For businesses, agencies and IT providers
DMARC monitoring and reporting.
See who sends email as your domain. SecureMark reads your DMARC reports, names sending services and shows what to fix before you request enforcement.
Free domain check, no account needed. Aggregate reports contain sending servers and authentication results, not message content.
Free monitoring: 1 domain, 2 team members, 30 days of report history. No card required.
Xero needs fixing before yourcompany.com can enforce DMARC. Its invoices are sent without DKIM, and an unknown server is failing too.
| Sending source | Messages | DMARC pass |
|---|---|---|
| Google Workspacegoogle.com | 12,480 | 99.6% |
| Mailchimpmcsv.net | 3,215 | 97.1% |
| XeroInvoices sent without DKIM | 642 | 41.0% |
| Unknown server185.234.72.19, Netherlands | 88 | 0% |
See how DMARC works Try each policy on a spoofed invoice. The simulator shows what each one asks receivers to do; it isn’t a delivery guarantee.
DMARC lets you tell receivers what to do with mail that claims to be from you but fails SPF and DKIM, and asks them to send you reports about it.
Start with p=none to see who sends as you, then request quarantine and reject once your own senders pass. Receivers apply their own policies too, so DMARC requests handling rather than guaranteeing it.
Illustrative DMARC policy simulator
Someone sends an invoice scam from a server you don’t control, using your address. Pick a policy. This example shows requests, not guaranteed delivery outcomes.
No DMARC enforcement requested. The receiver may still deliver, filter or reject the message under its own policy. Inbox placement is not promised.
Quarantine requested. The receiver is asked to treat failing mail as suspicious, often by placing it in junk. Its own policy determines handling.
Rejection requested. The receiver is asked to refuse failing mail. Receiver policy may override this; DMARC cannot prevent every form of impersonation.
Understand, fix, then strengthen
-
Recognise your senders
Each report lists the servers that sent mail using your domain and whether they passed. SecureMark recognises more than 60 mail services, so your own platforms stand apart from the ones that shouldn’t be there. A server it doesn’t know, you mark as yours or not.
Where each server comes from
Services are recognised by the domains they sign for and their servers’ names. Every server shows its country, city and network. Mail that passes DMARC from a mobile network or a proxy, where your own mail almost never comes from, is flagged as worth checking, so a too-broad SPF record or a signed message being resent by someone else stands out.
-
Find authentication problems
When a real service fails, like an accounting tool sending invoices without DKIM, you see which check failed, whether its DKIM key is published, and how it passes for your other domains. Say you’ve fixed it, and the next reports show whether you have.
-
Assess enforcement readiness
Use observed results to plan a staged policy change. Past results cannot guarantee future delivery. See a readiness example.
Managing client domains? Explore SecureMark for agencies. Working with an AI assistant? Connect your agent with MCP.
Explore enforcement, secure delivery and Gmail examples
Assess the next enforcement step.
Jumping straight to reject can block your own invoices and newsletters. SecureMark judges each domain on up to 90 days of available reports, and recommends quarantine, then reject, only once every sender you use passes and nothing unexplained is failing.
Before each step, see what it would have done: available reports replayed under the next policy, with how much observed mail would have failed the proposed policy, sender by sender. Receiver handling can differ. Past observations cannot guarantee future mail.
Let SecureMark host your DMARC record, with one CNAME in your DNS, and each step is a click. Changes reach mail servers within about 10 minutes, and the last one can be undone.
Domains that never send email, like parked domains and spellings bought to protect your brand, are recognised and taken straight to reject.
Ready for p=quarantine
- 47 days of reports, arriving on 45 of them
- All 3 of your senders pass DMARC
- Every failing server sorted into yours or not
- The last 90 days replayed: no observed legitimate failures, 88 unauthorized messages would fail the proposed policy
Protect the mail you receive, too.
DMARC helps reduce direct domain spoofing. MTA-STS protects the other direction: it tells Gmail, Outlook and other providers to deliver email to you only over an encrypted connection they can verify, so nobody in between can quietly read or change it.
It starts in testing, where senders report problems but still deliver. Every day they send a TLS report saying whether they could connect securely, and SecureMark shows what those reports say in plain words: which connections failed, to which mail server, and why.
Let SecureMark host it, with three DNS records added once. We keep the policy in step with your mail servers, collect the reports, and once 14 days of them show every connection was secured, switching to enforced is a click.
Your domain list shows where each domain stands: enforced, testing or not set up, and whether its TLS reports say all is secure.
Ready to enforce MTA-STS
- 16 days of TLS reports from Google, Microsoft and Yahoo
- All 2,914 connections to your mail servers secured
- Both of your mail servers listed in the policy
See your mail the way Gmail does.
DMARC reports tell you who sends as you. Gmail Postmaster Tools tells you how Gmail’s users take it: how much of your mail they mark as spam, and whether Gmail thinks you meet its rules for bulk senders. Add SecureMark as a user of your domain there once, and it all sits beside your DMARC reports.
Gmail asks senders to keep their spam rate under 0.1% and never reach 0.3%. SecureMark reads yours twice a day, charts the last 30 days against both lines, and emails you if it reaches 0.3%, so you can investigate.
You also get Gmail’s own verdicts on one-click unsubscribe, honouring unsubscribes and message formatting, which no DNS lookup can tell you, and your SPF, DKIM and DMARC pass rates as Gmail counted them.
Gmail publishes figures for domains that send it a steady amount of mail each day.
0.04%spam rate yesterday, under Gmail’s 0.1%
- DMARC pass rate at Gmail: 99.8%
- One-click unsubscribe: meets Gmail’s rules
- Honours unsubscribes: meets Gmail’s rules
- Message formatting: meets Gmail’s rules
From sign-up to enforcement
-
Add your domain
Enter the domain you send email from. SecureMark checks what’s already in your DNS.
-
Publish one record
Copy a TXT record into your DNS, with walkthroughs for Cloudflare, GoDaddy and others, or let SecureMark host it. Existing DMARC settings are kept.
-
Read your reports
Reports usually start arriving within a day or two. A weekly digest sums them up, and alerts tell you when something needs you.
-
Tighten the policy
SecureMark helps you assess each step from monitor to quarantine to reject, and with a hosted record, takes it in one click.
MCP and API access
Your DMARC data, in your tools and AI conversations
Connect a compatible AI assistant through MCP (Model Context Protocol) to explore your DMARC data in conversation. Use the read-only API to bring the same data into your reports and dashboards.
-
Ask your AI agent
Ask which senders are failing DMARC, compare results across reporting periods, or get a summary of last week's reports. Your agent can read domain summaries, sending sources and report records to support its answer.
-
Automate reports and dashboards
Pull DMARC summaries, sending sources and individual report records into scheduled exports and client reports. Combine authentication results and message volumes with your other business data.
-
Choose what each connection can read
Create a separate API key for each agent or integration, choose its read permissions and domains, and revoke access from your account. MCP tools read stored reports; they cannot change DNS or send email.
MCP and API access require a plan that includes API access. Choose an MCP client that supports API keys in its secure connection settings. Compare plans and API access.
Monitoring that fits your organization
Free monitoring: 1 domain, 2 team members, 30 days of report history. No card required.
Monitoring shows authentication results. Blocking unauthorized senders requires a separate enforcement decision and remains subject to receiver policy.
- Free: Free
- Starter: R149 per month, incl. VAT
- Business: R449 per month, incl. VAT
- Agency: R1 199 per month, incl. VAT
Compare current plans. Choose a plan from your Subscription page and confirm its price before paying by card through Payfast. For a plan Leadify invoices, contact billing support.
Free tools, no account needed
- Check a domain Grade its DMARC policy, with SPF, DKIM, MTA-STS and BIMI checked and a corrected SPF record when it can be fixed. Ask to be emailed if anything changes.
- Gmail, Yahoo and Outlook rules See whether your domain has the SPF, DKIM and DMARC that mailbox providers now require for bulk senders; delivery also depends on other checks.
- DMARC report viewer Upload the .xml, .gz or .zip reports in your inbox and review reported sending services, with what to fix. Nothing is kept.
Questions about DMARC
Not answered here? Email support@leadify.biz.
What is DMARC?
DMARC lets a domain request handling of messages that fail aligned SPF and DKIM authentication, and aggregate reports from participating receivers. Reports do not cover every message. Receivers apply their own policies.
What is in a DMARC report?
An aggregate report is an XML file that Google, Microsoft, Yahoo and other providers send, usually once a day. It lists each IP address that sent mail as your domain, how many messages it sent, and whether they passed SPF, DKIM and DMARC. Reports hold no message content. SecureMark collects them, names the service behind each IP address, and shows the results sender by sender.
Will adding a DMARC record affect my email?
p=none requests no DMARC enforcement; it does not promise delivery or inbox placement. Receivers still apply their own filtering. Review legitimate senders before requesting quarantine or reject.
What is the difference between p=none, p=quarantine and p=reject?
p=none requests no enforcement. p=quarantine requests suspicious handling, often junk; p=reject requests refusal. Receiver policy determines actual handling. Observed readiness cannot guarantee future mail, or prevent all impersonation, lookalike domains or compromised authorized senders.
Do I need DMARC to send to Gmail, Yahoo and Outlook?
Google applies bulk requirements at about 5,000 messages per day to personal Gmail accounts. Yahoo defines bulk senders by significant volume without a published numeric threshold. Microsoft applies its high-volume requirements to domains sending over 5,000 messages per day to Outlook.com consumer accounts. These groups require SPF, DKIM and DMARC (p=none is sufficient), with aligned authentication. Other requirements also apply; passing a DNS check does not guarantee delivery.
How long until DMARC reports arrive?
Reports usually arrive within a day or two after setup and mail reaching participating receivers. Timing and coverage vary; arrival is not guaranteed.
Can SecureMark read my email?
No. DMARC reports list sending servers, message counts and SPF, DKIM and DMARC results, not the content of your messages. The free report viewer reads uploaded files in memory and keeps nothing.
Can I access my DMARC data through an API?
Yes. Plans that include API access let you read your organization's domains, DMARC summaries, sending sources and report records from your own tools. Use it for dashboards, scheduled exports and client reporting. Each integration uses an API key with the read permissions and domain access you choose.
Can I connect my AI assistant to SecureMark?
Yes. On a plan with API access, connect a compatible AI assistant or developer agent through MCP (Model Context Protocol). Ask it to explain DMARC results, compare sending sources or summarize reports for the domains you allow. Your client must support an API key in its secure connection settings. Access is read-only, with permissions you choose and can revoke.
Can SecureMark show my Gmail spam rate?
Yes. Add SecureMark's Google account as a user of your domain in Gmail Postmaster Tools, and your domain's page shows the share of your mail Gmail users marked as spam over the last 30 days, against Gmail's 0.1% and 0.3% limits, with Gmail's own verdict on each of its sender requirements. You're emailed if it reaches 0.3%. Gmail only publishes figures for domains that send it a steady amount of mail each day.
Can I manage DMARC for client domains?
Yes. Agencies and IT providers keep each client in its own organization, add up to 50 domains at once, bring their team in, give a client read-only access to just their domains, and send a monthly report as a PDF.
Start with monitoring.
Begin by observing authentication. p=none requests no enforcement and makes no delivery guarantee.
Free monitoring: 1 domain, 2 team members, 30 days of report history. No card required.