DMARC monitoring and lookalike domain protection

Stop attackers sending mail as you, and catch the lookalike domains they register to fool your customers.

Or check your email authentication

Free on 1 domain for each product, no credit card Hosted on Google Cloud in the US Data never sold

PhishFence console home, example data: KPI tiles show 7 open lookalikes (1 critical, 2 high), 35,999 messages sent as your domains in the last 30 days with a 98.7% DMARC pass rate, 1 of 3 domains rejecting spoofed mail, and 6 items to act on. Below, the Protection flow shows the lookalike domains impersonating you, your three example domains with their email scores, and the three mail receivers reporting on your mail.

lookalike variants checked on every scan cycle: 51,276
scorecards published: 779

Alerts and data go where your team already works

Email
Slack
Microsoft Teams
Discord
Webhooks
REST API
MCP server

Brand Protection: find the lookalike before it phishes your customers

Attackers register domains like example-login.test and send from them. Your own DMARC cannot touch a domain you do not own, so PhishFence watches for them.

See every lookalike that goes live

Each scan checks 1,935 variants of a domain like example.com: typos, homoglyphs, TLD swaps, prefixes and suffixes. Live ones are scored on DNS, SSL, MX and HTTP signals.

Daily scans on Free, hourly on paid plans
Certificate Transparency alerts on Starter and up

Lookalikes · example.com Example data

Know which ones are real threats

Every alert carries the evidence: the signals that are live and registration and certificate facts, plus threat-feed matches on paid plans and a screenshot scored against your real pages on Pro.

Get it taken down in minutes

PhishFence finds the registrar abuse contact, writes the report with the evidence attached, and tracks which blocklists you have reported to.

Alert page for examp1e.test, Summary tab: verdict Critical with 4 of 4 risk signals, a plain-language reason, a Why Critical list, confidence Likely phishing with four pieces of evidence, and a Takedown panel with the status, the registrar abuse contact, a reviewable report draft, a false-positive option and a Report to more services button.

Open full size (Alert · examp1e.test, opens in a new tab)

See how Brand Protection works

Email Security: get to p=reject without breaking real mail

DMARC, SPF and DKIM stop attackers sending as your exact address. PhishFence reads the reports, shows what to fix, and tells you when it is safe to enforce.

See every service sending as you

Daily DMARC reports from Google, Microsoft, Yahoo and others become one list of senders, each matched to its provider, so an unknown source stands out.

Senders page for example.com: 16,475 messages from 4 senders and 1 unknown IP. Google Workspace, Microsoft 365 and HubSpot pass SPF, DKIM and DMARC and are authorized; one unidentified server with 493 messages passes nothing, is blocked by DMARC and is marked Unknown with a Review link.

Fix each record with the exact change

Every record (DMARC, SPF, DKIM, MTA-STS, TLS-RPT, BIMI) gets its own page with the live value, what is wrong, and the record to publish. Paid plans can host SPF and MTA-STS for you.

SPF record page for example.net: status Critical, too long for receivers to check because the record needs 12 DNS lookups against a limit of 10, the live record as published in DNS, and a How to fix section with the steps.

Open full size (SPF · example.net, opens in a new tab)

Enforce when your real senders pass

The rollout moves you from p=none through a dry run to quarantine and reject, and only says go when every known sender has been passing.

DMARC rollout for example.org at stage 4 of 6, Send fakes to spam: Check your senders, Watch reports and Test enforcement are done; the status is Waiting because the live record matches and the observation window ends in 6 days, before Reject fakes and Done.

Open full size (Rollout · example.org, opens in a new tab)

See how Email Security works

Check your domain now, free and without an account

The same DNS and email-authentication checks the products run, as one-off tools.

Browse all 33 free tools

Public prices, and a free plan on both products

Buy either product on its own or both. Each plan is sized by how many domains you monitor.

Brand Protection

Brand Protection plans
Plan	Price	Domains
Free	$0/mo	1
Starter	$49/mo	5
Pro	$99/mo	20
Business	$499/mo	100

Email Security

Email Security plans
Plan	Price	Domains
Free	$0/mo	1
Starter	$20/mo	5
Pro	$69/mo	20
Business	$399/mo	100

Compare plans on the pricing page

Questions buyers ask first

Do I need both products?

No. Brand Protection and Email Security are sold separately and each has its own free plan. DMARC stops mail sent from your exact domain; lookalike monitoring covers the domains attackers register instead. Many teams start with the one that matches their current problem.

What does the free plan include?

One monitored domain on each product, with no credit card and no trial clock. Brand Protection Free scans daily; Email Security Free includes report ingest, every record check and the rollout wizard. See what paid plans add.

How long does setup take?

Adding a domain starts the lookalike scan right away. For Email Security you publish one DMARC record that sends reports to PhishFence; the first reports usually arrive within a day.

Do you change my DNS?

Only if you ask. Monitoring is read-only. On paid Email Security plans you can opt in to have PhishFence host your SPF record or MTA-STS policy, with version history and one-click restore.

Lock down both halves of domain security

Start free on one domain. Upgrade either product when you are ready.

Start free Scan a domain

Free on 1 domain No credit card Cancel anytime