Get to p=reject. Keep your mail.
Continuous monitoring shows you exactly who’s sending as your domain, so you can move from p=none to full enforcement, stop spoofed mail, and meet Google and Yahoo’s 2024 sender rules, without losing a single real message.
Run your own domain on the left. Every check opens real DNS resolvers and reads what your zone actually publishes, right now.
p=none stops nothing. That’s the entire problem.
DMARC is the DNS record that tells Gmail, Outlook and every other receiving server what to do with mail that fails to authenticate as coming from you: let it through unchecked, quarantine it, or reject it outright. Every domain starts at the first option by default. Getting to the last one safely is the whole job.
Watching, not enforcing
Aggregate reports start flowing in. Spoofed mail still lands in inboxes. Nothing is blocked yet, you’re building the picture of who actually sends as you.
Suspicious mail gets flagged
Unauthenticated mail claiming your domain lands in spam instead of the inbox. This is usually when a forgotten sender, an old CRM or a marketing tool, turns up in the reports.
Spoofed mail never arrives
The receiving server drops it before delivery. This is the policy Google and Yahoo’s 2024 bulk-sender rules were written to expect from any domain sending real volume.
Your reports never leave the EU, and neither does the company that holds them.
A DMARC aggregate report lists every server that sent mail as your domain, often enough to identify a specific employee’s connection or a specific vendor’s mail relay. That makes it personal data under GDPR the moment it’s collected, not an anonymous number.
None of our sub-processors are US companies, so there’s no US legal entity in the chain for a CLOUD Act request to reach.
Why “EU region” isn’t enough
Choosing “EU region” hosting from a US-headquartered company doesn’t remove US jurisdiction over that data. The US CLOUD Act lets US law enforcement compel a US company to produce data it controls, regardless of where the server physically sits, a European datacenter address on the invoice doesn’t change who can be legally compelled to hand it over.
| Sub-processor | Where |
|---|---|
| Scaleway (hosting, database, storage) | France |
| Scaleway Transactional Email | France |
| AhaSend (inbound report email) | Netherlands |
| Mollie (payments) | Netherlands |
| Bunny.net (DNS + CDN) | Slovenia |
Seven free tools that read your DNS the way receiving servers do
No account, no email gate. Use them one at a time, or run the full check above.
SPF Surveyor
Visualize the full SPF include tree and count DNS lookups against the limit of 10.
DKIM Inspector
Find published DKIM keys across common selectors and analyze key strength.
DKIM Validator
Paste a raw email and verify its DKIM signature cryptographically.
DMARC Inspector
Parse and grade your DMARC policy, reporting addresses and alignment settings.
DMARC Record Wizard
Answer a few questions and get a copy-ready DMARC record with DNS instructions.
BIMI Inspector
Validate your BIMI record and check the logo against the SVG Tiny PS profile.
XML-to-Human Converter
Paste or upload a DMARC aggregate report and read it as a table with named sources.
Free tells you now. Paid tells you the moment something changes.
A DNS record can change on a Tuesday and stay broken for three weeks before anyone notices the missing replies. This is what runs in the background so that doesn’t happen.
Named sending sources, not raw IPs
DMARC aggregate reports arrive as IP addresses and message counts. We match them against known providers, Google Workspace, Microsoft 365, Mailchimp, SendGrid and a curated list of Danish platforms (e-conomic, DanDomain, one.com), so a report reads as “Mailchimp, 4,200 messages, aligned” instead of a column of unlabeled numbers.
Alerts before your customers notice
Email alerts from Basic, and Slack, Teams and webhook alerts from Pro. A weakened policy or a new blacklist hit reaches the channel your team actually watches.
REST API and PDF export
Pull scores and findings into your own dashboard, or hand a client a branded PDF. Included from Pro, € 45 per month, excl. VAT.
White-label agency workspaces
Client-branded workspaces with certificate-transparency-log domain discovery, so you find every subdomain a client owns before they mention it. Agency plan, € 90 per month, excl. VAT.
TLS-RPT and MTA-STS, not just DMARC
We also ingest TLS reporting so you can see when mail to your domain fails to negotiate encrypted transport, a failure mode DMARC alone never surfaces, and validate your MTA-STS policy mode.
Pricing
Billed monthly through Mollie. Pro free for 30 days. Prices excl. VAT.
Need certificates watched too? Bundles with SSL Monitor start at € 29.
See bundles on monitorbase.euQuestions worth answering plainly
What’s the difference between the free check and paid monitoring?
The free check reads your DNS once and grades what it finds, a snapshot. Paid monitoring re-checks daily, ingests the DMARC aggregate reports mailbox providers send back so you can see who is actually sending as your domain over time, and emails you the moment a record changes, a policy weakens, or an IP lands on a blacklist.
Why does monitoring cost money if the check itself is free?
A single DNS lookup costs us almost nothing to repeat for anyone. Storing months of report history, matching sending sources, and re-checking every monitored domain daily is the part with a real server bill attached, so that’s what the paid plans fund.
Is DMARC report data covered by GDPR, and where does it live?
Yes. Aggregate reports contain sending-source IP addresses, which are personal data under GDPR the moment they can be linked, even indirectly, to a person. We process and store that data entirely within the EU on self-hosted Supabase running on Scaleway infrastructure in Paris. No sub-processor in the chain is a US-headquartered company.
Can I monitor client domains as an agency or MSP?
Yes. The Agency plan adds branded client workspaces, white-label PDF reports, and certificate-transparency-log domain discovery to surface every domain and subdomain a client actually owns, for €90 per month excl. VAT (€112.50 incl. VAT for private customers).
Can I monitor more than email under one account?
Yes. The All-Monitors plan bundles every launched MonitorBase product, currently DMARC Monitor, SSL Monitor and Uptime Monitor, into one subscription, with more products added as they launch at no extra step for existing subscribers.
Why email deliverability breaks — and how to catch it early
Every email your business sends is judged before anyone reads it. Receiving servers at Google, Microsoft and every Danish hosting provider check three DNS-based standards — SPF, DKIM and DMARC — to decide whether your message lands in the inbox, the spam folder, or nowhere at all. Since 2024, Google and Yahoo outright require correct authentication from bulk senders, and Microsoft has followed. A single typo in a DNS record can silently cut your delivery rate for weeks before anyone notices the missing replies.
MonitorBase checks your domain the same way receivers do. We resolve your SPF record tree include by include and count every DNS lookup against the protocol's hard limit of ten. We scan the DKIM selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and other common providers, and flag weak or revoked signing keys. We parse your DMARC policy and grade how well it actually protects you against spoofing — a p=none policy collects reports but stops nothing. On top of that we query four major blacklists, verify your MX setup, and check the newer standards: BIMI for brand logos in the inbox, and TLS-RPT/MTA-STS for transport encryption.
The result is a single 0–100 health score with a prioritized list of findings, each with a plain-language explanation and the exact DNS record to change. Fixing the top finding is usually a five-minute job in your DNS panel — knowing about it is the hard part. That is why the paid plans re-check your domains every day and email you the moment a record changes, a policy weakens, or an IP lands on a blacklist. The check is free, takes about five seconds, and requires no signup.