Frequently asked questions

Most major receivers (Google, Microsoft, Yahoo, Apple) email reports daily, batched by their own schedule. After publishing the TXT record, your first report typically lands within 24 hours.

Not if you start with p=none. That's monitor-only — receivers report on what they observed, but they don't change delivery. We strongly recommend everyone starts at p=none for at least a week.

List both rua= addresses in your TXT record, comma-separated. Receivers send aggregate reports to both. Cut over to DMARCify when you're confident the data lines up.

Yes. You can monitor an apex domain and any number of subdomains separately. Each gets its own dashboard. Subdomain policy (sp=) is also surfaced in the dashboard so you can see exactly what receivers will apply.

Read your reports weekly for the first month. The dashboard makes this take 30 seconds. Once every legitimate sender is showing ≥99% aligned, you can ramp to p=quarantine, then p=reject.

Forwarders re-send your mail from their own IPs, which breaks SPF (the source IP isn't in your SPF anymore). DKIM usually survives forwarding because the signature is attached to the message. We detect this pattern — DKIM aligned, SPF broken — and group those senders into a separate 'Forwarded mail' bucket so you don't waste triage time on it.

SPF lists which IPs may send for your envelope-from. DKIM cryptographically signs each message with your domain's key. DMARC sits on top and says 'if a message claims to be from my domain in the From: header, at least one of SPF or DKIM must align with that domain.' Read the full primer on /why-dmarc.

The domain SPF or DKIM authenticated must match (or be a subdomain of) your From: header domain. Relaxed alignment (the default) accepts any organisational-domain match — mail.example.com aligns with example.com. Strict alignment requires an exact match.

By default many ESPs sign DKIM with their own domain (d=sendgrid.net) which doesn't align with your From: (yourbrand.com). The fix is 'DKIM signing with a custom domain' — every reputable ESP supports this, usually under 'sender authentication' or 'verified domain' settings. Add a couple of CNAMEs and you're aligned.

Typical timelines: 1 week at p=none watching reports, 1 week fixing misaligned senders, 1 week at p=quarantine, 1 week at p=reject. Total: ~4 weeks. Faster if your estate is small.

On a globally distributed, encrypted-at-rest data plane, pinned to the region closest to the org owner. Customer data is scoped per-organisation at the application layer; cross-tenant access is prevented by authorisation checks on every query. Account and org metadata is EU-replicated.

No. You can export your data any time directly from the app. Cancel whenever — we delete your account on request, no penalty.

Reports tied to that domain are hard-deleted within 24 hours and the underlying storage garbage-collected. Org-level metadata is removed immediately. We don't keep tombstones.

No. Never have, never will. We don't aggregate customer data into 'industry benchmarks' or anything similar.

Yes. The infrastructure is run by an EU-based operator (Germany), and a signed DPA is available on request. Email dpo@dmarcify.dev for the documents.

Per-domain. Pro is €5/domain billed quarterly or annually (no monthly billing, no domain minimum) and includes AI auto-policy progression and daily digests. Agency is €8/domain billed monthly or annually with a 3-domain minimum, and adds multi-tenant client orgs and white-label controls. Enterprise is custom. Volume discounts apply automatically: −10% at 10 domains, −20% at 25, custom at 100+. Stripe Managed Payments handles checkout as merchant of record, including tax collection and remittance.

Yes — on Pro. €15/quarter or €50/year for one domain. Agency requires 3+ domains either way (it's built for managing multiple clients).

Yes. Registered non-profits and actively-maintained open-source projects get 50% off Pro or Agency — email hello@dmarcify.dev with proof. Startups under 18 months old or 10 employees get 50% off Pro for the first year. Both stack with volume discounts.

Yes — two months free (≈17% off), billed up-front, pro-rata refund if you downgrade or cancel.

Yes — 14 days on both Pro and Agency. Payment method required at signup; nothing is charged for the first 14 days and you can cancel any time during the trial with no charge. The trial converts to a paid subscription automatically on day 15 unless you cancel.

We re-check your live _dmarc TXT daily. If your rua= no longer contains the mailbox we generated for you, we warn you on the domain page and overview — because the moment that happens, receivers stop sending us reports.

DMARC reports queue at the receiver and re-send for up to 7 days. So even an extended outage doesn't lose reports — they trickle in once we're back. The dashboard itself is multi-region and fails over automatically.

Not today. We're a small team and supporting self-hosting takes serious effort. If you have a strict requirement to self-host, contact us — we'll talk through your needs.