In short: Sophos DMARC Manager is a Sophos Email add-on that analyses DMARC reports, shows SPF, DKIM and DMARC results for every sender using your domains, helps manage the DNS records, and guides you from monitoring to an enforcing policy. It is included with Sophos Email Plus and available as an add-on for Sophos Email and the Email Monitoring System.
Why DMARC matters
Anyone can send an email that claims to come from your domain. Criminals use this to send fake invoices to your customers, fake payment change requests to your suppliers, and phishing to your own staff that appears internal. Three DNS-based standards work together to stop it:
- SPF publishes the servers and services allowed to send mail for your domain
- DKIM adds a cryptographic signature that proves a message came from your domain and was not altered
- DMARC tells receiving mail servers what to do with mail that fails those checks (nothing, quarantine or reject) and asks them to send you reports
The hard part is not publishing a DMARC record; it is reaching an enforcing policy (`p=quarantine` or `p=reject`) without blocking legitimate mail from your CRM, invoicing system, marketing platform or helpdesk. That needs you to read the DMARC reports, which arrive as large XML files that are hard to interpret by hand.
What Sophos DMARC Manager does
- Report analysis: collects and processes DMARC reports and presents them as summary and detailed views in Sophos Fusion
- Sender visibility: shows which services are sending email as your domain, which are authorised, and which are failing SPF or DKIM
- Spoofing detection: highlights unauthorised senders using your domains
- DNS record management: guided management of SPF, DKIM and DMARC records to reduce manual errors
- Process automation: automates repeatable maintenance tasks as senders and requirements change
- Guided enforcement: a structured path from monitoring (`p=none`) to enforcement, with clear actions at each stage
- Multi-domain and MSP use: manage DMARC visibility across several domains or customer tenants
It complements the inbound SPF, DKIM and DMARC checks that Sophos Email already performs on mail you receive. DMARC Manager is about protecting your domain when others receive mail claiming to be from you.
A practical route to p=reject
- Publish a monitoring record (`p=none`) with reporting turned on, so DMARC Manager starts receiving reports
- Inventory your senders: use DMARC Manager to list every service sending as your domain, from Microsoft 365 or Google Workspace to marketing, CRM and billing platforms
- Fix authentication for each legitimate sender by adding it to SPF or setting up DKIM signing, and remove services you no longer use
- Move to quarantine and watch the reports closely for legitimate mail that starts failing
- Move to reject once legitimate mail is consistently passing
- Keep monitoring, because new services and changes to existing ones can break authentication later
Do not forget domains you own but never send from. They can be locked down with a reject policy straight away, which stops criminals using them.
UK context: NCSC guidance and mailbox provider requirements
The UK's National Cyber Security Centre (NCSC) email security and anti-spoofing guidance covers SPF, DKIM and DMARC together, with DMARC used to tell receiving servers how to handle mail that fails the checks and to send you reports. The NCSC also offers a free, instant email security check that tests whether a domain is configured in line with its guidance; DMARC Manager helps you act on what it finds.
The major mailbox providers now expect authentication too. Since 1 February 2024, Google's sender guidelines have required everyone sending to personal Gmail accounts to use SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC. Even if you send less than that, authenticated mail is more likely to be trusted by receiving servers.
Strong email authentication also supports your UK GDPR duty to keep personal data secure, by making it harder for criminals to impersonate you to customers and staff.
Licensing
| You have | How you get DMARC Manager |
|---|---|
| Sophos Email Plus | Included |
| Sophos Email | Add-on |
| Sophos Email Monitoring System | Add-on |
| No Sophos email product | Talk to us about the right starting point |
Ask us for a quote. If you would buy Sophos Email plus the add-on, we will also price Email Plus so you can compare.
How we help
We set up DMARC Manager, review the first few weeks of reports with you, identify every legitimate sender, fix SPF and DKIM with your suppliers, and agree a timetable to move to quarantine and then reject. We also lock down parked domains and keep an eye on reports afterwards.
Contact us to start your route to p=reject.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Sophos DMARC Manager?
Sophos DMARC Manager is an add-on for Sophos Email that analyses DMARC reports, shows which services send email as your domain, helps manage SPF, DKIM and DMARC DNS records and guides you to an enforcing DMARC policy.
Is Sophos DMARC Manager included with Sophos Email?
It is included with Sophos Email Plus. For Sophos Email and Sophos Email Monitoring System customers it is an add-on.
What does p=reject mean in DMARC?
p=reject tells receiving mail servers to refuse email that claims to be from your domain but fails DMARC checks. It is the strongest DMARC policy and the end goal for stopping domain spoofing.
How long does it take to get to DMARC p=reject?
It depends on how many services send email for your domain. Simple setups can move in a few weeks; organisations with many third-party senders often take a few months. Reading the reports is what sets the pace.
Does the NCSC recommend DMARC?
Yes. The NCSC's email security and anti-spoofing guidance covers SPF, DKIM and DMARC, and the NCSC offers a free email security check to test whether your domain is configured in line with that guidance.