Skip to main content

DMARC monitoring that locks down your sending domain

Stop spoofing at the source. See who sends as you, fix each record, and get to p=reject without breaking real mail.

Free on 1 domain paid from $20/mo

Start free Check your DMARC record

No base plan required. Sold separately from Brand Protection.

Email security records · example.com Example data
Record Status
DMARC Protected
SPF Needs a fix
DKIM OK
MTA-STS Not set
TLS-RPT OK
email security scorecards published, each with the reason behind every point
779

From the first report to p=reject

DMARC, SPF, DKIM, MTA-STS, TLS-RPT and BIMI in one place, in the order you work through them.

Collect every DMARC report

Point your DMARC rua address at PhishFence and the daily aggregate reports from Google, Microsoft, Yahoo and other receivers are parsed for you. Forensic (RUF) reports are captured too.

  • 7 days of history on Free, 365 days on paid plans
  • TLS-RPT failure reports bucketed by cause
Activity · example.com · last 30 days Example data
Messages
27,868
Passing DMARC
96.3%
Report sources
14

Daily volume from Google, Microsoft, Yahoo and 11 other receivers.

See every service sending as you

Each sending IP is matched to its provider, so you see Google Workspace or SendGrid instead of an address. Tag the ones you use as known senders and an unknown source stands out.

  • PTR, ASN and provider attribution for every source
  • Anomaly alerts on paid plans
Senders · example.com · last 30 days Example data
IP / CIDR Provider Emails DMARC
192.0.2.0/24 Google Workspace 18,204 Pass
198.51.100.17 SendGrid 6,912 Pass
198.51.100.88 Mailchimp 2,340 Failing
203.0.113.9 Unidentified servers 412 Blocked

Fix each record with the exact change

Every record gets its own page: the live value, what is wrong, and the record to publish. SPF shows its DNS lookup count against the limit of 10.

  • DMARC, SPF and MTA-STS record builders
  • MTA-STS monitoring with a daily policy check
SPF · example.com Example data

Live record

Needs a fix
v=spf1 include:_spf.mail-host.example include:send.esp-one.example include:servers.esp-two.example include:mg.esp-three.example include:spf.office-suite.example ~all
11 DNS lookups, the limit is 10. Receivers stop evaluating at 10 and treat the result as a permanent error, so real mail can fail SPF.

The fix

Publish this record, or let PhishFence host it and keep it under the limit.

v=spf1 include:_spf.mail-host.example include:send.esp-one.example ip4:198.51.100.88 ~all

Let PhishFence host the hard records Paid plans

On any paid plan you can opt in and PhishFence hosts the MTA-STS policy file for you, and serves your SPF record so you can change senders without editing DNS each time.

  • Version history and one-click restore
  • Opt in per domain, switch back any time
Hosted records · example.com Example data
  • SPFHosted by PhishFenceVerified

    Served by PhishFence, with version history and one-click restore

  • MTA-STSHosted by PhishFenceVerified

    Policy file served for mta-sts.example.com, monitored daily

  • What stays in your DNS

    v=spf1 include:a1b2c3d4e5f60718.spf.hosted.phishfence.io ~all

Enforce when your real senders pass

The rollout moves you from p=none through a dry run to quarantine and reject. It only says go when every known sender has been passing, not on a calendar.

  • Watches your live DMARC record for the change
  • Dry run with t=y before quarantine
Rollout · example.com Example data

Rollout progress

  1. Check your senders
  2. Watch reports
  3. Test enforcement
  4. Send fakes to spam
  5. Reject fakes
  6. Done

Ready to advance

All 4 known senders have passed DMARC for 14 days. One unknown sending IP (203.0.113.9) fails, which is the mail enforcement should stop.

Getting ready for Google, Yahoo and Microsoft sender rules or an audit? Read the email trust and compliance use case →

Plans sized by how many domains you send from

  • Free

    $0/mo

    1 domain

    For trying it on one domain.

  • Starter

    $20/mo

    5 domains

    For small teams with multiple domains.

  • Pro

    $69/mo

    20 domains

    For mid-size companies with many sending domains.

  • Business

    $399/mo

    100 domains

    For enterprises and MSPs at scale.

Annual billing gives 2 months free. Compare every plan feature on the pricing page →

Need lookalike domain monitoring too? See Brand Protection →

Frequently asked questions

What is DMARC monitoring?
DMARC monitoring means ingesting the daily aggregate reports that mail receivers (Gmail, Microsoft, Yahoo, etc.) send to the rua address you publish in your DMARC record, then parsing those reports into a dashboard so you can see every IP that sent mail claiming to be your domain, broken down by ESP and pass/fail status. It is the only practical way to detect domain spoofing in real time and to ramp safely from p=none to p=reject.
How is PhishFence Email Security different from Postmark's DMARC Digests?
Postmark's DMARC Digests product is free but covers a single domain. PhishFence Email Security covers up to 5 domains for $20/month, and also ingests forensic (RUF) reports, generates your MTA-STS DNS records and policy file (or hosts it for you on any paid tier) and monitors the live policy for drift, parses TLS-RPT failure reports bucketed by cause, and includes an enforcement wizard that walks you from p=none to p=reject when your real senders are actually aligned. If you only need a single-domain DMARC digest, Postmark works. If you operate multiple domains or want TLS-RPT and MTA-STS in the same product, PhishFence is the broader fit.
Do I need to publish DNS records to use Email Security?
Yes, three of them. (1) A DMARC TXT record at _dmarc.yourdomain with rua= pointing to the PhishFence ingest address so receivers send their daily reports to us. (2) A TLS-RPT TXT record at _smtp._tls.yourdomain with rua= pointing to the same so we can collect TLS failure reports. (3) For MTA-STS, you publish a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt and a TXT record at _mta-sts.yourdomain declaring the policy ID. Our generator outputs both for copy-paste, or on any paid tier you can opt in and we host the policy file for you instead. We monitor your live policy and alert on drift. The product walks you through each one and verifies they resolve.
What happens when my DMARC reports arrive at PhishFence?
Each aggregate (RUA) report is dedup-checked, validated against the publishing org, and parsed into per-IP records. Source IPs are labeled against our ESP CIDR dictionary (Google Workspace, SendGrid, Mailchimp, hundreds more) so you immediately see whether an unknown sender is a known ESP or something suspicious. The records feed your compliance score, the enforcement wizard's safe-to-advance logic, and any alert rules you have configured. Forensic (RUF) reports are parsed the same way and surfaced individually.
Can I see the historical data after ingestion?
Yes. Every report we ingest is retained for 365 days and surfaced in your dashboard with drill-down by domain, ESP, country, and time range. You can trend SPF/DKIM alignment over time, prove compliance posture for an audit, or trace when a misconfigured sender first started leaking.

Get from p=none to p=reject, safely

Most domains never leave p=none because nobody wants to break real mail. The rollout tells you when it is safe.

Start free Check your DMARC record

Free on 1 domain No credit card Cancel anytime