Fix
See tonight's p=reject
before you flip it.
The scary moment in DMARC is the policy change. We replay your last 30 days of real reports under the stricter policy first, so you flip knowing what happens, and we watch the two weeks after.
If the last 30 days had arrived under p=reject:
Safe to flip. After the change, we watch receiver reports for 14 days.
Preview p=rejectWhat the preview tells you
Three numbers, all from your own receivers' reports, before a single record changes.
What would have been stopped
Every message that failed alignment in the last 30 days, replayed under p=quarantine and p=reject. That is the spoofing the new policy would have blocked.
Who would have been hurt
Legitimate senders you have identified whose mail would have been quarantined or rejected. If this is not zero, the preview names them so you fix them first.
What it cannot promise
Forwarded mail and mailing lists sit in a gray zone receivers handle case by case. The preview counts them separately and never folds them into a clean verdict.
Flip with a net
When the replay says safe, the same button that shows the preview stages the change through the DNS-fix safety net: a five-minute hold, the exact record emailed to you, and a 24-hour undo.
Then a 14-day watch begins. Your receivers' own reports are checked against the pre-flip baseline, and if known senders start being refused at volume you get an alert carrying a one-click rollback. The rollback is offered, never automatic: nothing changes your DNS without a click.
Three steps, no guesswork
Read the replay
Open the DMARC tab on any domain. The preview runs on the reports you already have; there is nothing to configure.
Flip when it says safe
One click stages p=quarantine or p=reject on Cloudflare or Route 53. Other providers get the exact record and a deep link to paste it.
Let the watch run
Fourteen days of post-flip checks against real receiver data, with an all-clear in your digest or a rollback if something regresses.
The preview reads your aggregate reports, which receivers send daily. A domain with no reports yet shows an honest empty state, not a made-up verdict.
Preview it on your domain.
Free, today.
Add a domain, let a day of reports arrive, and the preview is waiting on the DMARC tab.