Features
Everything you need to collect, analyze, and act on DMARC aggregate reports — from a single domain to hundreds — plus a header analyzer for the phishing patterns that pass DMARC cleanly.
DMARC Report Ingestion
dmarco connects to your DMARC inbox via IMAP — or a managed email collector — and automatically polls for new aggregate reports. Incoming emails are parsed whether they arrive as single-part or multipart MIME messages, and every individual record within each report is extracted, validated, and stored.
- ✓ IMAP polling or managed email collector — no inbox setup required
- ✓ Every record preserved individually, not rolled into summaries
- ✓ Automatic XML extraction from zip and gzip attachments
- ✓ Deduplication to prevent double-counting
Automated collection from Google, Microsoft, Yahoo, and every other DMARC reporter
Identify senders behind every IP address in your reports
Sender Attribution
Every IP address in your DMARC reports is enriched with reverse DNS, ASN data, CIDR range information, and country/city geolocation. dmarco maintains a built-in library of known senders — Google Workspace, Microsoft 365, Mailgun, SendGrid, Amazon SES, and more — so you can instantly see which services are sending as your domain.
- ✓ IP enrichment with reverse DNS, ASN, and country/city geolocation
- ✓ ASN lookup for network-level identification
- ✓ CIDR matching against known provider ranges
- ✓ Built-in known sender library, continuously updated
DNS Diagnostics
dmarco validates your DMARC and SPF DNS records in real time, flagging misconfigurations and providing actionable recommendations. SPF record history is tracked so you can see when changes were made and correlate them with report data.
Live validation of your DMARC and SPF records with clear guidance
Approve or reject senders on a per-domain basis
Per-Domain Sender Review
For each domain you monitor, dmarco lets you approve or reject individual senders. The review workflow cross-references each sender against your SPF record to show whether they are already authorized, making it easy to build a complete picture of your legitimate sending infrastructure.
- ✓ Approve/reject workflow for every discovered sender
- ✓ SPF authorization status for each sender
- ✓ Filter by status: approved, rejected, or pending
- ✓ Policy enforcement readiness based on sender coverage and pass rates
Alerting & Email Notifications
Stay informed when something changes. dmarco detects unknown senders, SPF/DKIM failure spikes, SPF record changes, and volume anomalies. Alerts are delivered via email (with RFC 8058 one-click unsubscribe), webhooks, or both.
- ✓ 5 alert types: unknown senders, SPF/DKIM spikes, SPF changes, volume anomalies
- ✓ Email delivery with per-recipient unsubscribe and suppression
- ✓ Webhook delivery to Slack, PagerDuty, or any HTTP endpoint
- ✓ Per-domain configurable thresholds with alert filtering
Real-time notifications when your email authentication landscape changes
Step-by-step guidance from first login to full monitoring
Setup Wizard
Getting started with DMARC monitoring shouldn't be complicated. dmarco's guided onboarding walks you through connecting your inbox, adding domains, and verifying your DNS configuration. Per-domain progress tracking shows you exactly what's left to do.
- ✓ Guided step-by-step onboarding flow
- ✓ Per-domain setup progress tracking
- ✓ DNS record verification checks
- ✓ Inbox connection testing and validation
Multi-Tenant
dmarco is designed for teams and agencies managing multiple organizations. Each organization gets fully isolated data, its own settings, and independent sender review workflows. Secure authentication with SSO support and tier-based feature gating ensure each org gets the capabilities they need.
- ✓ Complete data isolation between organizations
- ✓ Secure authentication with SSO support
- ✓ Tier-based feature gating per organization
- ✓ Organization-scoped settings and configurations
Manage multiple organizations with complete data isolation
Every record, every result — not just aggregated percentages
Record-Level Detail & Data Ownership
Most DMARC tools reduce your reports to pass/fail percentages. dmarco preserves every individual record — each source IP, each authentication result, each message count — so you can investigate issues at the most granular level. Your data belongs to you on every plan, with full export and inspection access.
- ✓ Every DMARC record stored individually, not summarized
- ✓ Per-IP authentication results with SPF and DKIM detail
- ✓ Full data ownership on every plan — no lock-in
- ✓ Data export so you always have access to your records
Practical guides that connect to product workflows
Built-In Education
DMARC enforcement decisions shouldn't require outside research. dmarco includes practical guides that explain when to tighten policy, how to identify legitimate senders, and how to communicate changes to IT and management — all linked from the product where you need them.
- ✓ Decision guides for policy progression (none → quarantine → reject)
- ✓ Interpretation guides for common report scenarios
- ✓ Ready-to-use email templates for IT and management requests
- ✓ Contextual links from diagnostics and recommendations
Header Analyzer — beyond DMARC
DMARC says the sender is real. That doesn't mean the message is.
DMARC verifies the domain that sent an email. It does not verify the display name the reader sees, the brand the body claims, where the links inside point, or whether a forwarded message is still the one that authenticated. Paste a message's raw headers and the analyzer runs the layers below on top of the DMARC/SPF/DKIM result.
Free · No signup required
Sender identity
Display names that impersonate a known brand (PayPal, Chase, Microsoft) sent from a domain that brand doesn't use. The pattern that lets a compromised marketing account send convincing phishing.
Display-name impersonation →Body-brand divergence
Bodies that render as a well-known brand while their links and tracking pixels point somewhere the brand doesn't use. Common on compromised ESP customer accounts.
Brand in the body, not in the links →Mailing-list forwarding + ARC
Google Groups, Mailman, Substack rebroadcasts — a list that keeps the original From breaks DMARC by design, and one that rewrites it hides who really sent the message. The analyzer reads the pre-forward authentication from ARC and refuses to trust an unattested forwarding record.
Mailing lists + ARC →Link-host lookalikes
Page-builder subdomains shaped to look like the sender's own domain. Everything a compromised marketing address needs to land a lure that reads as legitimate.
example-org-a1b2c3.webflow.io Link-host lookalikes →IDN homographs
Unicode characters that render identically to ASCII letters. A Cyrillic look-alike of paypal.com is indistinguishable to the eye and resolves to an entirely different registered domain. The Punycode form is the truth.
раураӏ.com → xn--80aa0cbo65f.com IDN homograph attacks →Path masquerade
The sender's domain in the URL path or query on a foreign host. Weaker signal alone; combined with an insecure scheme or attacker-writable host, decisive.
redirect.example/go?url=example.org How the layers fit together →URL shortener resolution
A shortener host tells you nothing on its own. dmarco resolves shortened links on a curated list through a hardened outbound fetcher, then runs every check above on the true destination.
URL shorteners →Domain authentication (DMARC / SPF / DKIM)
The foundation the seven layers sit on. Authentication verifies the domain; the layers above verify the presentation, downgrading a clean authentication verdict when the message layered on top of it is misleading.
Why mail can fail DMARC even when SPF passes →The analyzer is one layer of defense, not a verdict on every threat. It reports the patterns it can see in the headers and body of the message you paste — a clean result means those checks found nothing, not that the message is guaranteed safe. Read the email-safety overview for how it complements domain-wide DMARC monitoring.
One-click email analysis from inside Outlook
Outlook Add-in
Empower everyone in your organization to verify suspicious emails without leaving their inbox. The dmarco Outlook Add-in adds an Analyze button to the Outlook ribbon — one click sends the message for DMARC, SPF, and DKIM analysis, with a plain-language verdict emailed back in seconds.
- ✓ Single-click analysis from Outlook web, desktop, and mobile
- ✓ Plain-language recommendation: Legitimate, Review carefully, Suspicious, or Likely spoofed
- ✓ Detects internal Microsoft 365 messages and skips unnecessary analysis
- ✓ Auto-configured — no per-user setup, deploys to your whole tenant via M365 Admin Center
- ✓ Optional CC to your security team on every analysis
Ready to take control of your email authentication?
Get started in minutes. Free plan available.