DomainCanary Start free

DMARC monitoring

We read every DMARC report. You get the Monday digest.

Gmail, Microsoft, Yahoo and the other mailbox providers write a daily report about who sent mail as your domain. We collect them at an address that's yours alone, identify new and failing senders, and email Monday's summary with your next change.

Start with your first domain Run the free check first
  • First domain free
  • Daily totals kept for life
  • No card

The Monday digest

A tool a colleague connected, or a stranger forging you: the digest lists it the week it starts, with a pass or fail verdict.

View full screenshot View full screenshot
The Monday digest for shop.example.com: 97.3 percent of mail passed DMARC, down 2.0 points, with new senders and their results. The Monday digest for shop.example.com: 97.3 percent of mail passed DMARC, down 2.0 points, with new senders and their results.
Example Example Monday digest for shop.example.com, rendered from the email we send.

Pass rate against last week

The first line says whether more of your mail failed this week than last.

Each new sender, graded

See which senders are new and whether their mail passed or failed.

The next change to make

The digest ends on the policy line to publish and the week it is safe to publish it.

Skip the digest on a quiet week

On paid plans you can have us skip a domain's digest on a week where nothing changed.

Setup

Add your reporting address, then read the digest

Publish the record to prove you own the domain and have receivers send us their reports. Your mail carries on as before.

  1. STEP 1

    Add the reporting address

    We give you the TXT record for _dmarc. If one exists, we merge our address into it and keep your tags. Or let us host the record behind one CNAME.

  2. STEP 2

    Reports arrive

    Receivers send one report a day. The first usually lands within a day or two, and each one goes into the dashboard as it arrives.

  3. STEP 3

    Read Monday's digest

    It covers every report since the record went in. You'll see the change to make next. On a paid plan, a failing new sender is a same-day email.

The dashboard behind the digest

Each line in the digest links to the reports behind it: per-source history, daily totals kept for the life of the account, a trend per sender, and a daily check of your SPF and DKIM records. Every plan, including free.

View full screenshot View full screenshot
The dashboard: a new sender for example.com, the action to review it, and 95.9% of reported mail authenticated across the account's covered domains. The dashboard: a new sender for example.com, the action to review it, and 95.9% of reported mail authenticated across the account's covered domains.
Example Example account. The new sender and the action to review it appear beside the overall pass rate.

Start with the change

See which domain has a new sender and whether its messages passed DMARC.

Keep the wider picture

Check the overall pass rate beside the alert before opening the sender.

A reporting address that's yours alone

Each domain gets its own rua address, so its reports land already sorted. Add it to your DMARC record, or let us host the record.

Every sender identified, with evidence

Every IP in your reports is matched to the service behind it, with the DKIM domain, the SPF domain, reverse DNS, the ASN and the country as the evidence. We list mail that a forwarder or another company's account sends on as you by itself, so your pass rate covers the senders you use. When most of a sender's mail passes DKIM or SPF for its company's own domain, your answer covers every address that company sends from.

Pass and fail over 7, 30 and 90 days

A trend per sender. Date a drop against the week a colleague changed something.

Daily totals kept for the life of the account

Every plan keeps source-by-source report detail for its stated retention period. Daily totals stay for the life of the account, including year-over-year comparisons.

SPF and DKIM change history

We read your SPF and DKIM records daily and keep each change, so an edit can be dated against the week the pass rate moved. If a record breaks, a DKIM key is deleted, or your SPF record changes to end in +all, we email you once two daily reads agree.

Upload a report by hand

A report a receiver mailed you earlier goes into the same dashboard as the ones that arrive at your reporting address.

Paid

What the paid plans add

On the Starter plan, you get alerts between digests and can monitor more domains. On the Business plan, you also get one digest for the whole account, hosted SPF, MTA-STS and cleanup checks.

Same-day alerts

We read each report as it lands. The day a new source fails DMARC, or a known sender stops passing, you get an email. You get at most one alert a day per domain, and anything else found that day is included in the next one.

One email when a provider fails across your domains

When one provider starts failing DMARC on 3 or more of your domains within 2 days, you get one email that lists them all.

A watch list for domains you don't monitor

Save domains from the bulk check in your dashboard, such as suppliers or prospects. We check their DMARC and SPF records daily and email you when one gets worse.

One digest across every domain

Every domain in one Monday email, a section each under an account summary. Adding a domain does not add an email to read.

Team members

Invite up to 10 people. Each signs in with their own account, as a manager who changes domains and records or a viewer who reads. Billing stays with you.

Hosted records and cleanup

Hosted DMARC, hosted SPF and hosted MTA-STS let you change records from the dashboard. With DNS cleanup, check your SPF senders and DKIM keys against your reports.

Works alongside

Where to go next

Hosted DMARC Change the policy from the dashboard Move your policy up a step, or back down, from the dashboard in one save. Guide How to read a DMARC aggregate report Every field in the XML, and what a row that fails is telling you. Free tool DMARC report analyzer Paste the XML a receiver sent and read every source in English.

FAQ

Questions people ask first

What's in an aggregate report?

One row per sending address: how many messages it sent as your domain that day, whether SPF and DKIM passed, and whether the receiver delivered, quarantined or rejected them. No message content and no addresses of the people you mailed.

Will monitoring break my mail?

No. Receivers reject mail only when your policy tells them to, and adding a reporting address does not touch the policy. We read the reports that arrive.

What if I already have a DMARC record?

Keep it. When you add your domain we read the record you publish and hand it back with our reporting address merged in, so your policy and any existing addresses stay as they are. You paste the merged record over the old one.

How fast do I see something?

The first reports arrive a day or two after the record goes in, and the digest goes out on Monday. On a paid plan, an alert arrives the same day a new source first shows up failing.

What's the difference between monitoring and hosting the record?

Monitoring reads the reports. Hosting serves the DMARC record itself from our zone, so you change the policy from the dashboard instead of editing DNS. Monitoring works either way. Hosting is a paid feature you switch on per domain.

What do you do with my report data?

We parse it and mail it back to you. Aggregate reports list sending IPs and carry no message content. We'll never publish, resell or share your data.

What does it cost?

The free plan covers 1 domain, with 90 days of report detail and daily totals for the life of the account. It has no meter on message volume and does not expire. Alerts and hosted DMARC come with the Starter plan, $19 a month for 3 domains. The consolidated digest, hosted SPF and MTA-STS and the cleanup checks come with the Business plan, $49 for 10 domains. Try every feature of the Business plan free for 30 days, no card.

Add the record today, read Monday's digest

Receivers start reporting within a day or two of the record going in. We read what they send and mail you the summary.

First domain free · 30 days on the Business plan · No card

  • Your first domain free, and the plan does not expire
  • Daily totals per source for the life of the account, on every plan
  • Priced by domains watched, so a busier month costs the same
  • 30 days on the Business plan, no card