Step by step to full enforcement, with automatic rollback.
Full enforcement means receivers reject mail that fails DMARC, and one step too far catches your own mail with it. Guided enforcement walks you there one step at a time. Each step is proposed when your reports say it is safe, watched for three days after it goes live, and rolled back automatically if something goes wrong.
Create your account Check your policy today, free
One step at a time · Automatic rollback · Part of every paid plan
Every step is sized from your own reports
You set a budget: how many failing messages one step may expose. We read the last four weeks of reports, take the worst day of unexplained failures, and size the step so it stays inside that budget.
The ladder
From p=none to quarantine at a small percentage, quarantine
for all mail, reject for a sample, then reject for everything. Subdomains get the
policy they already had, written out explicitly.
The gates
A step is offered only when the reports are fresh, the big receivers are reporting, DKIM aligns on at least 80% of your passing mail, SPF is at eight lookups or fewer, and every failing sender has been marked as yours or not yours.
Monday or Tuesday
A step publishes early in the week, so its three-day watch closes before the weekend.
You choose who publishes
Approve each step from a link in the mail and we publish the exact record you saw. Or have the mail tell you the tags to set, and publish them yourself.
Automatic rollback when something goes wrong
After each publish we watch the reports under the new policy for three days. If a receiver starts quarantining or rejecting a sender you marked as yours, we put the previous record back and pause. Nothing retries on its own.
The abort rule, in numbers
One receiver, one sender you own, its rejected share up twenty points on at least twenty messages. That is the trigger. Anything smaller is noise.
Overrides do not count
Mail a receiver held under its own local policy, or a mailing list rewrote, is left out of the judgement.
Your edits win
If you change the hosted record inside the window, the step stands down and the ramp pauses rather than fighting you.
Every step on the record
Each move keeps the record before and after, the percentage, the forecast and the outcome, on the domain's page.
Hosted DMARC, and a few weeks of reports
Approving from the mail needs hosted DMARC, so the revert can happen without you. Without it, guided enforcement still sizes and proposes each step and mails you the tags to set. Either way it reads your reports, so it starts after your first weeks of monitoring, once the senders the digest lists have been marked as yours or not yours.
Part of Starter and up
Guided enforcement comes with Starter, beside the monitoring it's built on: the Monday digest, same-day alerts, and the sender evidence behind every verdict. Starter is $19 a month for 3 domains, Business is $49 for 10, Portfolio is $79 for 25. Every Business feature is free for 14 days, no card.
Where to go next
Questions people ask first
Does it change my policy on its own?
No. Every step is proposed to you by mail. You approve it from the link, or publish the tags yourself. The one thing that happens without you is the revert.
What does the budget mean?
How many failing messages one step may expose to a stricter policy. The step's percentage is sized so the worst day in the last four weeks stays inside it. If even one percent would overspend, the step waits.
How long until my domain is fully protected?
About as long as doing it by hand. Each step waits for reports under the new policy before the next is offered, and receivers report once a day. The difference is that nobody has to remember, and a bad step undoes itself.
What if nobody reports under the new policy?
The window stays open rather than counting as safe. After a week with no report under the new policy the ramp pauses and tells you.
What happens after a revert?
The previous record is back, the ramp is paused, and you get a mail naming the sender and the receiver. It never retries on its own. You read the evidence and start it again.
Do I need hosted DMARC?
For the revert, yes: we can only put a record back if we serve it. Without hosted DMARC, guided enforcement still sizes and proposes each step and mails you the tags to set, and you publish them yourself.
What does it cost?
It's part of every paid plan. Starter is $19 a month for 3 domains, Business is $49 for 10 and Portfolio is $79 for 25. Every Business feature is free for 14 days, and the trial needs no card.
Start it, and let your reports set the pace
Add the domain, mark the senders the first digests list, and the first step is proposed when the gates open.
First domain free · 14 days of every paid feature · No card
- Each step checked against your reports
- Three days of watching after each change
- Automatic rollback if something goes wrong
- Every step on the record, before and after