Product tour
DMARC monitoring,
front to back.
The dashboard, the digest, the one-click fixes, and the integrations. Real screens rebuilt in miniature, honest about what each one does.
Every domain, one screen.
The fleet view shows each domain's policy, alignment, and DNS provider at a glance, with a compliance scorecard against the Google, Yahoo, and Microsoft sender mandates, cross-checked against Gmail's own data where it disagrees with your DNS. Every sending IP is matched against a corpus of more than 140 vendors, so you see SendGrid and Mailchimp, not raw ASNs.
Under each domain sit as many as eleven tabs of detail across DMARC, SPF, DKIM, MTA-STS, deliverability, and BIMI: per-sender alignment, subdomain traffic, and a change history for the day you need to dig in.
| Domain | Policy | Aligned | |
|---|---|---|---|
| acme.com | p=reject | 99% | Cloudflare· one-click |
| acme-mail.co | p=quarantine | 97% | Route 53· one-click |
| acme.io | p=none | 84% | Namecheap· guided |
Sixty seconds a morning, not another console.
Each morning a plain-English summary lands in your inbox: what was blocked, what changed, and the one thing worth your attention, with a fix attached when there is one.
DMARC reports from Gmail, Microsoft, and Yahoo arrive on a daily cycle. The digest reads them so you do not have to. When nothing needs you, it says so and gets out of the way.
Confirm it is yours and we will watch its alignment.
DNS changes with a safety net.
When a fix is one click, we stage the exact record and hold it for five minutes before writing it to your DNS. Today that works on Cloudflare and AWS Route 53. You get an email record of every change and a 24-hour undo after it applies.
On other providers you get the computed record plus a step-by-step guided fix with a deep link into your DNS console. Never a blind write.
v=DMARC1; p=quarantine; rua=mailto:acme-7f3k@rua.trustyourinbox.com
Held for 5 minutes. Cancel with one click before anything goes live.
Applied and emailed. The exact record written, on the record, in your inbox.
Undo for 24 hours. One click rolls the change back, verified by a DNS read-back.
See tonight's p=reject before you flip it.
The scary moment in DMARC is the policy flip. So before you make it, we replay your last 30 days of real reports under the stricter policy: how much spoofed mail would have been stopped, which legitimate senders would have been at risk, and what sits in the forwarding gray zone.
Flip when the replay says safe, and we keep watching. For 14 days your receivers' own reports are checked against the pre-flip baseline, and if real mail starts getting refused you get an alert with a one-click rollback. Confidence is not a paid feature; the preview is on every tier.
If the last 30 days had arrived under p=reject:
Safe to flip. After the change, we watch receiver reports for 14 days.
Preview p=rejectFind out what sends as you.
The Subdomains tab reads your real traffic and groups every subdomain seen sending as your domain: the ones you know, the ones worth a look, and the ones that do not exist in your DNS at all.
A sender that is not in DNS might be a forgery or a forgotten tool, so we show you the evidence instead of guessing, and tell you when a policy change would actually cover it.
- Knownmail.acme.com12,408 msgs · Google Workspace
- Worth a looknews.acme.com1,872 msgs · unidentified sender
- Not in DNSinvoice.acme.com64 msgs · no records published
Name your own mail servers.
Run your own mail servers, or a client's? Register their IP ranges once and they stop showing up as possible spoofers. Alignment, sender buckets, and the threat view all read them as yours.
Give each one a name and an icon so your reports read in plain English, not raw IP blocks. It is an accuracy feature, so it is on every plan, free included.
- Your serverAcme MTA (primary)198.51.100.0/24
- Your serverAcme MTA (backup)203.0.113.0/24
- Your serverWarehouse relay192.0.2.0/25
See what Gmail sees.
Connect Gmail Postmaster and your domain's spam-complaint rate, reputation, and authentication pass rates land next to your DNS, graded against Google's own 0.10% and 0.30% thresholds.
When Gmail's data disagrees with what your DNS implies, we say so, and flag the compliance card as at-risk instead of leaving you a false green.
0.04% of Gmail's 0.10% limit
Forward us the bounce. We'll tell you why.
Every workspace gets a private diagnose address. Forward a bounce, or a message that landed in spam, and we name the cause in plain English: decoded bounce codes, the header chain, your own DMARC reports, Gmail's deliverability data, and blocklist checks, assembled into one verdict with what was ruled out.
When the cause is a DNS gap, the fix is attached as the same one-click staged change as everywhere else. We read the headers and keep the verdict; message bodies are never stored. Included from Lite up.
Microsoft rejected this because acme.com's SPF record does not include Postmark.
- Bounce code 550 5.7.515
- Header chain
- Your DMARC reports
- Blocklists: clear
One-click fix ready. Add the missing include, with the 24-hour undo.
Fix the recordApprove fixes from the channel.
Connect Slack and the alerts that matter land where your team already is. When an issue is one-click-fixable, the message carries a Fix this button.
Only a linked teammate with edit access can approve it, and the change goes through the same five-minute hold, cancel, and 24-hour undo as a fix from the app. Every approval is written to your history with the Slack handle that made it.
acme.com is not protecting your domain
No DMARC policy is published, so anyone can send mail as your domain. Publishing a record starts the clock on reports and protection.
Ask your DMARC data anything.
Connect Claude, Cursor, or any MCP client to your workspace and ask in plain English. The server answers from the same workspace queries the dashboard uses, so the numbers always match.
Tokens are read-only by default. Write actions are opt-in, re-check your live permissions on every call, and stage DNS changes through the same safety net as everything else.
Is acme.com being spoofed? Was I protected last week?
Yes, and receivers report they blocked all of it. Here's last week for acme.com:
| Spoofed messages blocked | 1,240 |
| Delivered anyway | 0 |
| Top source | Russia |
You're fully protected, receivers rejected every spoofed message before delivery.
Wire it into your own tooling.
A versioned REST API with 30 endpoints, 18 read and 12 write, covers your domains, issues, spoof activity, reports, senders, delivery diagnosis, enforcement simulation, and staged DNS changes. Keys are scoped read or write, revoke instantly, and writes support idempotency keys.
And the push complement: register an outbound webhook and we send a signed POST to your systems the moment a critical issue is detected or a DNS fix lands, so your SIEM, ticketing, or automation reacts on its own.
Every endpoint answers through the same workspace queries as the dashboard and the MCP server, one set of numbers everywhere. The API and webhooks are available on Pro and up.
$ curl https://api.trustyourinbox.com/v1/domains \
-H "Authorization: Bearer tyi_api_..."
{ "data": [ { "domain": "acme.com",
"policy": "reject",
"openIssues": 0 } ] }Don't take our word for it.
Everything we claim is checkable in the open: our DNS, our prices, our uptime, our shipping pace, and the product itself.
Audit our domain.
trustyourinbox.com publishes p=reject with MTA-STS and BIMI. Paste it into the free checker and read the verdict yourself.
Read every price.
No quote gates, no contact-sales tiers hiding the number. The whole price list is public, including what the free tier includes.
Watch our uptime.
status.trustyourinbox.com is served from independent infrastructure, so it stays up and honest even when something else is not.
Watch us ship.
The changelog is public and dated. See what shipped this month and judge the pace yourself.
The real dashboard on realistic data. No account required.
Start with one domain.
See it with your own data.
Free for one domain, no credit card. Add one DNS record and the first reports arrive within a day.