DMARC monitoring

What this tool does

A DMARC record can ask receivers such as Google, Microsoft and Yahoo to send you a daily aggregate report: which IP addresses sent mail as your domain, how much, and whether it passed SPF, DKIM and DMARC. The reports are XML files, usually zipped, and a busy domain gets several a day. Reading them by hand is no fun.

With DMARC monitoring you get a report address of your own. Receivers send their reports to it; we read each one with the same parser as the DMARC report reader, delete the email, and add the results to your account:

• the DMARC pass rate per day, for the last 90 days;
• every sender (grouped by provider: Google Workspace, Microsoft 365, SendGrid, Amazon SES and others) with its volume and pass rate;
• the busiest sending IPs and their reverse DNS names;
• why failing mail fails: not signed with DKIM, signed by another domain, IP not in SPF, SPF passing for another domain;
• which organisations sent the reports;
• a weekly summary email, which you can turn off per domain.

How to set it up

1. Sign in (free, no password) and open DMARC reports in your account.
2. Add your domain. You get the address to send reports to, and the exact DMARC record to publish. If your domain already has a DMARC record, the suggestion keeps its policy and adds our address next to any report addresses you already use.
3. Publish the record at your DNS provider, with the thenetworkery-verify= TXT record shown in your account, which proves the domain is yours. As soon as both are visible, reports are accepted. The first reports usually arrive within a day or two.

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@thenetworkery.com"

Start with p=none if you don't have a DMARC record yet: nothing changes for your mail, and the reports show you every service that sends as your domain. Once they all pass, follow the guide to moving from p=none to p=reject.

Why verification is needed

Anyone could put any address in their DMARC record, and anyone could send us a forged report. So reports are accepted only for domains whose owner proved control of their DNS: the domain must publish the thenetworkery-verify= TXT record shown in your account. A report is also kept only when the domain it is about is your domain or one of its subdomains.

Receivers also check that a report address on another domain agrees to take your reports (RFC 7489 section 7.1). We publish the record that says so, so there is nothing extra for you to add.

Limits and privacy

A free account can monitor 5 domains and receive up to 200 reports a day per domain. Each report is kept as a summary (counts, results and the 25 busiest sending IPs, never the report file) for 400 days after its reporting period, up to 3,000 reports per account. You can delete reports, stop receiving them for a domain, or delete your account at any time.

FAQ