DMARC monitoring, without the spreadsheets.
See who's sending email as you. Catch impersonations and failures before they hurt deliverability. One DNS record, no XML to read — from €5 per domain per month.
| Domain | Status | Policy | Records | Pass rate | Last |
|---|---|---|---|---|---|
| acme.com | verified | reject | 38,420 | 99% | today |
| send.acme.com | verified | quarantine | 14,002 | 97% | today |
| newsletters.acme.com | verified | none | 5,210 | 88% | 1d ago |
| support.acme.com | verified | reject | 1,212 | 100% | 2h ago |
| staging.acme.com | pending | none | 0 | — | — |
DMARC reports are XML. Yours don't have to be.
Every receiver from Gmail to Yahoo emails you a daily blob of XML describing who sent mail as you, from which IP, and whether it aligned. By default you get hundreds per month, none of it readable. We decode them, categorise senders, and surface what you actually care about: is something broken, and is anyone spoofing me.
<?xml version="1.0" encoding="UTF-8"?>
<feedback>
<report_metadata>
<org_name>google.com</org_name>
<email>noreply-dmarc-support@google.com</email>
<report_id>16341920482910581</report_id>
...
<record>
<row>
<source_ip>209.85.220.41</source_ip>
<count>2814</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>pass</spf>
...- Google Workspace sent 18,420 messages from
209.85.220.41— 100% SPF aligned, 100% DKIM aligned. - Fastmail forwarded 612 messages — DKIM still aligns, SPF broke. That's expected with mail forwarding.
- Unknown sender in NL tried 84 messages spoofing
ceo@acme.com. All blocked by yourp=reject.
Everything you need to roll out DMARC safely.
Built for engineers who'd rather ship product than read aggregate XML.
One DNS record
We generate a per-domain rua mailbox and the exact TXT value to publish. Copy, paste, done — receivers find us within hours.
Source attribution
Reverse-DNS, ASN and country are resolved for every source IP, then matched against ~80 known mail providers like Google, Microsoft 365, Amazon SES, SendGrid.
Smart categorisation
Senders are bucketed into authorized, forwarded (DKIM aligns, SPF broke) and unknown — so you know which failures matter and which are just mailing list forwarders.
DNS drift detection
We re-check your DMARC TXT on a schedule and warn you the moment your rua mailbox is removed — before you start losing visibility.
Digest cadence
Opt-in plain-text summary on a weekly or daily cadence: pass rate, new senders, any policy or alignment drift. Designed to be skimmed in 30 seconds.
Multi-tenant orgs
Invite teammates with viewer or admin roles. Switch orgs from the sidebar. Designed for agencies and consultancies running DMARC for clients.
Connect a provider once. Every domain follows.
Paste an API token for Cloudflare, Vercel, Azure DNS, GoDaddy, AWS Route 53, or Google Cloud DNS — DMARCify caches every zone you can reach and pushes the _dmarc record with one click. No DNS provider? Copy the TXT record we generate and paste it yourself. Either way, verification flips the moment the record goes live.
- Zero scripts or agents — only DNS
- One credential covers your whole estate — 1 zone or 1,000, same flow
- Verified automatically the moment your DNS record is detected — no waiting for the first report
Authorized senders
3 sourcesRecognised services sending mail aligned with your domain. Working as intended.
| Source | From: | Provider / ASN | Country | Total | Pass | Fail | SPF | DKIM |
|---|---|---|---|---|---|---|---|---|
google-public-mail.l.google.com 209.85.220.41 | — | Google Workspace AS15169 | 🇺🇸US | 18,420 | 18,402 | 18 | 100% | 100% |
a48-100.smtp-out.amazonses.com 54.240.48.100 | support.acme.com | Amazon SES AS14618 | 🇺🇸US | 7,211 | 7,211 | 0 | 100% | 100% |
o1.eu.mailhostbox.com 104.47.7.34 | — | Microsoft 365 AS8075 | 🇮🇪IE | 4,012 | 4,005 | 7 | 99% | 100% |
Forwarded mail
1 sourceDKIM-aligned but SPF-broken — the classic signature of a recipient mailbox forwarding your mail elsewhere.
| Source | From: | Provider / ASN | Country | Total | Pass | Fail | SPF | DKIM |
|---|---|---|---|---|---|---|---|---|
mx.fastmail.com 66.111.4.230 | — | Fastmail AS11403 | 🇺🇸US | 612 | 612 | 0 | 0% | 100% |
Unknown / unaligned sources
1 sourceSenders we don't recognise or that aren't aligning. Investigate before raising your DMARC policy.
| Source | From: | Provider / ASN | Country | Total | Pass | Fail | SPF | DKIM |
|---|---|---|---|---|---|---|---|---|
— 185.220.101.47 | ceo.acme.com | AS396982 | 🇳🇱NL | 84 | 0 | 84 | 0% | 0% |
Know exactly who's sending mail as you.
DMARC tells you alignment passed or failed for an IP. That's not actionable. DMARCify resolves PTR, ASN and country for every source, matches against a curated list of ~80 mail providers, and groups senders into three buckets so the right failures rise to the top.
- Authorized senders — known services aligning correctly
- Forwarded mail — DKIM-aligned but SPF-broken (the signature of a forwarder, usually fine)
- Unknown / unaligned — investigate before tightening your DMARC policy
- Header-From divergence highlighted when a sender spoofs a cousin domain
The boring, expensive parts of legacy DMARC tools — gone.
| DMARCify | Legacy DMARC platforms | |
|---|---|---|
| Setup time | 1 DNS record (60s) | DNS + onboarding form |
| Price for 3 domains | €15 / month equivalent (billed quarterly) | $50–200 / month |
| Per-source PTR/ASN/country | Yes, auto-resolved | Sometimes, behind a paywall |
| Forwarder detection | Yes — split into its own bucket | Mixed in with failures |
| DNS drift detection | Built-in, daily re-check | Manual re-check |
One price per domain. No metering. No seats.
Linear per-domain pricing — same rate whether you have one or fifty. Pro bills quarterly or annually with no domain minimum; Agency bills monthly or annually starting at three domains. Volume discounts kick in automatically at 10, 25 and 100 domains.
- One-click setup for Cloudflare, Vercel, Azure DNS, GoDaddy, AWS Route 53, Google Cloud DNS
- Full DMARC report ingestion + source IP attribution
- Smart sender categorisation (authorised / forwarded / unknown)
- Sortable, searchable dashboard
- Volume chart, source IP table, recent reports
- AI auto-policy management (promotes p=none → quarantine → reject when safe)
- Daily or weekly email digest
- Daily DNS drift check + in-app rua-mismatch warning
- Email support
- Everything in Pro, plus —
- Manage unlimited client organisations from one login
- White-label each client org — brand name, logo, primary colour, support email, optional custom domain
- Volume discount sums domains across all your client orgs
- Per-organisation invitations and roles (owner / admin / viewer)
- Hand off org ownership to your client when the rollout's done
- Org switcher in the dashboard for fast context-switching
- Email support, prioritised for agency accounts
- Everything in Agency
- Talk to us about: SSO (SAML / OIDC), audit log, dedicated SLA, regional data pinning, custom retention, vendor-onboarding paperwork, or anything else your security review needs
- One technical contact, dedicated email channel
- Annual contracts, wire transfer, signed DPA
Common questions
- Is my data private?
- Yes. Customer data is scoped per-organisation at the application layer and encrypted at rest. We never read or sell the contents of your reports. Full details on the security page.
- Will this break my existing email?
- No. You publish a TXT record at _dmarc with p=none — that's monitor-only and changes nothing about how mail is delivered. Once your reports look clean you can raise the policy at your own pace.
- Will I be locked in?
- No. You can export your data any time directly from the app. Cancel whenever — we delete your account on request, no penalty.
- What if I'm already using another DMARC tool?
- List both rua= addresses in your TXT record (comma-separated). Receivers send to both. Cut over when you're ready.
Stop guessing who sends mail as you.
Add one DNS record. Reports start arriving within 24 hours. From €5 per domain per month with a 14-day free trial — payment method required, cancel any time during the trial.