DMARC monitoring
Receivers are already reporting on your domain. You just cannot read it.
Gmail, Microsoft and the rest send a daily XML report about every message claiming to be from you. Point them at us and it becomes a list of who sends as your domain, how much of it authenticates, and what is being spoofed.
The basics
What DMARC actually is
DMARC is one DNS record that does two things: it tells receivers what to do when mail claiming to be from your domain fails authentication, and it asks them to report back on what they saw.
SPF says which servers may send for your domain. DKIM signs your messages so they cannot be altered in transit. Both were designed before anyone worried about the visible From address, so on their own neither stops somebody putting your domain in the From header of a message they sent from their own server.
DMARC closes that gap with alignment: the domain that passed SPF or DKIM has to match the domain your recipients actually see. If neither aligns, the message fails DMARC and your policy decides what happens next.
A minimal monitoring record
v=DMARC1; p=none; rua=mailto:your-token@dmarc.pilotverify.net
Published at _dmarc.yourdomain.com. It changes nothing about how your mail is handled — it only starts the reporting.
The reports
What an aggregate report contains
One zipped XML file per receiver per day. Unreadable in a mailbox, genuinely useful once parsed.
Every source sending as you
Each report lists the IP addresses that sent mail carrying your domain in the From header. That is how most people discover the invoicing tool, the old CRM and the marketing platform nobody told IT about.
SPF and DKIM results, per source
For every source: did SPF pass, did DKIM pass, and did either of them align with the domain in the From header. Alignment is the part that decides DMARC, and the part that usually fails.
Message volume
How many messages each source sent in the reporting window. Volume is what separates a real sender you forgot about from a single spoofed burst.
What the receiver did
Whether the receiver delivered, quarantined or rejected the mail, and which of your policy settings it applied. This is your evidence before tightening a policy.
The dashboard
What you get instead of the XML
Every report that arrives for your domain, merged and summarised — with the raw numbers still there when you need to prove something.
Sending sources
Reports from every receiver, merged into one list of sources per domain — so you see the whole picture rather than one provider's slice of it.
Pass rates over time
A rolling compliance rate per domain: how many of your messages authenticated and aligned. The number you watch climb before you tighten a policy.
Spoofing detection
Unauthenticated mail using your domain, separated from your own misconfigured senders, so a spoofing run does not hide behind a broken DKIM key.
Policy guidance
Your current published policy, what it actually does to failing mail, and whether your record is pointed at us so reports keep arriving.
Setup
Three steps, one DNS record
No agent, no mailbox access, no change to how your mail is routed.
- Step 1
Add your domain
Create a free account and add the domain you send from. We generate a reporting address unique to that domain, so nothing is shared between workspaces.
- Step 2
Publish one TXT record
We give you the exact _dmarc record to paste into DNS, starting at p=none so nothing changes for your mail. One record, one place, one time.
- Step 3
Wait for the reports
We verify the record is pointed at us, then parse each XML report as it arrives and build the picture. Nothing else to install and nothing to route.
Not sure what you publish today? The free email server test reads your current DMARC record, its policy and whether anybody is collecting your reports — no account needed.
FAQ
Questions about DMARC
What is rua?
rua is the tag in your DMARC record that names where aggregate reports should be sent — it stands for reporting URI for aggregate data. Receivers read it, and once a day they send an XML summary of the mail they saw claiming to be from your domain to that address. Without a rua tag, those reports are generated and thrown away. We give you a unique reporting address to put in it.
Will publishing a DMARC record break my mail?
Not at p=none, which is what we hand you. A p=none policy tells receivers to report what they see and change nothing about how they handle it, so mail flows exactly as it did before. Breakage only becomes possible when you move to quarantine or reject, which is a deliberate step you take later, once the reports show your real senders are authenticating.
How long until the first reports arrive?
Usually 24 to 72 hours. Most receivers batch aggregate reports once a day, and they only report on days they actually saw mail from your domain, so a low-volume domain can take longer. DNS propagation adds a few hours on top. If nothing has arrived after a week, the record is usually the problem and the dashboard will tell you whether yours is pointed at us.
What is the difference between p=none, quarantine and reject?
They tell receivers what to do with mail that fails DMARC. p=none means do nothing different and just report — monitor mode, and where everyone starts. quarantine means treat failing mail as suspicious, which in practice sends it to the spam folder. reject means refuse it outright at the SMTP conversation, so it never reaches the mailbox at all. The path is none, then quarantine, then reject, and you only move when the reports show your legitimate mail passes.
Do you need access to my mailbox or my mail server?
No. DMARC reporting is a DNS mechanism: receivers send reports to the address in your record. We read DNS and parse the reports that arrive. We never connect to your mail server, never read your mail, and nothing needs to be installed.
How many domains can I monitor?
One on the free plan, three on Starter, ten on Pro and fifty on Agency. Paid deliverability plans are in beta and free to use while the beta runs.
Start monitoring
One record today, a policy you can trust in a month
The free plan monitors one domain with seven days of history — enough to find every sender you forgot about. Paid plans add more domains and longer history, and are free while the beta runs.