Nine protocols,
one dashboard.
0.7% of the top 10,000 domains run the full stack, by our 2026 scan. DMARC is one record in nine; here is what we do with each.
Pick a protocol. See exactly what we do with it.
Every entry below is live in the product today — the record shapes are the real ones we read and write.
DMARC
The rule that tells inboxes what to do with mail that fails your checks — and the reporting channel that tells you who is sending as you.
Enforcement in weeks, without breaking mail.
Progression is automated and gated: the rollout advances a stage only while your pass rate holds above the threshold, and pauses itself the moment it does not. What each policy step does is in DMARC p=none vs p=reject.
Monitor
Reports flow in and nothing changes for your recipients. You find out who is already sending as you.
Quarantine
Unauthorized mail goes to spam instead of the inbox. Authorized senders keep delivering as normal.
Enforce
Spoofed mail is refused at the edge. This is the point where the domain is protected.
Hold the line
Stacks drift. New tools get added by people who do not know about SPF limits. Alerts catch it.
Pick a playbook, not a policy: a glide length and a safety gate, chosen for how much risk the domain can take. Stages advance on their own, and hold when the gate is breached.
Failures come classified, with the fix attached.
Every failure is sorted into a root cause and split into likely spoofing versus your own misconfiguration — because those two need completely different responses.
Split by mechanism
SPF-only, DKIM-only and both-failed counted separately. Both-failed is the number that usually means someone else is sending.
Threat vs misconfiguration
Critical-severity events are separated from fixable DNS mistakes, so you are not triaging your own SPF record as an attack.
Forensic samples
Individual failing messages, failing sources and spoofed identities, each on its own tab.
Time to resolution
How long your misconfigurations stay open, so DMARC work does not quietly become a permanent backlog.
You write the rule. We watch it.
Alerts are conditions you define, not a firehose of every report we parse. Build them in a sentence and pick where they land.
Every domain in one dashboard
Bulk policy changes, shared sender inventory, per-domain owners and role-based access. Subdomains inherit unless you say otherwise.
Reports you can hand upward
PDF executive summaries, CSV extracts and the raw DMARC XML if your auditor wants it. Scheduled weekly or monthly.
REST API and webhooks
Everything the dashboard shows is available programmatically — provision domains, pull posture, and send alerts to a webhook your SIEM or PSA reads.
Plain-language explanations
Each finding comes with what it means and the exact record change to make. No RFC reading required.
The free Monitor plan is not a demo.
In every plan
Monitor · free2 domains, 30-day retention, no card. The checks are the same ones the paid plans run.
Unlocks as you grow
Paid plans add domains, retention and the managed hosting we run on your behalf.
Add one DNS record. See everything.
Free for 2 domains, and you will usually have your first report within 24 hours, sometimes 48.