Why we are doing this

Email works a lot like physical mail. For decades, anyone could write any return address on an envelope and the post office would deliver it and sort out the junk later. The major mailbox providers, Google, Microsoft, and Yahoo, are steadily closing that loophole. They now want proof that a message genuinely came from the domain it claims to, they already require it from anyone sending in bulk, and they increasingly favour mail that can prove itself and treat the rest as less trustworthy. Unproven mail is more likely to be routed to the spam folder, and it quietly counts against your reputation over time.

There is a second reason, and on shared hosting it matters even more. A great deal of mail leaves from shared mail servers, the digital equivalent of a shared street address. If one sender on that street behaves badly, or a spammer forges a domain to push out junk, the whole street can pick up a bad name, and that drags down deliverability for every legitimate business sharing it. It is sometimes called guilt by association, and it is a genuine cause of good mail being filtered or blacklisted.

What we are doing about it

We built our own tool, Provenly, to read the delivery reports the major providers send back for every domain we host. It shows us precisely which senders are passing these checks, which are failing, and why, so we can fix problems before they cost you deliverability rather than after. We wrote up the thinking behind it in our Field Notes: [The DMARC signal nobody watches](https://www.momentumhosting.com.au/notes/dmarc-signal-nobody-watches/).

This is not something we resell or bolt on as a paid extra. We built Provenly ourselves and run it for you as part of your hosting, so the monitoring, and the careful step-by-step tightening that follows, are handled on our side rather than left for you to set up.

With that visibility, we are steadily strengthening the email authentication on the domains we manage. The proof itself is three quiet standards working together (SPF, DKIM, and DMARC); think of them as an approved-sender list, a tamper-proof seal, and a rule that tells the receiving post office what to do with mail that does not match. Today almost every domain sits at the most permissive setting of that rule, where even mail that fails the check, including mail that is not genuinely yours, is still delivered. Our aim is to bring every domain we manage up to at least a "quarantine" standard, the level at which failing mail is set aside instead of delivered. That is the point where someone forging your name can no longer land convincing mail in an inbox, and the point modern providers reward with more trust. This is ongoing work over the coming weeks and months, done one domain at a time, as the evidence shows it is safe.

Who this applies to

Because a domain's DMARC policy lives in its DNS, we can only carry out these changes where we manage the DNS, so that is the one requirement. If we manage your DNS, your domain is included by default and there is nothing you need to do to opt in. If your DNS is managed elsewhere, your domain is excluded, even if we host your email, because we cannot safely change records we do not control, though we are glad to advise if you would like our help. Among the domains we do manage, we are working through them in order of priority: Managed Support customers first, then customers whose email we also run, and then customers who run their own email while we manage the DNS.

What it means for you

For most customers, nothing changes and no action is needed. Your email keeps sending as normal and, over time, becomes more trusted by the providers your recipients use and better protected against anyone impersonating your domain.

If you send email for your domain through an outside service (for example a marketing platform, a CRM, or a booking system), that service needs to be authorised to send on your behalf. If we find a sender that is not set up correctly, we will contact you directly with the specific steps before making any change that could affect your mail. We will never tighten a domain while legitimate mail is still failing.

If you would like access to your compliance dashboard this is available on request, and we encourage customers to request access to gain a greater understanding of how mail providers treat mail sent from your domain.

If you have any questions in the meantime, please open a support ticket and we will be glad to help.