DMARC monitoring and reporting
See who is sending email as your domain.
Gmail, Microsoft and other mailbox providers send DMARC reports about every message that uses your domain name. SecureMark collects those reports and shows you which senders pass, which fail, and when it’s safe to block the rest.
Free, and nothing to sign up for. See whether anyone can spoof your domain, then start monitoring free to fix it. Setup is one DNS record.
What happens to a spoofed email?
Someone sends an invoice scam from a server you don’t control, using your address. Pick a policy.
Delivered to the inbox. Receivers report the failure to you but still deliver the message. You see the spoof in SecureMark, and so does your customer.
Moved to junk. Receivers treat mail that fails DMARC as suspicious and file it away from the inbox.
Refused before delivery. Receivers turn the message away. Only the services you’ve authorised can send as your domain.
Free tools, no account needed
- Check a domain Grade its DMARC policy, with SPF, DKIM, MTA-STS and BIMI checked and a corrected SPF record when it can be fixed. Ask to be emailed if anything changes.
- Gmail, Yahoo and Outlook rules See whether your domain has the SPF, DKIM and DMARC that mailbox providers now require before they deliver bulk mail.
- DMARC report viewer Upload the .xml, .gz or .zip reports in your inbox and see every service sending as you, named, with what to fix. Nothing is kept.
Every sender, in one list.
Each report lists the IP addresses that sent mail using your domain and whether they passed. SecureMark recognises more than 60 mail services by the domains they sign for and their servers’ names, so your own mail platforms stand apart from the ones that shouldn’t be there. A server it doesn’t know, you mark as yours or not.
When a real service fails, like an accounting tool sending invoices without DKIM, you see which check failed, whether its DKIM key is published, and how it passes for your other domains. Say you’ve fixed it, and the next reports show whether you have.
Every server shows its country, city and network. Mail that passes DMARC from a mobile network or a proxy, where your own mail almost never comes from, is flagged as worth checking, so a too-broad SPF record or a signed message being resent by someone else stands out.
| Sending source | Messages | DMARC pass |
|---|---|---|
| Google Workspacegoogle.com | 12,480 | 99.6% |
| Mailchimpmcsv.net | 3,215 | 97.1% |
| XeroInvoices sent without DKIM | 642 | 41.0% |
| Unknown server185.234.72.19, Netherlands | 88 | 0% |
Know when it’s safe to tighten.
Jumping straight to reject can block your own invoices and newsletters. SecureMark judges each domain on its last 90 days of reports, and recommends quarantine, then reject, only once every sender you use passes and nothing unexplained is failing.
Before each step, see what it would have done: the last 90 days replayed under the next policy, with how much of your own mail would have gone to junk or been refused, sender by sender, and how much spoofing it would have stopped.
Let SecureMark host your DMARC record, with one CNAME in your DNS, and each step is a click. Changes reach mail servers within about 10 minutes, and the last one can be undone.
Domains that never send email, like parked domains and spellings bought to protect your brand, are recognised and taken straight to reject.
Ready for p=quarantine
- 47 days of reports, arriving on 45 of them
- All 3 of your senders pass DMARC
- Every failing server sorted into yours or not
- The last 90 days replayed: none of your own mail junked, 88 spoofed messages stopped
Protect the mail you receive, too.
DMARC stops others sending as you. MTA-STS protects the other direction: it tells Gmail, Outlook and other providers to deliver email to you only over an encrypted connection they can verify, so nobody in between can quietly read or change it.
It starts in testing, where senders report problems but still deliver. Every day they send a TLS report saying whether they could connect securely, and SecureMark shows what those reports say in plain words: which connections failed, to which mail server, and why.
Let SecureMark host it, with three DNS records added once. We keep the policy in step with your mail servers, collect the reports, and once 14 days of them show every connection was secured, switching to enforced is a click.
Your domain list shows where each domain stands: enforced, testing or not set up, and whether its TLS reports say all is secure.
Ready to enforce MTA-STS
- 16 days of TLS reports from Google, Microsoft and Yahoo
- All 2,914 connections to your mail servers secured
- Both of your mail servers listed in the policy
See your mail the way Gmail does.
DMARC reports tell you who sends as you. Gmail Postmaster Tools tells you how Gmail’s users take it: how much of your mail they mark as spam, and whether Gmail thinks you meet its rules for bulk senders. Add SecureMark as a user of your domain there once, and it all sits beside your DMARC reports.
Gmail asks senders to keep their spam rate under 0.1% and never reach 0.3%. SecureMark reads yours twice a day, charts the last 30 days against both lines, and emails you if it reaches 0.3%, before more of your mail starts landing in spam.
You also get Gmail’s own verdicts on one-click unsubscribe, honouring unsubscribes and message formatting, which no DNS lookup can tell you, and your SPF, DKIM and DMARC pass rates as Gmail counted them.
Gmail publishes figures for domains that send it a steady amount of mail each day.
0.04%spam rate yesterday, under Gmail’s 0.1%
- DMARC pass rate at Gmail: 99.8%
- One-click unsubscribe: meets Gmail’s rules
- Honours unsubscribes: meets Gmail’s rules
- Message formatting: meets Gmail’s rules
Watching while you’re not.
SecureMark keeps checking your domains between reports, and emails you when something needs you.
-
A sender starts failing
Your own senders are checked every hour. You hear when one starts failing DMARC, or a new one turns up failing.
-
A record breaks
Your DMARC and SPF records, the DKIM keys your mail is signed with, and your MTA-STS policy and BIMI record are checked every 6 hours. If one stays broken, you’re told.
-
Reports stop arriving
A domain that usually gets reports most days and goes a week without one is flagged, so a quiet domain never passes for a safe one.
-
A corrected SPF record
Over the 10-lookup limit, two records, a mistyped include: you get a fixed record and what changed. Or let SecureMark host your senders, so it stays under the limit as you add them and providers change their addresses.
-
Spoofed subdomains
See which subdomains mail claimed to come from, including made-up ones only spoofers use, and whether your record lets them through.
-
Your logo in the inbox
Once DMARC is enforcing, BIMI can show your logo in Gmail, Apple Mail and Yahoo. Check your record, see your logo previewed, and hear before its certificate expires.
-
A monthly report
Mail, spoofing stopped and progress to reject, emailed on the 1st and ready to print as a PDF. Send it to clients who don’t log in.
-
Built for agencies
Keep each client in its own organization, add up to 50 domains at once, bring your team in, and give a client read-only access to just their domains.
-
Someone else runs your DNS?
Email them the record, with the steps for their DNS provider, and hear when the first report arrives.
From sign-up to enforcement
-
Add your domain
Enter the domain you send email from. SecureMark checks what’s already in your DNS.
-
Publish one record
Copy a TXT record into your DNS, with walkthroughs for Cloudflare, GoDaddy and others, or let SecureMark host it. Existing DMARC settings are kept.
-
Read your reports
Reports usually start arriving within a day or two. A weekly digest sums them up, and alerts tell you when something needs you.
-
Tighten the policy
SecureMark tells you when each step from monitor to quarantine to reject is safe, and with a hosted record, takes it in one click.
New to DMARC?
Three DNS records work together to prove a message really came from you, and two more protect the mail you receive.
- SPF
- Lists the servers that are allowed to send email for your domain.
- DKIM
- Adds a signature to each message so receivers can check it wasn’t forged or altered.
- DMARC
- Tells receivers what to do when SPF and DKIM don’t line up with your domain, and asks them to send you reports.
- MTA-STS
- Tells other mail servers to deliver email to you only over an encrypted connection they can verify.
- TLS reporting
- Asks them to report each day whether they could connect to your mail servers securely.
Questions about DMARC
Not answered here? Email support@leadify.biz.
What is DMARC?
DMARC is a DNS record that tells mailbox providers like Gmail and Outlook what to do with email that claims to come from your domain but fails SPF and DKIM: deliver it, send it to junk, or refuse it. It also asks them to send you reports about every message they saw using your domain.
What is in a DMARC report?
An aggregate report is an XML file that Google, Microsoft, Yahoo and other providers send, usually once a day. It lists each IP address that sent mail as your domain, how many messages it sent, and whether they passed SPF, DKIM and DMARC. Reports hold no message content. SecureMark collects them, names the service behind each IP address, and shows the results sender by sender.
Will adding a DMARC record affect my email?
Not with p=none. A monitoring policy only asks for reports, and receivers deliver your mail exactly as before. Quarantine and reject do change delivery, which is why SecureMark only recommends them once every service you send with passes.
What is the difference between p=none, p=quarantine and p=reject?
p=none monitors only. p=quarantine asks receivers to put mail that fails DMARC in junk. p=reject asks them to refuse it before delivery. Most domains move from none to quarantine to reject as their reports show their own mail passing.
Do I need DMARC to send to Gmail, Yahoo and Outlook?
If you send 5,000 or more emails a day to them, yes. Gmail and Yahoo since 2024, and Outlook.com since May 2025, require SPF, DKIM, a DMARC record of at least p=none, and a From address aligned with SPF or DKIM. Everyone else needs SPF or DKIM, and DMARC is what stops others sending as you.
How long until DMARC reports arrive?
Usually within a day or two of publishing the record. Large providers send a report each day for every domain they received mail from.
Can SecureMark read my email?
No. DMARC reports list sending servers, message counts and SPF, DKIM and DMARC results, not the content of your messages. The free report viewer reads uploaded files in memory and keeps nothing.
Can SecureMark show my Gmail spam rate?
Yes. Add SecureMark's Google account as a user of your domain in Gmail Postmaster Tools, and your domain's page shows the share of your mail Gmail users marked as spam over the last 30 days, against Gmail's 0.1% and 0.3% limits, with Gmail's own verdict on each of its sender requirements. You're emailed if it reaches 0.3%. Gmail only publishes figures for domains that send it a steady amount of mail each day.
Can I manage DMARC for client domains?
Yes. Agencies and IT providers keep each client in its own organization, add up to 50 domains at once, bring their team in, give a client read-only access to just their domains, and send a monthly report as a PDF.
Start with monitoring.
Nothing changes for your email until you decide to enforce.