for every sender found in the reports, and only then move to quarantine and reject.
Check your domain
Send us your domain names and we will review SPF, DKIM and DMARC, then tell you what is missing and what it takes to reach p=reject.