Skip to main content

Changelog

What's new in PhishFence, written for customers.

October 2026

  • Feature A new console

    The signed-in app has been rebuilt as a console: a navigation rail with per-area flyouts, a command-center home that shows open lookalikes, mail volume, enforcement status and what to act on, and a protection flow from threats to your domains to the receivers. Search any domain, alert or page with Cmd/Ctrl+K, see items that need action in the bell, and switch between all domains and one. Every page reads the same numbers, so a sidebar count, a tab badge and a page total never disagree.

  • Feature See the first scan as it runs

    Adding a domain now shows what the first scan is checking while you wait, with the next setup steps, instead of an empty dashboard.

  • Feature A new phishfence.io

    The website has a new product-led home built around real screenshots of the console, with clearer Brand Protection and Email Security pages.

  • Improvement Email Security numbers that reconcile

    Mail volume, pass rates and sender tables come from one aggregate, so totals match across the summary, activity and senders pages. Charts mark the trailing days whose reports have not arrived yet and compare complete days only, so a slow reporter no longer looks like a drop in mail. Date windows follow your local time zone.

  • Improvement Senders, identified

    The senders page groups sources by provider (Google Workspace, Microsoft 365, HubSpot and others), shows each sender's pass rate, and marks it Authorized, Unknown or needing review, so an unexpected source stands out.

  • Improvement Record pages lead with what is wrong

    Each record page (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and now DANE) opens with the single most important finding in plain language, the live record, and the exact change to publish. DANE is reported as advisory, and optional items are marked Review rather than Fix.

  • Improvement Unknown is never shown as OK

    When a check cannot run, for example a DNS timeout or a blocklist outage, the result reads as not checked with the time of the attempt, never as a pass, and a failed lookup never overwrites a good earlier result.

  • Improvement Lookalikes show the difference

    Lookalike domains highlight the characters that differ from your domain, with an explanation of each substitution or missing character on hover.

  • Improvement DMARC rollout in plain language

    The rollout page names each stage (check your senders, watch reports, test enforcement, send fakes to spam, reject fakes) and reads your live DNS record, so the stage shown is the one that is actually in effect.

  • Improvement Quieter alerts and digests

    Unknown-sender DMARC alerts go out once per sender, and again only after seven days or if that sender's volume doubles, instead of once per report. The weekly digest skips weeks with nothing new, and allowlisted lookalikes no longer count as threats in digests or board reports.

  • Improvement Plan changes and cancellation from the billing portal

    Switch between Starter, Pro and Business, or between monthly and annual, and cancel at the end of the period, all from the Stripe billing portal. If a renewal payment fails, access continues while the card is retried.

  • Improvement Accessibility sweep

    Every public and app page was reviewed for keyboard access, labelled form fields, contrast and phone tap targets of at least 44 pixels.

  • Fix Lookalike screenshots resumed

    Screenshots of live lookalike sites stopped being captured on 2 October after a browser library update. Captures resumed on 11 October and the backlog is being worked through.

  • Fix Allowlisted domains stay out of the way

    Domains you have allowlisted no longer get takedown prompts and no longer count toward open lookalikes.

  • Fix Scorecard refreshes no longer get stuck

    A public Security Scorecard that was being re-scanned could stay pending indefinitely; refreshes are now bounded and recover on their own.

August 2026

  • Feature Hosted MTA-STS

    Any paid Email Security plan can now opt in to have PhishFence host their MTA-STS policy file: CNAME mta-sts.<your-domain> to us and we serve it over TLS, no cert management on your end. New domains start in testing mode and only promote to enforce after a 7-day dwell with clean TLS-RPT reports, and you can repoint the CNAME away and self-host at any time.

July 2026

  • Feature AI-assisted DMARC root-cause analysis

    Email Security subscribers investigating a flagged sending source can now get a plain-English, AI-generated explanation of what's likely wrong and how to fix it, grounded in your own report data instead of generic advice.

  • Feature Free tool reports, delivered to your inbox

    You can now have your results from the Domain Lookalike Checker, DMARC Lookup, and Security Scorecards emailed to you instead of only viewing them once. The Scorecard directory also got a search box and A-Z browsing, making it easier to find a specific company.

  • Improvement DMARC enforcement wizard now watches for DNS changes

    Publish an updated DMARC record while the enforcement wizard is open and it now detects the change and updates automatically, no manual page reload needed.

  • Improvement Improved lookalike-domain detection accuracy

    We refined how PhishFence classifies flagged domains, reducing false positives so legitimate businesses are less likely to be mistakenly flagged, without weakening detection of real threats.

  • Improvement Wider lookalike-domain coverage

    PhishFence now checks a broader set of lookalike-domain patterns when scanning for threats to your brand, so more real-world impersonation attempts get caught.

  • Fix More accurate DKIM detection, including Apple iCloud+

    DKIM checks now recognize a wider set of provider signing configurations, including domains verified through Apple iCloud+ Mail's custom-domain feature, so they're no longer incorrectly reported as missing DKIM.

  • Fix Better DMARC forensic-report guidance

    Improved the guidance PhishFence gives for DMARC forensic reporting (ruf) so recommendations always reflect a working, correctly-configured setup.

  • Fix Fewer false 'visual change detected' alerts

    Visual-change alerts are now less likely to fire on routine, non-threatening changes to your site, cutting down on false alarms.

  • Fix Recommended Actions cards fixed and focused

    Fixed the Recommended Actions cards on alert pages so they only appear for alerts that need your attention, link directly to the relevant alert, and display correctly instead of as broken, overlapping boxes.

June 2026

  • Feature Guided setup, delivered to your inbox

    PhishFence now sends a short, personalized email series that walks you through getting protected: add a domain, turn on Email Security, publish your DMARC record, and ramp safely from monitoring to full enforcement. Each email reflects exactly where your domains stand and the single best next step to take, with the copy-paste DNS record when you need one. At most one email a week, and one-click unsubscribe any time.

  • Feature Start (and extend) your free trial yourself

    Turn on a 14-day trial of Brand Protection and Email Security right from the billing page, no sales call needed. If you need a little longer to finish your DMARC setup, you can extend the trial once with a single click.

  • Feature DANE / TLSA added to your email posture

    For DNSSEC-signed domains we now check for DANE (TLSA) records that pin your mail server's certificate, an advanced protection against mail-in-transit tampering. It is advisory only and never affects your grade, so you can see at a glance whether it is in place without any risk to your score.

  • Improvement More accurate visual matching on lookalike alerts

    We recalibrated how we measure how closely a suspicious site resembles yours, leading with AI image-embedding matching instead of surface-level page structure. The visual-similarity score on an alert now reflects real resemblance to your brand, so the percentage you see is one you can trust when deciding what to act on first.

May 18-25, 2026

  • Feature Bulk domain add/remove from the dashboard

    New drawer lets you paste a newline-separated list of domains to monitor, or select multiple rows and remove them in one shot.

  • Feature User-facing audit log

    Every account action (logins, domain adds, scan triggers, status changes) is now visible to the account owner under Settings → Audit Log.

  • Feature DNS auto-publish for Cloudflare (DMARC MVP)

    Connect a Cloudflare API token, pick a domain, and PhishFence will publish the recommended DMARC record straight to your zone. Your token is stored encrypted.

  • Improvement Deeper DMARC + SPF diagnostics

    Per-record diagnostics now cover alignment quirks, SPF lookup-count overruns, and risky mechanism use, and the Email Security advisor grounds its recommendations in them.

  • Improvement Email Security woven into onboarding

    New users see Email Security as a first-class second half of the product from step 1 of onboarding, not as a bolt-on later.

  • Security Team-aware API tokens

    API endpoints (/api/v1/domains, /alerts) now respect team membership, so a member's token sees exactly the shared data it should. Shipped alongside a broader security hardening pass across the API and billing.

April 2026

  • Improvement Trial expiry reminders

    Users on the free plan get a clean reminder cadence ahead of trial expiry rather than a sudden cut-off.

Customers can turn product-update emails on or off in Settings, Notifications (log in first).