sendsend.email
Sign inStart building

DMARC monitoring

See every server that sends email as your domain, whether it passes, and when it is safe to tell receivers to block the rest.

Why monitor DMARC

DMARC is the DNS record that tells mailbox providers what to do with mail that claims to be from your domain but fails SPF and DKIM. Starting with p=none only watches. The reports are how you find out which of your own services still fail, and whether anyone is spoofing you, so you can move to p=quarantine and p=reject without blocking your own mail.

Set it up

  1. Add your domain in DMARC in the dashboard, or with POST /v1/dmarc/domains.
  2. Publish the TXT record we show you at _dmarc.yourdomain.com. If you already have a DMARC record, keep it and add our address to its rua= tag, separated by a comma from any address already there.
  3. Wait. Google, Microsoft, Yahoo and others send one report a day, so the first usually arrives in a day or two.
v=DMARC1; p=none; rua=mailto:a1b2c3d4e5f60718293a@dmarc.sendsend.email

What you see

  • Pass rate: the share of messages where SPF or DKIM passed and matched your domain.
  • Senders: each server that sent as your domain, named when we recognise it (Amazon SES, Google Workspace, SendGrid and others), with how much of its mail passes and what to do. A sender you do not recognise that fails everything is probably spoofing you.
  • Advice on the policy: when nearly all mail passes, it says you can move to quarantine, and later to reject.
  • Record check: whether your published record sends reports to us.

Good to know

  • Reports show what receivers saw, one day late. They are summaries, with no message content and no recipient addresses.
  • We keep reports for 90 days.
  • A forwarded message can fail SPF even when it is yours. DKIM survives forwarding, which is why the advice leans on it.
  • Plans include 1 domain on Free, 5 on Pro and 25 on Scale.

To check your records before you start, use the free domain checker.