Email Authentication
Continuous monitoring of SPF, DKIM, and DMARC across your domains, with alerts on risky changes and guided DMARC setup.
Last reviewed:
Impersonating a company's domain almost never requires breaking into anything: a misconfigured DNS is enough for anyone to send mail that looks like yours.
What it measures
The three mechanisms that tell the world which mail is legitimately yours, and whether any of them changes without your say-so:
- SPF — which servers are allowed to send mail on your domain's behalf.
- DKIM — the digital signature that travels with each message and reveals whether it was altered in transit.
- DMARC — what the recipient should do when a message claims to be yours but fails the other two: ignore it, send it to spam, or reject it.
How to set it up
- 1
Add your domain
The root domain only, with no
http://and nowww— for exampleyourcompany.com. The first check runs within 24 hours; after that it repeats on its own. - 2
See what is missing
The domain's detail view shows the SPF and DMARC records exactly as they are published today, and which DKIM selectors were detected. That is where you see at a glance which of the three is absent.
- 3
Turn on managed DMARC (optional, but it is the short path)
Instead of standing up your own mailbox to receive reports, the platform gives you a managed alias: you copy one DMARC record into your DNS, press *I've updated my DNS*, and we receive and process the reports for you.
- 4
Confirm the DNS change
Verification takes up to an hour to reflect a DNS change. If you would rather not wait, *Check now* forces a review — with a short pause between attempts.
How to read the result
Each domain carries a risk label — low, medium, high, or *Pending* until the first check runs — and each mechanism has its own status: OK, Missing, or Needs attention.
Once the DMARC record has a reporting address configured, the large mail providers start sending aggregate reports with how many of the messages claiming to be yours actually authenticated. That percentage, charted over time, is the honest measure of whether your mail is protected: everything else is configuration.
What to do with an alert
Every alert comes with a plain-language explanation of what it means, not just the technical name:
| Alert | What to do |
|---|---|
| No SPF or DMARC protection | Publish the missing record. It is the biggest gap and the fastest to close. |
| SPF or DMARC record changed | Confirm the change was yours. An unexpected DNS change deserves a look, not a dismissed alert. |
| DMARC policy weakened | Someone moved it from "reject" down to "monitor only". This often happens during a mail migration and nobody remembers to put it back. |
| No DKIM signature | Enable it with your mail provider and publish the matching selector. |
Once the gap is closed, mark the alert resolved. The next check confirms it on its own.