For MSPs and IT providers
Get every client domain to p=reject, and hear the same day when a client adds a sender without telling you
Add your clients' domains from a spreadsheet and see which ones anyone can spoof today. Tighten each policy with changes you approve. When a report shows a new sender failing on a client's domain, we email you that day.
01 Onboarding
Add a client's domains by pasting a list
Paste domain,group lines, with the client's name as the group, or drop in a CSV. Before anything is added, the preview shows the DMARC record each domain publishes today, so you see which clients have no protection at all. We create the groups as the domains are added.
Check a whole list first
The bulk check reads the DMARC record of every domain on a list you paste and gives you the results as a table or a CSV. It works during the trial and on every paid plan. You can send its list straight into the import, or save the domains, such as prospects, to a watch list. We check their DMARC and SPF records daily and email you when one gets worse.
Keep your current DMARC tool while you try ours
A DMARC record can list more than one reporting address. The preview marks the domains that already report to another service, and you add our address beside theirs.
A change request for whoever holds DNS
Each group gets a list of the records to publish and a plain-text change request you can paste into a ticket. The request lists each record and where to publish it.
An API for your own scripts
List domains, add domains to a group, and read the records a domain needs, at
/api/v1/domains. The API refuses the same domains the import form would.
02 Groups
Keep each client's domains, people and email separate
Put each client's domains in a group. Your dashboard lists every group with the least protected first, and each group's page shows only that client's domains.
- Members who see one client. Invite a technician, or the client's own IT contact, as a member who sees one group's domains and nothing else. This comes with the Business plan and up.
- A weekly email for the client, if they want it. You turn it on for each group. The client's contact confirms from a link, then gets one weekly email covering their domains. You keep getting yours. On the Portfolio plan and up, the email shows your company name as the sender.
- History you can show an auditor. Every policy change keeps the record before and after, and we keep daily totals for each sender for the life of the account.
| Client | Policy | Failing |
|---|---|---|
| Harborview Dental Studioharborviewdentalstudio.comp=none | p=none | 1,284 |
| Kestrel Hall Legalkestrelhalllegal.comp=quarantine | p=quarantine | 212 |
| Quillmoor Logisticsquillmoorlogistics.comp=none | p=none | 96 |
| Alder Finch Accountingalderfinchaccounting.comp=reject | p=reject | 18 |
| Birchway Clinicbirchwayclinic.comp=reject | p=reject | 0 |
03 The client report
Send each client a report with your name on it
Each group has a share link to a report, with a "Prepared by" line that carries the name you set for your company. It lists their domains with the least protected first, with each domain's last 30 days of numbers and a finding with the action to take.
The page carries none of our navigation. When you rotate the link, the old one stops working at once. The client report comes with the Business plan and up.
What each domain on the report showsIllustration
- No recordReceivers have no instruction to refuse forged mail
- A record with an errorReceivers ignore it
- Monitoring
p=none: receivers take no action on failing mail - Quarantine
p=quarantine: failing mail goes to spam - Enforcing
p=reject: failing mail is refused
04 Enforcement
Move each client to p=reject without blocking their mail
Guided enforcement proposes each policy change when that domain's reports show it is safe, and you approve it before we publish it. With hosted DMARC, the client's DNS holds one CNAME and you change the policy from your dashboard. Hosted SPF works the same way for the senders in their SPF record.
If a step blocks a client's own mail, we put the previous policy back
- It needs hosted DMARC, on the Starter plan and up, because we can only put back a record we serve.
- We roll back only during the report watch after a step. The usual watch is 3 days. We set it from how fast each client domain's own reports arrived after earlier changes. We watch a step into reject for at least 3 days.
- We roll back when a sender you marked as the client's has at least 20 messages at one receiver, and 20 points more of them are quarantined or refused than before the step.
- Receivers send reports about once a day. We act on the report that shows the problem.
- We can't bring back mail a receiver already refused.
- After the watch ends, a new sender that fails gets you a same-day alert, and the policy stays where it is.
05 Beyond free reporting
Why pay when DMARC reporting can be free?
Free DMARC reporting collects your clients' reports and shows them to you. Moving each client from p=none to p=reject is still your work. With a paid plan, we take on these parts of it.
- Proposed policy steps We time each policy step from that client's own reports and email it to you to approve.
- Same-day alerts We email you the day a report shows a new sender failing on a client's domain. When one provider starts failing on 3 or more of your domains within 2 days, you get one email that lists them all.
- Automatic rollback With hosted DMARC, we put the previous policy back if a step starts blocking a client's mail.
- No message meter A client under a spoofing wave doesn't raise your bill, because we don't count messages.
06 Plans
Priced by the domains you watch
Groups, members limited to a group, the client report and every hosted record come with the Business plan and up. Every feature of the Portfolio plan is free for 30 days, no card.
Business
For a few clients
- 10 domains, then $5 each
- Groups, scoped members and the client report
- Hosted DMARC, SPF and MTA-STS
- Report detail kept 24 months
Portfolio
For a client book
- 25 domains, then $4 each
- Everything in the Business plan
- Your company name on client digests
- $3.16 a domain with all 25 in use
- Up to 50 parked domains free
- Report detail kept 24 months
Enterprise starts at 100 domains, from $399 a month. What a client book costs on the full plan table.
Work out what you keep reselling DMARC monitoring, from your client count and your price per domain.
Questions
What MSPs ask first
Can I try it with real client domains before paying?
Yes. Sign up from this page and you get 30 days of the Portfolio plan with no card, which covers 25 domains. When the trial ends, your account goes back to the free plan. Your oldest domain stays watched, the others pause, and we delete nothing.
A client already sends DMARC reports to another service. Can I add them anyway?
Yes. A DMARC record can list more than one reporting address, so you add ours beside the one that is there and both services receive the reports. The import preview shows which domains already report somewhere.
I don't control my clients' DNS. How do I get the records published?
Each client's group has a list of the records to publish, and a plain-text change request you can paste into a ticket for whoever holds their DNS. The request lists each record and where to publish it, and states that nothing in it changes how mail is sent or received.
Can our PSA turn your alerts into tickets?
Yes, if it opens tickets from email, as HaloPSA, Autotask and ConnectWise PSA do. Enter your PSA's ticket mailbox as the address for a domain's alerts and digests. If that domain is in a group, we put the group's name in brackets at the start of each alert's subject, so you see the client in the ticket title. You also get the weekly digest there, unless you turn it off for that domain.
Can a client, or one of my technicians, see only one client's domains?
Yes, on the Business plan and up. You can limit a member to one group, so they see that client's domains and nothing else.
Does the client get email from you?
Only if you switch it on for that client and their contact confirms from a link we send them. They then get one weekly email covering their domains, and you keep getting yours. On the Portfolio plan and up, the email shows your company name as the sender, followed by "via DomainCanary". They can decline or unsubscribe at any time.
Do domains that send no mail count?
Not if you park them. Up to 50 parked domains are free on the Portfolio plan, and 200 on Enterprise. We hold each one at p=reject and keep watching its reports for spoofing. If one starts sending real mail, we email you, and 14 days later it counts as one of your plan's domains.
What does it cost with more than 25 domains?
The Portfolio plan is $79 a month for 25 domains, then $4 a month for each extra domain. For 100 domains or more, write to contact@domaincanary.com for a quote, from $399 a month, with invoice billing and a named contact.
Start with the clients you worry about most
Create an account, paste their domains, and the preview shows where each one stands before you change anything. To look at one domain first, the SPF, DKIM and DMARC checker needs no account.
Questions before you start? Email me, and I'll answer you myself.
Josh Purvis, founder of DomainCanary
Software engineer with more than 20 years of experience
contact@domaincanary.com