Guided enforcement
Reach p=reject with automatic rollback.
Reach p=reject one policy level at a time, timed from your reports.
You approve each step before we publish it through hosted DMARC, then we watch the
daily reports.
- One small step at a time
- Automatic rollback with hosted DMARC
- Steps you publish, on the free plan
Automatic rollback needs hosted DMARC, on the Starter plan and up. It acts during the report watch after a step. The usual watch is 3 days. We adjust it to match when your reports arrive, with at least 3 days for a step into reject.
How automatic rollback works
- It acts when a sender already marked as yours has at least 20 messages at one receiving domain and at least 20 percentage points more of them quarantined or rejected than before the step.
- We also roll back when reported quarantines or rejections of senders we saw before the step exceed the budget you set for it.
- We act on daily reports. We can't recover mail already rejected.
- If you edit the record during the watch and a rollback comes due, we keep your change, pause the ramp and email you.
- After the watch ends, we send a same-day alert when a report shows a new failing sender. We don't roll back after the watch ends.
You set how many failing messages one step may put at risk
We read the last 4 weeks of reports and take the worst day of unexplained failures as the forecast. We propose a step once that forecast fits inside your budget.
The steps from p=none to p=reject
With hosted DMARC, you go from p=none to quarantine in test
mode, then quarantine, then reject in test mode, then reject. Test mode is
t=y, which replaced pct in the DMARC standard. When you
publish the record yourself, each step is a whole level. Subdomains keep the policy
they already had.
Checks before each step
A step is offered only when the reports are fresh, the big receivers are reporting, DKIM aligns on at least 80% of your passing mail, SPF is at 8 lookups or fewer, and every failing sender has been marked as yours or not yours.
We propose each step on a Monday or Tuesday
We propose steps early in the week so the usual 3-day watch closes before the weekend.
You choose who publishes
Approve each step from a link in the mail and we publish the exact record you saw. Or have the mail tell you the tags to set, and publish them yourself. On the free plan you publish each step yourself, up to quarantine.
The watch
When we put the previous policy back
- Automatic rollback needs hosted DMARC, on the Starter plan and up.
- It acts during the report watch after a step. The usual watch is 3 days. We adjust it to match when your reports arrive, with at least 3 days for a step into reject.
- It acts when a sender already marked as yours has at least 20 messages at one receiving domain and at least 20 percentage points more of them quarantined or rejected than before the step.
- We also roll back when reported quarantines or rejections of senders we saw before the step exceed the budget you set for it.
- We act on daily reports. We can't recover mail already rejected.
- If you edit the record during the watch and a rollback comes due, we keep your change, pause the ramp and email you.
- After the watch ends, we send a same-day alert when a report shows a new failing sender. We don't roll back after the watch ends.
After a rollback, we pause guided enforcement and email you the reported harm. You review the evidence and choose when to restart.
Marked senders only
We compare mail from senders you already marked as yours with their results before the step, at each receiving domain.
Overrides do not count
Mail a receiver held under its own local policy, or a mailing list rewrote, is left out of the judgment.
Your edits win
If you change the hosted record during the watch, we drop the step, pause guided enforcement and email you. We keep your edit.
Every step on the record
Each move keeps the record before and after, the forecast and the outcome, on the domain's page.
Start with your senders and reports
Start monitoring and mark each sender as yours or not yours. We propose the first step after a few weeks of reports. Without hosted DMARC, we email you the proposed tags to publish yourself.
Plans
Part of the Starter plan and up
Guided enforcement includes the Monday digest, same-day alerts and sender evidence. Try every feature of the Business plan for 30 days, no card.
Starter
$19 /month
3 domains
Business
$49 /month
10 domains
Portfolio
$79 /month
25 domains
Works alongside
Where to go next
FAQ
Questions people ask first
Does it change my policy on its own?
No. Every step is proposed to you by mail. You approve it from the link, or publish the tags yourself. If we revert, we email you why. Automatic rollback needs hosted DMARC, on the Starter plan and up. It acts during the report watch after a step. The usual watch is 3 days. We adjust it to match when your reports arrive, with at least 3 days for a step into reject. It acts when a sender already marked as yours has at least 20 messages at one receiving domain and at least 20 percentage points more of them quarantined or rejected than before the step. We also roll back when reported quarantines or rejections of senders we saw before the step exceed the budget you set for it. We act on daily reports. We can't recover mail already rejected. If you edit the record during the watch and a rollback comes due, we keep your change, pause the ramp and email you. After the watch ends, we send a same-day alert when a report shows a new failing sender. We don't roll back after the watch ends.
What does the budget mean?
How many failing messages one step may expose to a stricter policy. We forecast each step from the worst day in the last four weeks. If the forecast is over the budget, we hold the step until you have marked more of your senders.
What is test mode?
The t=y tag from RFC 9989, the current DMARC standard. While it is set, receivers that follow RFC 9989 apply one level less: quarantine is treated as none, and reject as quarantine. Receivers still on the older standard ignore it and apply the full policy, so we forecast every test-mode step as the full policy. The tag covers the whole record, so the subdomain policy is one level lower for the same few days.
How long until my domain is fully protected?
We wait for reports under the new policy before we offer the next step, and receivers report once a day. We track when the next step is ready. Automatic rollback follows the conditions above.
What if no reports arrive under the new policy?
The step stays unproven. After a week with no report under the new policy, we pause guided enforcement and email you.
What happens after a revert?
The previous record is back, guided enforcement is paused, and we email you the reported harm. It stays paused until you have read the evidence and started it again.
Do I need hosted DMARC?
For the revert, yes. We can only put a record back if we serve it. Without hosted DMARC, guided enforcement still works out and proposes each step and mails you the tags to set, and you publish them yourself.
What does it cost?
On the free plan we propose each step up to quarantine, and you publish it yourself. Every paid plan adds hosted DMARC: we publish each step, go on to reject, and put the old record back if the next few days of reports show your own senders being blocked. The Starter plan is $19 a month for 3 domains, the Business plan is $49 for 10 and the Portfolio plan is $79 for 25. Try every feature of the Business plan free for 30 days, no card needed.
Review your senders, then take your first step
Add your domain and mark the senders in your first digests. We propose a step once your reports meet the checks above.
First domain free · 30 days on the Business plan · No card
- Each step checked against your reports
- A report watch after each step, at least 3 days into reject
- An email explaining any rollback under the conditions above
- Every step on the record, before and after