Sender Identity

Free static audit

Prove the name on the message.

A receiver uses DNS to check whether someone is allowed to send a message that claims to come from your domain. This audit reads that DNS and tells you what is missing, what is dangerous, and whether it is safe to start rejecting forgeries.

A free DNS audit of who may send as this domain.

Mailbox for a new DMARC record

Optional. Used only when a new record is suggested. Its organizational domain must match the domain you audit. An existing record is copied unchanged, and this audit does not open a report mailbox.

DKIM selectors

Focused checks

Check one protocol at a time.

Start with the signal you need to fix. Each checker uses the same DNS engine but explains only the relevant record, failure modes, and next step.

DMARC checkerPolicy, reports, alignment, and reject readiness. SPF checkerRecord syntax, qualifiers, and the ten-lookup limit. DKIM checkerSelectors, published keys, and weak or revoked keys. BIMI checkerLogo record, DMARC prerequisite, selector, and VMC caveats.

Pricing

Free audit. Managed DMARC from $15/month.

Annual billing for a small team or an agency. Cancel the next renewal in billing. The first yearly payment has a 30-day refund window.

Compare full plans and billing · How hosted DMARC works · DMARC for agencies

Free static audit One domain per audit, no account required. Run static audit

Agency

25 domains

$75/month

$900 billed yearly · 25 domains

$3 per domain per month

Start 25-domain plan
  • Everything in Managed DMARC, for up to 25 domains.
  • One account for agencies, groups, and multi-brand teams.
  • The same hosted records, notices, weekly digest, and probe mailbox.
  • Add or remove domains from the account within the 25-domain cap.
Limits
  • The same p=reject review applies to every domain. A person's approval cannot override a blocker.
  • A twenty-sixth domain is refused on this plan.
  • Each domain keeps its latest saved inventory, with the 200 largest senders listed.
  • No certificate is issued.

30-day refund Ask for a full refund of the first yearly payment within 30 days. A refund ends that period and stops renewal.

No per-message metering Reports are not charged by message volume. The latest saved sender inventory is kept per domain.

How hosted setup works
  1. Create an account and choose the 2-domain or 25-domain plan.
  2. Complete the yearly payment on Stripe. Card details stay on the payment page.
  3. Open a report mailbox for each domain in the account.
  4. Remove the TXT at _dmarc, then publish only the CNAME shown on the domain card. On Cloudflare, keep it DNS only.

We publish the DMARC, MTA-STS and TLS-RPT records. p=reject still needs a saved report and a person's approval.

Card details are entered on the payment page and kept there for the yearly renewal. Opening that page, or creating an account, does not start the subscription. Subscribing confirms the terms of use and the privacy policy.

What a saved sender list looks like

This table is an example, not an audit of a real domain. include, a, and mx are not expanded, so an unnamed address is not proof that the sender is unauthorized.

IPFromMessagesNamed byDMARC failuresChange
203.0.113.10news.brand.example4none4new
203.0.113.20brand.example12dkim0seen

What a static audit can see

Read these in order. The later items do not prove who sent the mail.

SPF

Who is allowed to use the envelope. +all accepts the whole internet. More than ten DNS lookups makes the record a permanent error.

DKIM

Which published selectors carry a production key. The probe list is finite, so you can add a selector the audit would otherwise miss.

DMARC

What receivers should do when both SPF and DKIM fail to align. p=none watches. Reject actually stops the forgery. The result offers one record to copy, or explains why it will not.

Logo and TLS

BIMI, MTA-STS, and TLS-RPT cover the logo, TLS policy, and TLS reports. They matter after the identity itself is enforced, and they are scored as maturity rather than as proof.

Account

Create an account with this address. Email a login link to open an existing account. Creating an account does not start the subscription.

Address for change notices. Login links go to this address too. Publishing p=reject on a domain card changes the hosted TXT. Reviewing a report does not.

The link works for 15 minutes and only once.

Questions about an account or a charge: support@senderidentity.com

Advanced

Each check below uses only the fields in its own form. These checks are for a report or a logo you already have. An opened mailbox is reviewed from the account card, using the saved report. Pasting a report here does not publish a hosted record.

Read and review a pasted report
DKIM selectors for this report

Optional. Approving p=reject needs a reviewer name. The review still blocks approval when the report or the static audit does not allow it. Checking this box does not publish a hosted record.