Stop attackers sending email as your domain
DMARC+ shows every service using your domain, identifies authentication gaps, and guides you safely from monitoring to full DMARC enforcement.
Check your public DMARC record—free, with no sign-up.
We query public DNS only. Nothing is installed or changed.
On 19 October 2026 we read the DNS of the top 1,000 domains. 180 of the 688 that receive mail still let anyone send as them: no DMARC record, or p=none. See the study.
Illustrative domain overview
example.com
98.7%
DMARC pass
12
Known senders
3
Need attention
From XML to a clear next step
Know who sends. Know what to fix.
DMARC+ organizes raw reports into a rollout plan your security, IT, and email teams can act on together.
See every sender before changing policy
Illustrative product view
Aggregate reports turn into a readable inventory of services, IPs, volume, and authentication results.
| Sending source | Messages | Status | Action |
|---|---|---|---|
| Google Workspace | 18.4k | Passing | Inspect → |
| Customer platform | 6.2k | Fix DKIM | Inspect → |
| Unknown sender | 842 | Review | Inspect → |
Four steps to full DMARC enforcement
Go from zero DMARC coverage to full enforcement without disrupting your legitimate email flow.
Monitor
p=none
Start with a p=none policy to collect DMARC data. No emails are blocked. You gain full visibility into every sender using your domain.
Analyze
Identify senders
Review aggregate and forensic reports. Identify which senders are authorized and which are not. Map your entire email infrastructure.
Enforce
p=reject
Move to p=reject and block all unauthorized emails. Recipients never see spoofed messages from your domain again.
Comply
Stay compliant
Meet sender requirements from Google, Yahoo and Microsoft. Satisfy regulatory frameworks including GDPR, DORA, NIS 2 and PCI DSS.
Everything needed to reach enforcement
Everything you need to protect your domain from email spoofing and phishing attacks.
Sender inventory
See the providers, services, source IPs, countries, and message volumes using your domain in one place.
Record guidance
Create SPF and DMARC records with guided steps, then verify the public DNS result before moving forward.
Readable reports
Turn aggregate report files into trends, failures, and specific remediation work instead of reading raw XML.
Authentication checks
Review SPF, DKIM, and DMARC alignment together so legitimate senders keep reaching the inbox.
Change alerts
Receive email or SMS notifications when a sender starts failing or an authentication record changes.
Expert support
Get help interpreting reports, fixing sender configuration, and planning each move toward enforcement.
How the top 1,000 domains protect their email
We read the DMARC, SPF and BIMI records of the Tranco top 1,000 domains. These are the 688 that receive mail.
Method and findings · Download the data (CSV)
Published methodology and row-level data make every percentage independently reviewable.
A safer path to p=reject
Enforcement should reduce spoofing without interrupting legitimate mail. The rollout is designed around that constraint.
No risky first move
Start in monitoring mode. DMARC+ maps legitimate mail before you ask receivers to quarantine or reject anything.
Evidence you can inspect
See sending sources and authentication outcomes directly. Recommendations link back to the evidence behind them.
Ongoing drift detection
Keep reading reports after enforcement so new vendors and configuration changes do not quietly create delivery problems.
A person when needed
Every trial begins with guided setup, and support is available when a sender or DNS change needs a closer look.
Meet modern sender requirements
Requirements depend on who you send to and how much mail you send. Use the primary sources below to confirm the rule that applies to your organization.
| Regulation | Region | Effective | Scope |
|---|---|---|---|
| Global | Since Feb 2024 | 5,000+ messages/day to Gmail | |
| Global | Since Feb 2024 | Bulk senders to Yahoo or AOL | |
| Global | Since May 2025 | 5,000+ messages/day to Outlook.com | |
| US | Ongoing | Federal civilian agencies |
See your own sending landscape
Request a guided 14-day evaluation, or speak with a specialist about a domain that is already proving difficult.