The portal
Three questions, answered on sight.
Are we protected? Who is sending as us? Is anyone faking us? The portal has a page for each.
Home
Every domain with its protection stage, its live record and its security score. A progress strip reads Observe, Quarantine, Reject.
Your domains
harbourview.example
p=reject✓ Reject
p=reject✓ Reject
calderfinch.example
p=quarantineQuarantine 50%
p=quarantineQuarantine 50%
tidewell.example
p=noneObserve
p=noneObserve
DMARC Reports
Who sent mail as you and how much of it passed, sender by sender. A monthly PDF, and one on demand.
Top sending sources
Microsoft 365
229 messages✓ Legitimate
229 messages✓ Legitimate
Newsletter service
17 messages✓ Legitimate
17 messages✓ Legitimate
Accounts software
13 messagesNeeds a fix
13 messagesNeeds a fix
Senders to confirm
When we cannot tell whether a sender is yours, we ask. "Not sure" is an answer: it leaves the sender with our engineers.
Is this sender yours?
Impersonation
Mail failing DMARC in your name is grouped into campaigns. A campaign your policy already blocked is logged as good news and never emailed. The page states its one blind spot openly: fakes sent through shared mail providers.
Campaigns in your name
Fake invoices
Blocked by your policy✓ Blocked
Blocked by your policy✓ Blocked
Password reset
Some reached an inboxLive
Some reached an inboxLive
Email Investigation
Paste the headers of a suspicious email. It shows who really sent it, the route it took, and the SPF, DKIM and DMARC results. It reads headers only, so where it cannot verify a signature it says so.
Who really sent it
Security posture
The score and its findings, the fix plan with a PDF, and a scanner for any other domain.
Fix plan · calderfinch.example
Tools
Nine checkers: DMARC, SPF, DKIM, MTA-STS and TLS reporting lookups, an SPF generator, a DNS record checker, a domain scanner and a look-alike domain check.
DMARC lookup
Signing in
A Microsoft work account
A passkey
It runs in any browser, phones included, and installs from the browser as an app. It is not in an app store.
Leaving
The account holder can delete the account from the portal. It first lists what will go and the records to change in your own DNS, and it refuses while a domain still takes its DMARC policy from us, so nobody is left without DMARC.
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.