See who sends mail as your domain
Every large mailbox provider, Google, Microsoft and Yahoo among them, sends a daily report to the domain in the From address of the mail it received. The report lists each server that sent that mail and whether it passed SPF and DKIM for your domain. Sender Security reads those reports and puts them on one page.
How it works
- 1 You add our address to your DMARC record.
- 2 Receivers send their daily reports to it.
- 3 We name the service behind each sender, judged on reliable reporters.
- 4 Each domain gets one page: is it at reject, and what is next.
Levels
Watch
Free, every verified domain
Are you at reject? The verdict, the counts and every DNS warning, for 30 days.
Standard
$20.00 a domain a month
Which of your senders fail, why, and which flow to fix. Totals for two years.
Priority
$200.00 a domain a month
Sender discovery, threats and the evidence to act, probe addresses, and detail for 13 months.
Questions
What do I have to change?
One record. Add our address to the rua= tag of your DMARC record, beside any address already there. Your SPF record, your DKIM keys and your policy stay as they are. It takes about five minutes. The first reports arrive within a day or two, as each provider sends its first daily report.
Do you host my DMARC record?
No. The record stays at your DNS provider, and you stay in control of it. To stop using us, take our address out of the record.
Am I at reject?
Two things decide it. Your policy is reject, for your subdomains too. And every service that sends as you is at reject quality: its mail is aligned, which means it passed SPF or DKIM for a domain that matches the From address. We judge that on the reporters whose reports we found reliable, so a service you use twice a month counts as much as one you use all day.
Which of my senders is not at reject quality, and why?
Standard names each sender of each domain, says which step fails (the signature, its domain, the return path, the record), and gives the fix for that service where we have it.
Which flow needs the fix?
A flow is mail with one From name, one sender and one signing identity. Standard shows the flows of each sender, and lets you name the application behind each one. Priority gives each application a probe address, so one test message proves which flow it is.
What is suspicious mail?
Mail in your name that failed, from a server that lets anybody claim any domain. We tell where mail came from by the server itself, not by your records, which a forger can copy. Failing mail from a service that makes its customers prove the domain, such as Amazon SES, is not suspicious: somebody set it up, and it needs fixing. At reject, receivers refuse suspicious mail. At none, it is delivered.
What can I do about threat mail?
Priority groups suspicious mail by source, with the evidence we hold about each: the failure reports, our trap mailboxes, a lookalike on the same server. You can report a source; we send it to Spamhaus and to its network and follow the answer.
Which reports do you read?
Aggregate reports (rua) from every provider that sends them, and failure reports (ruf) where a provider sends them, which few do. We read reports in the current format (RFC 9990 for aggregate reports and RFC 9991 for failure reports, under DMARC as RFC 9989 defines it) and in the original one of RFC 7489. We keep the headers of a failure report and drop its body.
I am already at reject. Why keep reading reports?
Reject protects you only while every real sender keeps passing. A provider changes its servers, a key is rotated, or a team adds a new tool, and real mail starts to bounce. The reports show it first. That is why we do not charge more as more of your mail passes.
Can I roll out reject to part of my mail first?
Not reliably any more. The pct= tag is gone from the current DMARC standard, and receivers that follow it ignore the tag. Fix your senders using the reports, then move from none to quarantine to reject. A subdomain can move first with sp= or a record of its own.
Do you send alerts?
Yes, at every level: when a sender that was at reject quality no longer is, and when mail goes out under a From or bounce name under your domain for the first time.
What does it cost?
Watch is free for every verified domain, at any volume. Paid levels are priced by the domain, never by the message.
What about lookalike domains?
DMARC protects your exact domain. A lookalike is somebody else's domain, with its own DMARC record, and no report of yours will name it. Lookalike monitoring finds those. The same level on both products, on one domain, costs less.
New to SPF, DKIM and DMARC? A crash course in email security →