DomainCanary Start free

DMARC enforcement with automatic rollback

Stop email spoofing without blocking your own mail.

We move your DMARC policy to p=reject one step at a time, and you approve each step. When a sender you marked as yours sends enough mail to measure and a step starts blocking it, we put the previous policy back.

  • You approve every change
  • If a step blocks your own email, we undo it
  • Try it free for 30 days, no credit card needed

Rollback works with hosted DMARC, on the Starter plan and up, in the days after each step. How rollback works

01  What you already have

Email providers send a daily report on mail from your domain

Receivers, meaning the mail servers at Gmail, Outlook, and the rest, send them to the address in your DMARC record. We turn them into a list of senders you can read.

What a receiver sends Illustration

<row>  <source_ip>198.51.100.14</source_ip>  <count>340</count>  <policy_evaluated>    <disposition>none</disposition>    <dkim>fail</dkim>    <spf>fail</spf>  </policy_evaluated></row><row>  <source_ip>192.0.2.10</source_ip>  <count>8412</count>  …

What you see

Illustration: senders from one week of reports, with example values
SenderMessagesDMARC
Microsoft 365192.0.2.10 · marked as yours8,412pass
Newsletter toolmarked as yours1,236pass
Invoicing toolmarked as yours212pass
198.51.100.14new this week · not marked340fail
Illustration  Example values.

02  Why most domains never turn protection on

To Gmail and Outlook, mail from a tool you forgot to set up looks the same as forged mail

Turn on protection before you find those tools, and your own invoices and password resets stop arriving. We find them for you first, in your daily reports.

If you turn protection on todayIllustration
Your invoicing appSends your invoices. Not set up yet.
BlockedYour customer never gets the invoice
A scammerPretending to be you
BlockedYour customer never sees the fake

To the email provider, the two look the same. Neither one is set up, so both are blocked.

With us, you turn protection on after you set up your tools. We find them first, so the fake gets blocked and your invoices keep arriving.

Half of the top million domains with a valid DMARC record still have protection turned off (p=none). DMARC Census, Oct 2026

03  How we get you to p=reject

We time each step from your reports. You approve it, and we publish it.

  1. You mark which senders are yours

    Your reports list the servers that send as your domain. You mark the ones you use.

    v=DMARC1; p=noneReports coming in every day

  2. We propose the next step

    When your last 4 weeks of reports show few enough failing messages from senders you haven't marked, we email you the exact record.

    v=DMARC1; p=quarantineProposed to you by email

  3. You approve it, and we publish it

    You approve from a link in the email. With hosted DMARC, there's no DNS edit on your side.

    v=DMARC1; p=quarantinePublished through hosted DMARC

  4. We watch reports after the step

    We compare each new report with the ones from before the step. Then we propose the next one, up to p=reject.

    v=DMARC1; p=quarantineWatching reports after the step

04  Automatic rollback

If a step starts blocking your own email, we put the previous policy back

We check each daily report during the watch after a step. If we roll back, we email you what we saw.

Rollback comes with hosted DMARC, on the Starter plan and up.

How rollback works
  • It needs hosted DMARC, because we can only put back a record we serve.
  • We roll back only during the report watch after a step. The usual watch is 3 days. We set it from how fast your domain's own reports arrived after earlier changes. We watch a step into reject for at least 3 days.
  • We roll back when a sender you marked as yours has at least 20 messages at one receiver, and 20 points more of them are quarantined or refused than before the step.
  • Receivers send reports about once a day. We act on the report that shows the problem.
  • If someone edits the record during the watch and we then need to roll back, we keep their edit, pause guided enforcement and email you.
  • We can't bring back mail a receiver already refused.
  • After the watch ends, if a new sender starts failing, we send you a same-day alert. Your policy stays where it is.
Your invoicing toolMail refused at one receiver
The day 2 report shows 31% of 212 messages refused. We put p=quarantine back and email you.Illustration

05  After the watch

A digest every Monday, and an alert the day a report shows a new sender failing

The digest lists each sender and whether its mail passed. When a report shows a new sender failing, we email you that day.

The digest comes with every plan. Same-day alerts come with the Starter plan and up.

The Monday digest email for shop.example.com: 97.3% DMARC pass, down 2.0 points on last week, 12,761 messages across 7 reports, with 1 new failing source listed.
Alert · example.comToday

A new sender, 198.51.100.24, sent 350 messages as example.com and all 350 failed DMARC.

Illustration
A real Monday digest, for an example domain with example numbers.

06  For MSPs

Every client's domains in one place, with the worst first

Group each client's domains, share a read-only report with your name on it, and give each technician the groups they manage.

DomainCanary for MSPs
ClientsWorst first
Illustration: client groups, worst first
ClientPolicyFailing
Harborview Dental Studioharborviewdentalstudio.comp=nonep=none1,284
Kestrel Hall Legalkestrelhalllegal.comp=quarantinep=quarantine212
Quillmoor Logisticsquillmoorlogistics.comp=nonep=none96
Alder Finch Accountingalderfinchaccounting.comp=rejectp=reject18
Birchway Clinicbirchwayclinic.comp=rejectp=reject0
Failing messages this weekIllustration
Client names and domains are made up for this illustration.

07  Plans and price

Plans priced by the number of domains

Guided enforcement, hosted DMARC, and rollback come with the Starter plan and up. On the free plan, we watch 1 domain with the Monday digest and sender grading.

Free

For watching one domain

$0

Free for as long as you like

  • 1 domain
  • The Monday digest
  • Every sender graded pass or fail
  • Step-by-step proposals you publish yourself
  • Report detail kept 90 days
Start free

Starter

For one company's domains

$19 /month

or $190 a year

  • 3 domains, then $5 each
  • Hosted DMARC: we publish each step and put it back if it blocks your email
  • Same-day sender alerts
  • Report detail kept 12 months
Create your account

Business

For companies with several brands

$49 /month

or $490 a year

  • 10 domains, then $5 each
  • Everything in the Starter plan
  • Hosted SPF and hosted MTA-STS
  • TLS-RPT failures by mail server
  • Cleanup checks on every include and selector
  • One digest across all your domains
  • Client groups with scoped access
  • Report detail kept 24 months
Create your account

Portfolio

For MSPs and agencies

$79 /month

or $790 a year

  • 25 domains, then $4 each
  • Everything in the Business plan
  • Your company name on client digests
  • Report detail kept 24 months
  • $3.16 a domain with all 25 in use
Create your account

Enterprise starts at 100 domains, from $399 a month, with SSO and billing by invoice.

Get a quote

Try every feature of the Business plan free for 30 days, no credit card needed. Pay yearly and 2 months are free.

Questions

Before you add the record

Will adding a DMARC record break my email?

No. Your first record uses p=none. With it, you get reports, and receivers handle your mail the same as before.

What if I don't have a DMARC record yet?

We give you one to publish. It starts at p=none, so you get reports while nothing changes. Run the free check to see what your domain publishes today.

What if I already have a DMARC record?

You keep your policy. We read the record you publish and give it back with our reporting address added, so your policy and any reporting addresses you already have stay the same. You publish it in place of the old record, because receivers ignore DMARC when a domain publishes two records.

How long until my domain is fully protected?

Usually a few weeks. We need 14 days of reports before the first step, then we wait for new reports after each step before we propose the next one.

What happens if a step blocks my own email?

With hosted DMARC, we watch reports after each step. The usual watch is 3 days. We set it from how fast your domain's own reports arrived after earlier changes. We watch a step into reject for at least 3 days. We look at each sender you marked as yours with at least 20 messages at one receiver. If 20 points more of its messages are quarantined or refused than before the step, we put the previous policy back and email you. We can't bring back mail a receiver already refused.

Is there a free plan?

Yes. The free plan covers 1 domain with the Monday digest and every sender graded, and it has no end date. Guided enforcement, hosted DMARC, and rollback come with the Starter plan and up.

What do you do with my report data?

We turn it into your digest, alerts, and dashboard. Aggregate reports list sending servers and message counts, not message content. We share it only with the service providers our privacy policy lists, which we need to run the product.

Start by checking your domain

See the DMARC policy your domain publishes today and what a forger can do with it.

The check is free and needs no account.

Josh Purvis
Questions before you start? Email me, and I'll answer you myself.

Josh Purvis, founder of DomainCanary
Software engineer with more than 20 years of experience
contact@domaincanary.com