Anyone can email your customers using your name.
Until you publish one DNS record, nothing tells Gmail or Outlook to refuse a forgery. Publishing it takes about 10 minutes and blocks nothing on day one — it just shows you who is already sending as you.
Five questions, no email address required.
Tick what applies. Each one changes how exposed you are — and none of them is about how technical you are.
Tick anything that sounds like you.
Most small businesses match at least 3 — usually the ones about extra sending tools and having nobody watching the domain.
Check your domain insteadBusiness email fraud cost US victims about $2.95 billion in one year.
FBI IC3 2023 Internet Crime ReportThree things, one of them in your registrar.
This is the whole job. The only unfamiliar part is pasting a record where your domain lives, so here is exactly what that screen looks like at the common registrars.
Add your domain
Type it in. We generate the exact record for you — there is nothing to configure and no options to get wrong.
Paste one record
Log in wherever you bought your domain and add a single TXT record. We show you the screen and the field names for your provider.
Read your first report
Providers begin sending reports the next day. We turn them into a plain list of who is sending as you, named and grouped.
Where is my domain hosted?
DNS → Records → Add record. Cloudflare calls the value field "Content", and leaves TTL on Auto.
Leave the orange proxy cloud alone — it does not apply to TXT records.
Most small businesses never need to pay us.
If you have up to 2 domains, the free plan is the whole product. We would rather you stayed on it than churned off a trial.
2 domains, 30 days of report retention, and every protocol check the paid plans run.
5 domains, 365 days of report retention, and the detail you need once you start enforcing.
Free plan: 2 domains, no card, no expiry · Trial: card required, billed on day 15 unless you cancel · 14-day money-back on new paid plans
The email your business depends on.
Order and refund emails
Confirmations and shipping notices are the easiest messages to clone convincingly, because customers are already expecting them.
Invoices and engagement letters
A forged invoice from an accountant or law firm is paid without question. Authentication is what makes the real one provable.
Anything signed by a founder
A short request from the CEO to finance is the oldest attack in the book, and it works because the domain looks right.
Bookings and review requests
Appointment confirmations carry links and card details, which makes them worth impersonating and easy to misuse.
The worries that stop people starting.
Not at the setting we start you on. p=none means "watch and report, change nothing" — receiving servers treat your mail exactly as they did yesterday. You only move to a blocking policy later, deliberately, once your reports show every legitimate sender is authenticated. That is the step where care is needed, and the product holds you back from it until the numbers support it.
No. You need access to wherever you bought your domain — that is all. We generate the exact value, tell you which box it goes in for your registrar, and then verify from the outside that it published correctly. If you would rather someone else did it, forward our setup email to whoever manages your website.
It has no expiry date, for 2 domains with 30 days of report history, and it does not ask for a card. It runs the same checks as the paid plans. If you have one or two domains, this is likely the only plan you will ever need.
Reports usually start arriving within 24 hours, sometimes 48, because they are generated by the receiving providers, not by us. The first thing most people see is a sender they had forgotten about — an old newsletter tool, a form service, a plugin.
You will see the sending sources, where they are, and how much mail they attempted. The response is the same one you were heading towards anyway: finish authenticating your real senders, then move your policy to reject so the forgeries are refused instead of delivered.
They protect mail arriving in your inbox. Neither one stops somebody else sending mail that claims to be from your domain to other people — your customers, your suppliers, your staff. That is a different problem, and DMARC is the part that addresses it.
Find out who is sending as you.
Thirty seconds and no signup for the check. Ten minutes and one DNS record for the monitoring — and the first report lands the next day.
What buyers on this page ask.
Yes. The free Monitor plan covers 2 domains with 30-day retention, and Protect is $29/mo for 5 domains with forensic reports, scheduled DNS monitoring, and API access included — no enterprise contract or sales call required.
No. Setup takes under 5 minutes: add your domain, paste one DNS record, and reports usually start flowing within 24 hours, sometimes 48. The dashboard surfaces readable insight instead of raw XML.
Yes. DDMARC monitors SPF, DKIM, and DMARC alignment so you can confirm you meet the Google/Yahoo bulk-sender requirements in force since February 2024.
You add a card to start a paid trial, and we bill it when the 14-day trial ends. Cancel anytime before then and you will not be charged — your account simply moves to the free Monitor plan, and reports inside the free plan's 30-day window stay accessible. The free Monitor plan never needs a card.
Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.