SPF
Who is allowed to use the envelope. +all accepts the whole internet. More than ten DNS lookups makes the record a permanent error.
Free static audit
Prove the name on the message.
A receiver decides from DNS whether mail that claims your domain is allowed to. This audit reads that DNS and tells you what is missing, what is dangerous, and whether it is safe to start rejecting forgeries.
What a static audit can see
Read these in order. The later items do not prove who sent the mail.
DKIM
Which published selectors carry a production key. The probe list is finite, so you can add a selector the audit would otherwise miss.
DMARC
What receivers should do when both SPF and DKIM fail to align. p=none watches. Reject actually stops the forgery. The result offers one record to copy, or explains why it will not.
Logo and TLS
BIMI, MTA-STS, and TLS-RPT cover the logo, TLS policy, and TLS reports. They matter after the identity itself is enforced, and they are scored as maturity rather than as proof.
The audit is free. Hosted DMARC is billed annually.
Static audit
Free
No account
Run static audit- One domain, on demand, no account
- Published SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT
- Score, findings, and a reject readiness check
Hosted DMARC
$180
per year, for 2 domains
$15 per month for 2 domains, billed annually
Create an account- A report mailbox and a saved sender list for 2 domains.
- Remove the TXT at _dmarc, then publish only a CNAME. If this name is on Cloudflare, set the CNAME to DNS only and leave the proxy off. We publish the DMARC TXT.
- Reports go to an address at reports.senderidentity.com, not on the website host
- Renewed automatically. Cancel in billing to stop the next charge.
Limits
- p=reject stays blocked until the static audit and the saved report agree, and the paying account approves it. A person's approval cannot override that block.
- A third domain is refused on this plan. Add or remove a domain from the account.
- Include, a, and mx are not expanded, so unnamed does not mean unauthorized.
- No certificate is issued.
Card details are entered on the payment page and kept there for the yearly renewal. Opening that page, or creating an account, does not start the subscription.
What a saved sender list looks like
This table is an example, not an audit of a real domain. include, a, and mx are not expanded, so an unnamed address is not proof that the sender is unauthorized.
| IP | From | Messages | Named by | DMARC failures | Change |
|---|---|---|---|---|---|
| 203.0.113.10 | news.brand.example | 4 | none | 4 | new |
| 203.0.113.20 | brand.example | 12 | dkim | 0 | seen |
Account
Create an account with this address. Email a login link to open an existing account. Creating an account does not start the subscription.
Returning from payment does not start the subscription. It starts when the payment notice arrives.
- Create an account
- Subscribe for the year
- Open a report mailbox
- Publish one CNAME and remove the TXT at _dmarc
Change the notice address
Questions about an account or a charge: support@senderidentity.com
Advanced
Each check below uses only the fields in its own form. These checks are for a report or a logo you already have. An opened mailbox is reviewed from the account card, using the saved report. Pasting a report here does not publish a hosted record.