Email Authentication for Agencies: Managing SPF, DKIM, and DMARC for Multiple Clients
Managing email deliverability for multiple clients requires a systematic approach. Here's how agencies can efficiently set up and monitor authentication across their entire client portfolio.
The agency challenge
Agencies managing email for multiple clients face a unique challenge: each client has different email stacks, different DNS providers, and different sending services. One client uses Google Workspace and Mailchimp; another uses Microsoft 365 and HubSpot; a third runs their own mail server.
Without a systematic approach, authentication issues fall through the cracks: a client's DKIM key expires, SPF breaks when a new ESP is added, or a blacklisting goes unnoticed for days. Each of these incidents damages client trust and generates emergency support work.
Per-client authentication monitoring checklist
| Check Item ↕ | Frequency ↕ | Alert Threshold ↕ | Tool/Method ↕ |
|---|---|---|---|
| Domain blacklist status (all 60 lists) | Hourly | Any new listing | IsMyEmailBlacklisted or HetrixTools |
| Sending IP blacklist status | Hourly | Any new listing | Monitor all IPs in client's ESP account |
| SPF record validity and lookup count | Daily | Any change or count > 9 | SPF checker with DNS monitoring |
| DKIM key presence per ESP selector | Daily | Any selector resolving to NXDOMAIN | DKIM checker for each known selector |
| DMARC policy level | Weekly | Policy downgrade (reject → quarantine → none) | DMARC record monitor |
| DMARC reporting mailbox active | Weekly | No reports received in 7+ days | Check rua= mailbox or DMARC processor |
| MX record changes | Daily | Any MX record modification | DNS change monitor |
| Google Postmaster domain reputation | Weekly | Drops below High | Postmaster Tools API or manual check |
Email authentication adoption by domain type (2025)
Building a client authentication audit process
For each new client, audit:
1. All sending services — Interview the client and dig through DNS records. Find every service that sends email on behalf of their domain.
2. SPF record — Check for validity, lookup count, missing includes, and whether all sending services are covered.
3. DKIM — Check for each sending service's selector. Some clients have outdated keys from providers they no longer use.
4. DMARC — Check policy level, reporting destination (is the reporting mailbox monitored?), and alignment settings.
5. Blacklist status — Check both the primary domain and all sending IPs.
Document findings in a client authentication matrix and remediate gaps before proceeding.
Monitoring at scale
Manual monitoring across 10, 20, or 50 client domains is not sustainable. Use a multi-domain monitoring tool that:
- Monitors all clients' blacklist status from a single dashboard - Alerts you immediately when any client gets listed - Tracks authentication record changes (detects when a client's IT team modifies SPF without telling you) - Shows deliverability score per client
IsMyEmailBlacklisted's Agency plan supports unlimited domains with a multi-tenant dashboard. HetrixTools also offers agency-focused multi-domain monitoring.
Handling client DMARC progression
Many clients are stuck at p=none indefinitely. Offer structured DMARC enforcement as a service:
1. Set up DMARC reporting with a dedicated reporting mailbox or SaaS reporting tool 2. Review reports weekly for 4 weeks, identifying all sending sources 3. Ensure every sending service has DKIM configured 4. Present client with a 'DMARC roadmap' showing identified sources and required actions 5. Move to p=quarantine at pct=10, then 50, then 100 over 6-8 weeks 6. Achieve p=reject within 3-4 months of project start 7. Include DMARC enforcement level in monthly reporting to demonstrate ROI
Check your domain's email health
Run a free scan against 60 blacklists. Validate SPF, DKIM, DMARC, and MX records in seconds.
Related free tools