See tonight's p=reject
before you flip it.
The scary moment in DMARC is the policy change. We replay your last 30 days of real reports under the stricter policy first, so you can review identified senders, unidentified sources and forwarding before you change anything. We watch the two weeks after the change.
Messages a stricter policy would ask receivers to act on, last 30 days. Next step: p=quarantine.
Example message counts. A policy is a request; receivers decide the outcome.
Check the unidentified sources. Reports cannot tell a forgotten tool from a forgery.
What the preview tells you
The next step and the messages it would ask receivers to act on, replayed from their own reports.
Unidentified sources
Messages from sources we cannot match to a sender that would face a new request to quarantine or reject. Reports cannot tell a forgotten tool from a forgery; review these sources before tightening the policy.
Identified senders
Identified senders failing alignment whose mail would face the stricter request. If this count is not zero, the preview names the senders so you can fix their SPF or DKIM setup first.
What it cannot promise
Forwarded mail and mailing lists are counted separately. A policy is a request, and receivers decide the outcome. An earlier override does not establish future delivery.
Flip with a net
When you are ready, the Start here card stages the change through the DNS-fix safety net: a five-minute hold, the exact record emailed to you, and a 24-hour undo.
Then a 14-day watch begins. Your receivers' own reports are checked against the pre-flip baseline, and if known senders start being refused at volume you get an alert carrying a one-click rollback. The rollback is offered, never automatic: nothing changes your DNS without a click.
Three steps, no guesswork
Read the replay
Open the DMARC page on a domain and choose See the full preview. It replays the reports you already have; there is nothing to configure.
Review, then change
One click stages p=quarantine or p=reject on Cloudflare or Route 53. Other providers get the exact record and a deep link to paste it.
Let the watch run
Fourteen days of post-flip checks against real receiver data, with an all-clear when there is enough evidence, or an offered rollback if something regresses.
The preview reads your aggregate reports, which receivers send daily. A domain with no reports yet shows an honest empty state, not a made-up verdict.
Preview it on your domain.
Free, today.
Add a domain, let a day of reports arrive, and the preview is waiting on the DMARC tab.