Hosted DMARC
Change your DMARC policy from the dashboard.
Point _dmarc at us and we serve the record. Move from
p=none to quarantine to reject from your dashboard, and move back the
moment a step catches real mail. We publish each change within 15 minutes.
Receivers read it when the record's 5-minute cache expires.
- Part of the paid plans
- 30 days free, no card
- Leave with one record swap
Change your policy from the dashboard
Choose your DMARC policy, inspect the record, and review earlier changes in the same place.
View full screenshot View full screenshot
Change the policy here
Choose the policy, subdomain policy and percentage before you save.
Inspect the record
Read the DMARC record we're publishing for your domain. Every change is kept in the history below.
Point your DMARC record at us
The CNAME proves you own the domain, sends the reports to us, and hands the record over. Once it resolves, you change the policy from the page.
-
STEP 1
Switch to hosted
On the domain's DMARC page, press Switch to hosted DMARC. We read the record you publish today and carry its policy and tags over, with our reporting address in place of the old one. A domain with no record, or with a policy receivers cannot read, starts at
p=none. -
STEP 2
Publish the CNAME
Delete the TXT at
_dmarc, then add the CNAME we give you at the same name. The TXT goes first because two answers at that name make receivers discard both. -
STEP 3
Move the policy from the page
Once the CNAME resolves to us, the controls unlock. Pick the policy, the subdomain policy and the percentage, save, and the record changes in our zone.
Move the policy up or down from the same controls
Getting to p=reject takes several small steps. Moving back
down is the step you take in a hurry, and it's the same control.
A warning before a risky step
Tighten the policy while your reports still show real mail failing, and the page says so before it saves. Confirm and it goes.
Move back with no confirmation step
Drop from quarantine to none, or from reject to quarantine, without a confirmation step. We publish your change on the next push.
Your reporting address is in the record
The record we serve carries your reporting address. Hosting the record and receiving the reports is one setup, and the CNAME is also the proof you own the domain. Other reporting addresses in your old record stay in the one we serve, so another DMARC tool keeps getting its reports.
A history of every change
We keep every change and its date under the controls. Compare an edit with the week your pass rate changed.
We check the record is live every 15 minutes
We push to our zone, then read the record back through public DNS every 15 minutes. The badge says live only after that read succeeds, and says broken when a delegation that was live stops resolving.
The controls change three tags
Each policy change writes p, sp and pct.
The reporting address and every other tag stay exactly as they were.
What an outage does to your mail
If our DNS is unreachable
Receivers find no policy at _dmarc and treat your mail the way they
treat a domain with no DMARC record: it delivers. Protection and reporting pause
until our zone answers again. Mail keeps delivering.
If your plan lapses
The record keeps serving exactly as it stands and only the controls lock. Cutting a live record over a billing event would break mail, so we don't. Upgrade and the controls unlock. Stop hosting and the page hands you the record to publish yourself.
Stop hosting whenever you want
Press Stop hosting and the page writes out the TXT we were serving, ready to
paste at _dmarc. Publish it, delete the CNAME, and the domain is
self-managed again with the same policy and the same reporting address. We keep
answering the old name until your DNS stops referencing it, and for 20 days after
that, so a receiver that cached the CNAME still finds a policy.
Guided enforcement
Automatic rollback after an approved step
- Automatic rollback needs hosted DMARC, on the Starter plan and up.
- It acts during the report watch after a step. The usual watch is 3 days. We adjust it to match when your reports arrive, with at least 3 days for a step into reject.
- It acts when a sender already marked as yours has at least 20 messages at one receiving domain and at least 20 percentage points more of them quarantined or rejected than before the step.
- We also roll back when reported quarantines or rejections of senders we saw before the step exceed the budget you set for it.
- We act on daily reports. We can't recover mail already rejected.
- If you edit the record during the watch and a rollback comes due, we keep your change, pause the ramp and email you.
- After the watch ends, we send a same-day alert when a report shows a new failing sender. We don't roll back after the watch ends.
Plans
Part of the Starter plan and up
Hosted DMARC includes the Monday digest, same-day alerts and sender evidence. Try every feature of the Business plan for 30 days, no card.
Starter
$19 /month
3 domains
Business
$49 /month
10 domains
Portfolio
$79 /month
25 domains
Works alongside
Where to go next
FAQ
Questions people ask first
Do I need hosted DMARC to use DomainCanary?
No. Monitoring works with a record you manage yourself: you add our reporting address to the TXT you already publish. Hosting is for a domain whose policy you'll move more than once, and would rather move from a page than through a DNS ticket.
What's the difference between hosted DMARC and DMARC monitoring?
Monitoring reads the reports receivers send about your domain. Hosting serves the record those receivers read. Monitoring works without hosting. Hosting always includes monitoring, because the record we serve carries your reporting address.
Does a CNAME at _dmarc work everywhere?
At every receiver, yes. They look up the TXT at _dmarc.yourdomain.com, and a CNAME at that name sends the lookup to the name we serve. The one rule is that nothing else can sit at a name that holds a CNAME, so the old TXT is deleted first.
How fast does a policy change reach receivers?
We push every change to our zone within fifteen minutes of the save, and the record carries a five-minute TTL. A receiver that cached the old answer reads the new one when that expires.
Can I roll back?
Yes. You can manually lower the policy in one save, with no confirmation step. If p=quarantine starts catching a real sender, drop back to p=none and the record changes on the next push.
What happens if DomainCanary is down?
Receivers find no policy at _dmarc and deliver your mail the way they do for a domain with no DMARC record. Protection and reporting pause until our DNS answers again. Mail keeps flowing.
Which tags can I change from the page?
p, sp and pct: the policy, the subdomain policy and the percentage. The reporting address is written by us and every other tag carries over from the record you switched from. A record whose policy receivers cannot read starts fresh at p=none instead.
What does it cost?
It's part of every paid plan. The Starter plan is $19 a month for 3 domains, the Business plan is $49 for 10 and the Portfolio plan is $79 for 25. Try every feature of the Business plan free for 30 days, no card needed.
Host the record, then change the policy without a DNS ticket
Each Monday digest says which week the next step is safe. With the record hosted, that step is one save on the page.
First domain free · 30 days on the Business plan · No card
- Point _dmarc at us once, then never edit that DNS record again
- Policy, subdomain policy and percentage from the page
- Manually restore your policy in one save
- Fails open: mail delivers if our DNS is ever unreachable