Stop anyone
sending mail
as you.
Real-time DMARC, SPF and DKIM monitoring with managed MTA-STS and BIMI hosting included from Growth. One DNS record, five minutes, free for your first 2 domains, then from $29 a month for up to 5.
Grade your domain in 30 seconds.
Reads all 14 records and grades the five that decide most outcomes — the other ten are shown, not scored — plus the exact DNS records to paste. No expiry date, no account.
Fixes are ranked by what reduces spoofing risk today — not a wall of green ticks.
One record in. Enforcement in four to eight weeks.
Most teams reach a working policy in four to eight weeks. The boring middle is DMARC monitoring, reading every report until each sender passes, and that part is ours. What DMARC monitoring involves.
Add your domain
One TXT record into DNS — any provider. Validated as you paste, reversible in one click.
Reports start landing
Every major receiver sends aggregate XML to us. We parse it — you never open a report.
You ship enforcement
Walk to p=reject without breaking a legitimate sender. Simulate the blast radius first.
See the blast radius before you enforce.
Replay the last 30 days against any policy. Which senders break under p=reject? Which ESPs need a DKIM key first? Answer it before you touch DNS.
Everything else, already switched on.
Aggregate + forensic
Both report types parsed from Google, Microsoft, Yahoo, iCloud and 40+ smaller receivers. You never open XML.
Failure analysis
Failures grouped by sender, IP and root cause — "SPF 11 lookups", "DKIM key missing on s2" — with the fix attached.
ARC chain monitoring
Authentication followed through forwarders, mailing lists and alumni redirects, so relays do not read as spoofing.
TLS-RPT + MTA-STS
Downgrade attacks and certificates expiring inside 14 days flagged on every mail route, not just the primary MX.
DNS health watch
SPF lookup count, DKIM key strength, DNSSEC and DANE/TLSA re-checked every 15 minutes across all domains.
Multi-domain + RBAC
Every domain in one console with scoped roles, invite flows and an exportable audit trail of config changes.
Priced per domain. Never per email.
Managed MTA-STS and BIMI hosting are included from Growth. No setup fees, no per-report charges.
rua=mailto:dmarc@yourvendor.com,
mailto:your-rua-token@rua.ddmarc.com; fo=1;
Run us alongside your current vendor.
A DMARC record accepts more than one rua= address. Add ours next to your existing one and both platforms receive the same reports for two weeks. You compare on real data and cancel whichever loses.
One caveat: aggregate history does not transfer between vendors, so you start a new history on day one. That is true of every DMARC platform, and it is exactly why running in parallel beats a cutover.
Reports in. Alerts out.
DMARC monitoring takes the daily reports from every mail provider that sees your domain and turns a new sender or a failure spike into an alert where your team already works.
One posture report. No marketing.
Built on infrastructure with a SOC 2 Type II report and ISO 27001 certification; every API and dashboard request is authenticated and authorized. Below is what we ship, labeled, including what is still in progress. 99.99% uptime is a term written into Enterprise agreements — public uptime measurement is in preparation, and until it exists the incident log is the record.
PlatOps Security, LLC holds the report for the infrastructure and operations scope. Product examination under way.
PlatOps Security, LLC holds the certificate for the infrastructure and operations scope. Product examination under way.
EU residency selectable, in US or EU; Tokyo, HIPAA-eligible (US) and AWS GovCloud (US) on Enterprise. DPA template in preparation.
Questions, answered.
Yes. SPF and DKIM authenticate individual messages; DMARC is the policy that tells receivers what to do when they fail — and the only one that reports back. Without it you are authenticating blind.
Two minutes for the DNS record, usually within 24 hours (sometimes 48) for the first reports, and typically four to eight weeks from the first report to an enforced p=reject.
2 domains, full aggregate report parsing, DNS health monitoring and email alerts — no expiry date, no card. Managed MTA-STS and BIMI hosting come with Growth and above.
Migration is a single DNS change. Point your rua= at us and run both tools in parallel for one billing cycle, then cut over when you are satisfied.