White-label DMARC: what it covers and what it can't hide
If you resell DMARC monitoring under your own brand, the branding is not vanity: your client hired you, trusts you, and should see your name on the thing they are paying for. Every vendor with a partner program knows this, so every one of them says 'white-label.' The claims are not equivalent, and one piece of the product can never be hidden by anyone. Here is what white-label actually covers, surface by surface, so you can evaluate any vendor's claim, including ours.
The surfaces that can carry your brand
A DMARC service touches a client in four places, and each is a separate white-label claim worth checking individually.
The client portal
The deepest version is a portal on your own hostname, something like dmarc.your-msp.com, with your logo, your colors, and no vendor name in the page, the tab title, or the certificate chain your client would ever look at. The shallow version is the vendor's own domain with your logo in a corner. The question to ask: whose hostname is in the address bar when my client logs in?
Reports, alerts, and sign-in links land in your client's inbox. Full white-label means they are sent from your domain, which requires the vendor to walk you through authorizing their sending infrastructure for your domain: DKIM keys and an SPF include, published once in your DNS. If the vendor cannot send as you, every branded report arrives from an address your client has never heard of, and the From line undoes the branding.
Reports
The monthly summary is the artifact your client forwards to their boss, so it is the highest-value branding surface: your name and logo on the masthead, no vendor footer. Check the printed and PDF versions specifically; more than one product brands the web view and stamps the vendor on the export.
Your own console
Some vendors also skin the console your technicians use. This is the least important surface, your team knows who the vendor is, but it keeps demos coherent when a client is looking over a shoulder.
What no vendor can hide: the DNS
DMARC works because your client publishes records in their own DNS, and DNS is public. The record that matters here is rua=: the address receiver reports are mailed to, which lives in the vendor's report-collection infrastructure. Whoever collects the reports, their collection domain appears in your client's DMARC record, where anyone who queries the DNS can see it. Most vendors in this market collect on domains that carry their own name; a few use neutrally-named collector domains, which hides the brand from a casual look but still is not yours. Domain ownership verification records work the same way.
How much this matters is worth being honest about: your client will never look at their own TXT records, and the person who might, a technical auditor or a rival MSP running a DNS query, can identify the underlying vendor of almost any white-label service in any industry with enough effort. The branding that shapes the client relationship is the portal they log into, the emails they receive, and the report with your name on it. The DNS is a technical residue, not a relationship surface. But a vendor who claims total invisibility is overclaiming, and that should tell you something about their other claims.
Questions to ask any vendor
Five questions separate the marketing from the product: Does the client portal run on my hostname, and who handles the certificate? Do client-facing emails send from my domain, and what DNS do I publish to make that work? Is the monthly report, including the PDF, free of your name? What appears in my client's DNS, and do you say so out loud? And is white-label included at my size, or gated behind a partner tier with a minimum?
Where we stand
So this article passes its own test: our white-label covers the client portal on your hostname, every client-facing email from your verified domain, the monthly reports, the embeddable scanner, and your console chrome, included from your first domain. Report collection stays on our domain, in your client's DNS, and we tell you that upfront rather than hoping nobody runs a query. The full claim set, published pricing included, is on the MSP page.
Keep reading
Was this page helpful?
Free for one domain. Set up in five minutes. We parse the reports; you read plain-English summaries.