Reseller playbook · Intermediate · 15 minutes plus a monitoring month

How to publish a DMARC policy — Who Signs Off p=reject on a Client's Domain

Enforcement decides whether a client's invoices get delivered, which makes it their decision to authorise and your job to document.

See Domain Names plans More in How-To Library

Straight answer first

DMARC on a domain you administer but do not own is a governance job before it is a DNS job: publishing p=none is safe and yours to do, while moving to quarantine or reject can stop a client's invoicing platform dead and therefore needs their signature.

Fifteen minutes writes the record. The monitoring month is what makes enforcement survivable, and across a client list it is also the part that needs somewhere sensible for the reports to land and somebody's time booked to read them.

Written by the Hosting Seller staff · Checked 24 August 2026

Intermediate

Skill assumed

Stages to enforcement

Free

Cover included

Tested

Tested on our reseller stack

Written for the reseller or agency holding the DNS. It assumes you manage domains on behalf of businesses whose senders you did not choose and cannot fully enumerate on day one.

The technical work here is small. The commercial work — scoping it, getting the authority in writing, charging for the month of watching — is where the job either pays or quietly costs you.

The sign-off, in writing, before the record changes

Publishing p=none changes nothing about delivery and needs no ceremony. Moving to p=quarantine or p=reject can silently stop a client's payroll notifications, their booking confirmations or the invoices their accountant sends from a platform nobody told you about. That is a business risk sitting on their revenue, not yours.

So get it authorised in an email that names the date, the policy value and the senders you have accounted for. When something does bounce three weeks later, that email is the difference between a scoping conversation and an argument about liability.

Where forty report streams actually go

The rua address receives XML from every receiving provider that sees mail claiming to be the domain. One client is a curiosity. Forty is a mailbox nobody opens, which means the monitoring month has technically happened and practically has not.

Point rua at a reporting service that parses and groups by domain, or at a dedicated mailbox that feeds one. What you must not do is aim it at your general support address, where the reports will be triaged as noise by whoever is on the desk that morning.

The month that is not billable, and how to make it

The gap between publishing p=none and moving to enforcement is real elapsed time in which you are reading reports rather than shipping work. Sell it as a fixed-price project with a defined start and a written outcome, not as goodwill folded into a care plan, or it becomes an obligation you renew annually for nothing.

The deliverable at the end is worth having on paper: a list of every sender using the client's domain, marked as recognised or not. Clients who have never seen that list before tend to find it more interesting than the policy record it was gathered to justify.

What the platform handles, and what it cannot

On a reseller account here, SPF and DKIM for hosting mail are straightforward and the panel does most of the work, so the tripod's first two legs are rarely the obstacle. Daily backups, Imunify360 and AutoSSL run across every client account without being asked, which keeps your attention on the senders you do not control.

What no platform can do is know which third-party services a client signed up for in 2019. That is why the monitoring month exists, and why the report stream stays switched on long after the policy reaches its final value.

The account this playbook assumes

These guides are written against the reseller platform we sell rather than a generic host: WHM, cPanel per client, private nameservers, and limits you set per account.

The renewal price on the tag matches the order price, which makes a client-facing margin something you can plan around rather than defend every twelve months.

Authority and liability handled first
Report handling sized for a client list
The monitoring month scoped as billable work
The senders you cannot see, named as the risk

Why Hosting Seller

On every plan, as standard

Governance before DNS

Starts with whose decision enforcement is, because that is the part that generates the argument.

Sized for a client list

Assumes many domains rather than one, and says where the reports have to go as a result.

The month, made billable

Treats monitoring as a scoped project with a written deliverable instead of unpaid vigilance.

A deliverable clients value

Ends with a list of every sender using their domain — usually the first time anyone has shown them one.

Failure modes named early

Points at the invoicing platform and the booking system, because those are what enforcement breaks first.

Cover while it settles

Support answers at any hour, for you and for the client whose confirmation email has stopped arriving.

First Steps

From choosing to live

1
Get SPF and DKIM aligned first, per domain
DMARC only judges whether the other two line up with the client's domain. Every stream you already know about should be passing and aligned before enforcement is even on the agenda.
2
Publish p=none with a reporting address that scales
A TXT record at _dmarc.clientdomain with p=none and an rua pointing at a parsing service or a dedicated mailbox. Delivery is unchanged; the reports start arriving, which is the entire purpose of this stage.
3
Turn the XML into a list the client recognises
Group the sources by name and mark each one recognised or unknown. The forgotten CRM and the invoicing tool set up by a departed bookkeeper are exactly what this list exists to surface.
4
Move to quarantine on an agreed, written date
With every legitimate sender aligned, set p=quarantine so failures go to spam rather than nowhere. Do it on a date the client has agreed in writing, and not on the Friday before their busiest week.
5
Reject, then keep the reports running
p=reject stops forged mail being delivered at all. Leave the reporting address live afterwards: new services and quiet misconfigurations announce themselves there weeks before they announce themselves as an incident.

In the Box

Packed with every plan

WHM for you, a cPanel of their own for every client
You set the limits each client account gets
Private nameservers under your own brand
Daily backups across every client account
Imunify360 on guard on every client site
The renewal price on the tag matches the order price
Nothing added at setup — no joining fee, ever
A 99.9% uptime target, watched by monitoring day and night
Ready to wire into WHMCS billing
Real people answer, for you and for them

Across the Counter

Things people ask us all the time

Can I publish DMARC on a client's domain without asking them?

p=none, yes — it changes no delivery outcome and it starts the reporting you need. Quarantine and reject are different: they can stop the client's own mail reaching customers, so get the policy value, the date and the accounted-for senders confirmed by email first.

Forty clients means forty report streams — what do I actually do with the XML?

Send it to a parsing service that groups by domain, or to one dedicated mailbox that feeds such a service. Aggregate reports are unreadable at volume by hand, and a monitoring month nobody reads is a month you have spent rather than used.

Is this something I can charge a client for?

It sells well as a fixed-scope project, because the outcome is concrete: authentication finished, enforcement reached, and a written list of every sender using their domain. Folding it into a retainer as goodwill turns a one-off piece of work into an annual obligation.

How many client accounts will a reseller plan actually hold?

Each reseller tier carries a stated number of client accounts alongside its storage and bandwidth, and overselling is enabled so allocation is a decision rather than a hard ration. Moving up a tier is a change to your account, not a migration of the clients on it.

Moving your site to another host? Start with this checklist.

A step-by-step order of work for a move your visitors never spot: which files to copy first, how to carry email across without losing one message, the right moment to repoint DNS, and the two mistakes behind nearly every hour of downtime people ring us about.

Build the hosting line into your business.

WHM, overselling from the start and packages you name yourself — with support that answers your clients too.

See Domain Names plans