# DMARCguard

> Email authentication platform monitoring DMARC, SPF, DKIM, BIMI, MTA-STS, TLS-RPT, ARC, DANE, and ARF from one dashboard. SaaS at dmarcguard.io.

## About

DMARCguard is an email authentication monitoring and compliance platform. It processes DMARC aggregate reports, validates DNS records for 9 email security protocols, and provides actionable remediation guidance — all from a single dashboard.

The platform is available as a managed cloud SaaS at [dmarcguard.io](https://dmarcguard.io). Rated 4.9/5 on [G2](https://www.g2.com/products/dmarcguard) (11 reviews).

The DMARC report parser ([https://github.com/dmarcguardhq/parse-dmarc](https://github.com/dmarcguardhq/parse-dmarc)) is open-source. The full platform — including the dashboard, alerting, compliance scoring, MCP integration, and multi-org support — is proprietary.

### What DMARCguard Does

- Parses and visualizes DMARC aggregate reports (RFC 9990)
- Validates DNS records for SPF, DKIM, BIMI, MTA-STS, TLS-RPT, ARC, and DANE
- Identifies sending sources automatically (170+ services via CIDR and rDNS matching)
- Calculates per-domain compliance health scores
- Generates step-by-step remediation guidance personalized to each domain's DNS state
- Sends email and webhook alerts on policy failures with configurable thresholds
- Exposes 17 MCP tools for AI assistant integration (Claude, ChatGPT, Cursor, etc.)

## Protocols

DMARCguard monitors 9 core email authentication protocols and 8 supporting systems.

### Core Protocols

| Protocol | RFC | Purpose |
|----------|-----|---------|
| DMARC | RFC 9989 | Domain-based Message Authentication, Reporting & Conformance |
| SPF | RFC 7208 | Sender Policy Framework — authorized sending IP validation |
| DKIM | RFC 6376 | DomainKeys Identified Mail — cryptographic message signing |
| ARC | RFC 8617 | Authenticated Received Chain — authentication across forwarding |
| TLS-RPT | RFC 8460 | TLS Reporting — SMTP TLS failure diagnostics |
| BIMI | Draft | Brand Indicators for Message Identification — logo in inbox |
| MTA-STS | RFC 8461 | Mail Transfer Agent Strict Transport Security — TLS enforcement |
| DANE/TLSA | RFC 7671 | DNS-Based Authentication of Named Entities — certificate pinning |
| ARF | RFC 5965 | Abuse Reporting Format — forensic failure reports |

### Supporting Systems

- **DNSBL** — DNS-based blocklist monitoring for sending IP reputation
- **Certificate Transparency** — CT log monitoring for domain certificates
- **Email Format Validation** — RFC 5322 compliance checking
- **IP Reputation** — Sender reputation scoring for every sending IP
- **Sender Identification** — Automatic detection of 170+ email services
- **Anomaly Detection** — Statistical baseline monitoring for traffic patterns
- **Deliverability Scoring** — Multi-factor email deliverability assessment
- **Remediation Engine** — Step-by-step fix guidance for 22+ email services

## Features

### Dashboard & Reporting
- Aggregate DMARC report visualization with source breakdown
- Per-domain compliance health score (0-100)
- Trend analysis across time periods
- Geographic IP mapping
- CSV and JSON data export

### DNS Validation
- Real-time DNS record checking for all 9 protocols
- Syntax validation against RFC specifications
- Personalized fix recommendations based on current DNS state
- One-click navigation to exact DNS configuration pages

### Alerting
- Email alerts for DMARC policy failures
- Webhook integration for external systems
- Configurable thresholds and cooldown periods
- Per-organization alert settings

### AI Integration
- 17 MCP (Model Context Protocol) tools for AI assistants
- Query compliance scores, DNS records, and trend data conversationally
- Compatible with Claude, ChatGPT, Cursor, and any MCP-compatible client
- Both stdio and HTTP/SSE transport modes

### Multi-Organization
- Per-organization settings, outbound mail configuration and report mailbox connections
- Encryption at rest for stored credentials
- Ownership transfer between organization members
- Role-based access (owner, admin, viewer)

## Pricing

Per-domain pricing. No per-email-volume caps.

| Feature | Free | Pro | Enterprise |
|---------|------|-----|------------|
| Price | Free | $29/mo including 2 domains ($290/yr annual), then $15/domain | Custom |
| Founding rate | – | $14.50/mo including 2 domains ($145/yr annual), then $7.50/domain (3–10) and $5/domain (11+) | – |
| Additional domains | 2 domains max | 3–10: $15/domain ($7.50 founding) · 11+: $10 ($5 founding) | Unlimited |
| Users | 1 | 10 | Unlimited |
| Data retention | 30 days | 1 year | Unlimited (you control retention) |
| Protocols | 7 | All 9 | All 9 |
| AI queries | 5/day | Unlimited | Unlimited + MCP API |

### Founding Member Pricing

First 25 customers lock in founding rates for 2 years. After that, they keep a permanent 15% alumni discount — forever.

- Entry: $14.50/mo or $145/yr, including 2 domains (2 months free)
- Domains 3–10: $7.50/domain/mo or $75/domain/yr
- Domains 11+: $5/domain/mo or $50/domain/yr
- Price lock: 24 months from signup
- Alumni rate: 15% off standard pricing, permanent, after the lock
- Stated at signup — no surprises, no renegotiation

### Add-Ons (Pro plan)

- **Hosted DNS** ($12/domain/mo): Hosted DMARC, SPF, and DKIM records, Dynamic SPF flattening, Hosted MTA-STS, BIMI, and TLS-RPT, Cloudflare DNS integration with drift detection

All plans include: DMARC aggregate reporting, compliance health scoring, email alerts, email digests, CSV/JSON export, manual report upload, 2FA, and the free tool suite.

- [Pricing page](https://dmarcguard.io/pricing/)
- [Sign up free](https://app.dmarcguard.io/register)

## Free Tools

50 free email authentication tools. No signup required.

### Email Authentication (14 tools)

- [DMARC Record Checker](https://dmarcguard.io/tools/dmarc-checker/): Validate your DMARC policy and get actionable recommendations. All checks run in your browser -- nothing is sent to our servers.
- [DMARC Record Generator](https://dmarcguard.io/tools/dmarc-generator/): Build a valid DMARC TXT record with the right policy, reporting, and alignment settings. All generation runs in your browser — nothing is sent to our servers.
- [DMARC Report Analyzer](https://dmarcguard.io/tools/dmarc-report-analyzer/): Free DMARC report analyzer — upload aggregate XML to visualize authentication results, identify your senders, and spot failures. Runs in your browser; no data leaves your device.
- [DMARC Failure Diagnoser](https://dmarcguard.io/tools/dmarc-failure-diagnoser/): Seeing DMARC failures in your reports or bounce messages? Enter your domain and get the most likely causes ranked by impact — with the exact fix for each one. Covers missing record, p=none silent failure, SPF misalignment, DKIM gaps, and forwarding-induced breaks.
- [SPF Record Checker](https://dmarcguard.io/tools/spf-checker/): Free SPF checker. Validate your SPF record against RFC 7208, parse every mechanism, count its DNS lookups, and catch PermError before receivers do. No signup.
- [SPF Record Generator](https://dmarcguard.io/tools/spf-generator/): Build a valid SPF TXT record with provider presets, mechanism management, and live DNS lookup counting against the RFC 7208 limit.
- [SPF Flattener](https://dmarcguard.io/tools/spf-flattener/): Recursively resolve SPF include chains, visualize the lookup tree, and generate a flattened record with all IPs — entirely in your browser.
- [SPF Record Syntax Inspector](https://dmarcguard.io/tools/spf-syntax-inspector/): Paste an SPF record (or fetch one from a domain) and get a token-by-token breakdown — every mechanism, every qualifier, every modifier, mapped to its RFC 7208 section with plain-English meaning and the common pitfalls for each.
- [SPF Macro Debugger](https://dmarcguard.io/tools/spf-macro-debugger/): Expand SPF macros — %{i}, %{s}, %{d}, %{l}, %{o}, %{h}, %{v}, %{p} — with your own evaluation context. See exactly what each macro expands to before publishing the record, and understand the per-IP and per-sender authorisation patterns most receivers never document.
- [DKIM Record Checker](https://dmarcguard.io/tools/dkim-checker/): Free DKIM checker — look up your DKIM record by selector, validate the public key against RFC 8301, and check the signing algorithm. Instant results, no signup.
- [DKIM Record Generator](https://dmarcguard.io/tools/dkim-generator/): Generate DKIM key pairs (RSA or Ed25519) and DNS TXT records entirely in your browser. Your private key never leaves your device.
- [DKIM CNAME Validator](https://dmarcguard.io/tools/dkim-cname-validator/): Most ESPs publish DKIM keys via CNAME so they can rotate keys server-side. This tool walks the CNAME chain (loop-safe), resolves the terminal TXT, and validates the DKIM key against RFC 8301 — flagging dangling aliases, weak keys, and missing terminals.
- [ARC Checker](https://dmarcguard.io/tools/arc-checker/): Check your domain's ARC readiness — DMARC enforcement, mail provider capabilities, and DKIM key availability at common ARC selectors.
- [ARC Chain Analyzer](https://dmarcguard.io/tools/arc-chain-analyzer/): Parse and visualize Authenticated Received Chain (ARC) headers per RFC 8617. Validate chain integrity, inspect each hop, and diagnose forwarding issues.

### Transport Security (8 tools)

- [TLS-RPT Record Checker](https://dmarcguard.io/tools/tls-rpt-checker/): Validate your TLS-RPT DNS record, check report destinations, and verify MTA-STS integration per RFC 8460.
- [TLS-RPT Record Generator](https://dmarcguard.io/tools/tls-rpt-generator/): Generate a valid TLS-RPT DNS record with mailto and HTTPS report destinations per RFC 8460.
- [TLS-RPT Report Analyzer](https://dmarcguard.io/tools/tls-report-analyzer/): Upload and analyze TLS-RPT JSON reports in your browser. Visualize TLS negotiation successes, failures, and policy compliance — no data leaves your device.
- [MTA-STS Policy Checker](https://dmarcguard.io/tools/mta-sts-checker/): Validate your MTA-STS DNS record, fetch the policy file, and verify MX record alignment per RFC 8461.
- [MTA-STS Policy Generator](https://dmarcguard.io/tools/mta-sts-generator/): Generate the DNS TXT record and policy file needed to deploy MTA-STS (RFC 8461). MX records are auto-populated from DNS.
- [DANE/TLSA Record Checker](https://dmarcguard.io/tools/dane-checker/): Look up TLSA records, verify DNSSEC status, and validate DANE configuration for your mail server per RFC 6698 and RFC 7672.
- [DANE/TLSA Record Generator](https://dmarcguard.io/tools/dane-generator/): Generate DANE TLSA records for your mail server. SHA-256/SHA-512 hashing with optional PEM parsing — all in your browser.
- [CSP Validator](https://dmarcguard.io/tools/csp-validator/): Paste a Content-Security-Policy header and get a security grade, the exact weaknesses ranked by severity, and a paste-ready fix for each — plus a strict-policy generator and formatter. Everything runs in your browser.

### Brand & Reporting (7 tools)

- [BIMI Record Checker](https://dmarcguard.io/tools/bimi-checker/): Verify your BIMI record, check SVG logo compliance, VMC authority, and DMARC enforcement prerequisites.
- [BIMI Record Generator](https://dmarcguard.io/tools/bimi-generator/): Generate a valid BIMI DNS record with SVG logo URL and optional VMC certificate. All configuration stays in your browser.
- [ARF / Forensic Report Checker](https://dmarcguard.io/tools/arf-checker/): Validate your DMARC forensic reporting — check ruf= destinations, external authorization, failure options, and provider compatibility.
- [ARF Report Analyzer](https://dmarcguard.io/tools/arf-report-analyzer/): Parse ARF feedback reports (RFC 5965). Upload or paste an ARF email to extract feedback type, source IP, domain, and auth results — in your browser.
- [APRF Record Checker](https://dmarcguard.io/tools/aprf-checker/): Check the APRF record mailbox providers find for your DKIM signing domain: which of the three record names answers, whether rua and sdi are valid, and whether every external report address is authorized.
- [APRF Record Generator](https://dmarcguard.io/tools/aprf-generator/): Build the APRF TXT record that asks mailbox providers for daily inbox placement reports: pick every selector or one, add report addresses and an optional SDI header, and get the authorization record any external address needs.
- [APRF Report Analyzer](https://dmarcguard.io/tools/aprf-report-analyzer/): Paste or upload an APRF performance report and read it: who sent it, which DKIM domain and selector it covers, and the inbox, unwanted and engagement counts for every segment, exactly as the mailbox provider reported them. Nothing leaves your browser.

### Compliance (11 tools)

- [NIS2 Email Authentication Readiness Scorecard](https://dmarcguard.io/tools/nis2-readiness/): EU equivalent: check the same posture against NIS2 Article 21.
- [BSI NIS2 E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/bsi-nis2/): Same scorecard, German auditor language, BSI-Grundschutz mapping.
- [NIS2 Supplier Email-Auth Questionnaire](https://dmarcguard.io/tools/nis2-supplier-questionnaire/): Paste or upload a supplier list and get a NIS2 §21(2)(d) supply-chain readiness report in seconds. Each supplier's DMARC, SPF, and MTA-STS posture is scored and the gaps named in auditor language. Downloadable as CSV evidence.
- [DORA ICT Email Control Mapper](https://dmarcguard.io/tools/dora-compliance/): Map your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture to DORA Articles 9, 10, and 11. Built for EU financial entities preparing for supervisor reviews under Regulation (EU) 2022/2554.
- [DORA E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/dora-de/): Für Finanzunternehmen: DORA Art. 9-11 statt NIS2-Allgemein.
- [PCI DSS 4.0.1 § 5.4.1 Anti-Phishing Checker](https://dmarcguard.io/tools/pci-anti-phishing/): Requirement 5.4.1 has been mandatory since March 31, 2025. Check your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture against the QSA-facing rubric for PCI's anti-phishing automated mechanism.
- [HIPAA Email Authentication Readiness](https://dmarcguard.io/tools/hipaa-email-readiness/): Check your domain against the HIPAA 164.312 Technical Safeguards: the email-authentication controls covered entities and business associates need before an OCR audit.
- [Microsoft 550 5.7.515 Bulk Sender Diagnostic](https://dmarcguard.io/tools/microsoft-550-diagnostic/): Outlook routes non-compliant bulk-sender mail to Junk since 5 May 2025, and 550 5.7.515 rejections are documented for DMARC failures. Diagnose your domain against Microsoft's high-volume sender requirements and get the exact DNS records to publish.
- [Gmail & Yahoo Bulk-Sender Readiness](https://dmarcguard.io/tools/gmail-yahoo-bulk-sender/): Same DNS posture, different inbox provider requirements.
- [NCSC Mail Check Migration Tool](https://dmarcguard.io/tools/ncsc-mail-check-migration/): UK equivalent against the retired NCSC Mail Check MCSS B3 baseline.
- [p=none Escape Plan — 4-Week DMARC Migration Wizard](https://dmarcguard.io/tools/pnone-escape-plan/): Stuck at p=none? Enter your domain to get a personalised four-week plan that walks you from monitoring to p=quarantine to p=reject — with the exact DNS record at every step and the criteria for advancing.

### General Lookups (10 tools)

- [Domain Email Health Check](https://dmarcguard.io/tools/domain-health-check/): Run a comprehensive email authentication audit across all protocols. Get a weighted security score and actionable recommendations -- entirely from your browser.
- [Email Header Analyzer](https://dmarcguard.io/tools/email-header-analyzer/): Free email header analyzer — paste raw headers to decode SPF, DKIM, and DMARC results, trace the delivery path, and check sender alignment, entirely in your browser.
- [DNS Record Lookup](https://dmarcguard.io/tools/dns-lookup/): Query any DNS record type for any domain — A, AAAA, MX, TXT, NS, CNAME, and more. Client-side queries via Cloudflare's edge network. No signup required.
- [MX Record Lookup](https://dmarcguard.io/tools/mx-lookup/): Free MX record lookup. Check any domain's mail servers, priority, and routing in your browser via Cloudflare DNS-over-HTTPS. No signup, instant results.
- [CNAME Record Lookup](https://dmarcguard.io/tools/cname-lookup/): Free CNAME record lookup tool. Verify canonical names, alias targets, and DNS configuration in your browser via Cloudflare DoH. No signup, no ads.
- [TXT Record Lookup](https://dmarcguard.io/tools/txt-lookup/): Free TXT record lookup tool. Verify SPF, DKIM, DMARC, domain ownership, and verification tokens in your browser via Cloudflare DoH. No signup.
- [Reverse DNS Lookup](https://dmarcguard.io/tools/reverse-dns-lookup/): Free reverse DNS / PTR lookup tool. Resolve any IPv4 or IPv6 address back to its hostname in your browser via Cloudflare DoH. No signup, no ads.
- [WHOIS Domain Lookup](https://dmarcguard.io/tools/whois-lookup/): Look up domain registration details via RDAP — registrar, dates, nameservers, and DNSSEC status. All queries run in your browser.
- [Blacklist Check](https://dmarcguard.io/tools/blacklist-check/): Check if an IP address or domain is listed on major DNS blacklists. All queries run in your browser via DNS over HTTPS.
- [Open Relay Tester](https://dmarcguard.io/tools/open-relay-tester/): A real open-relay test requires an SMTP probe — which browsers cannot perform. This tool runs the DNS-side posture check (MX, A/AAAA, PTR, FCrDNS, ISP-host heuristics) and renders the exact telnet sequence you run yourself to complete the SMTP-level verification.

## Comparisons

### [DMARCguard vs Valimail](https://dmarcguard.io/compare/valimail/)

Valimail publishes no price for any Enforce tier: Starter, Premium and Enterprise all read "Contact us for custom pricing", and the pricing page no longer lists Align. Valimail remains the enterprise DMARC leader; DMARCguard delivers broader protocol coverage including ARC and DANE at per-domain pricing, with full data portability and no DNS delegation lock-in.

| Feature | DMARCguard | Valimail |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | No |
| Sender Identification | Yes | Yes |

**Why switch:** ARC free, DANE from Pro · No CNAME or DNS delegation lock-in · A price before the sales call · AI-native with MCP

---

### [DMARCguard vs EasyDMARC](https://dmarcguard.io/compare/easydmarc/)

EasyDMARC pricing starts at $44.99/mo for the 2-domain Plus plan, and its pricing page no longer lists a free plan, only a free trial. DMARCguard offers simpler pricing and broader protocol coverage — 7 protocols free, all 9 from Pro.

| Feature | DMARCguard | EasyDMARC |
|---------|------------|-----------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | No |
| Sender Identification | Yes | Yes |

**Why switch:** Transparent pricing, full coverage · Full protocols, simple pricing · Per-domain pricing from day one · AI-ready with MCP

---

### [DMARCguard vs dmarcian](https://dmarcguard.io/compare/dmarcian/)

dmarcian pricing runs $24–$600/mo across volume-metered tiers with hard domain caps — and the Basic→Plus step is a 10x jump ($24→$240/mo). DMARCguard covers 9 protocols with transparent per-domain pricing that scales continuously.

| Feature | DMARCguard | dmarcian |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | No |
| MTA-STS Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | No |
| Sender Identification | Yes | Yes |

**Why switch:** Beyond DMARC · No 10x tier cliff · Full data portability · AI-native with MCP

---

### [DMARCguard vs PowerDMARC](https://dmarcguard.io/compare/powerdmarc/)

PowerDMARC pricing scales $8–$250/mo on the Basic plan by email volume, with Enterprise quote-only. DMARCguard matches its broad protocol coverage while adding ARC chain validation, single-pane multi-tenant management, and automatic sender identification.

| Feature | DMARCguard | PowerDMARC |
|---------|------------|------------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | No |
| Sender Identification | Yes | Yes |

**Why switch:** Full data portability · Zero-config sender detection · ARC chain analysis · Transparent refund and cancellation

---

### [DMARCguard vs MXToolbox](https://dmarcguard.io/compare/mxtoolbox/)

Looking for an MXToolbox alternative for continuous DMARC monitoring? MXToolbox built the internet's favorite free DNS toolbox, but Delivery Center costs $129/mo for 5 domains, caps DMARC history at 90 days, and its Plus tier is $399/mo. DMARCguard monitors 9 protocols with published per-domain pricing.

| Feature | DMARCguard | MXToolbox |
|---------|------------|-----------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Validation | Yes | No |
| TLS-RPT Support | Yes | No |
| ARC Chain Support | Yes | No |
| DANE/TLSA Support | Yes | No |

**Why switch:** Audit-ready history · Protocol coverage that keeps going · The 5-domain math · Pricing and cancellation you can see

---

### [DMARCguard vs Proofpoint](https://dmarcguard.io/compare/proofpoint/)

Proofpoint Email Fraud Defense pairs hosted DMARC with genuinely unmatched threat intelligence — at enterprise prices published nowhere in USD. The only verifiable list prices are UK G-Cloud figures: £22,901/yr for a single sending domain. DMARCguard covers 9 protocols at a published per-domain price.

| Feature | DMARCguard | Proofpoint |
|---------|------------|------------|
| DMARC Monitoring | Yes | Yes |
| Hosted DMARC Record | Yes | Yes |
| SPF Management | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Validation | Yes | No |
| TLS-RPT Support | Yes | No |
| ARC Chain Support | Yes | No |

**Why switch:** Compare the published prices · No bundle required · Data portability by default · The modern transport stack

---

### [DMARCguard vs Mimecast](https://dmarcguard.io/compare/mimecast/)

Mimecast DMARC Analyzer 2.0 (January 2026) is a real upgrade — hosted SPF/DMARC/DKIM delegation and TLS-RPT reporting. But the price appears nowhere on mimecast.com, tiers by your domain's web-traffic profile, and renewals carry a contractual uplift. DMARCguard publishes one per-domain price.

| Feature | DMARCguard | Mimecast |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| Hosted DMARC Record | Yes | Yes |
| SPF Flattening / Hosting | Yes | Yes |
| DKIM Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| Forensic (RUF) Reports | Yes | Yes |
| BIMI Support | Yes | No |
| MTA-STS Hosting | Yes | No |

**Why switch:** Priced per domain, not per Alexa rank · A locked price vs an uplift clause · Exit without data loss · DMARC-first, not an add-on

---

### [DMARCguard vs Barracuda](https://dmarcguard.io/compare/barracuda/)

Barracuda folds DMARC reporting into its Email Protection bundles — priced per mailbox with 25-seat reseller minimums, guided setup but no automated enforcement, and five protocols missing entirely. DMARCguard prices per domain and monitors all 9 protocols.

| Feature | DMARCguard | Barracuda |
|---------|------------|-----------|
| DMARC Monitoring | Yes | Yes |
| Guided Path to Enforcement | Yes | Yes |
| SPF Management | Yes | Guidance only |
| DKIM Management | Yes | Guidance only |
| BIMI Support | Yes | No |
| MTA-STS Validation | Yes | No |
| TLS-RPT Support | Yes | No |
| ARC Chain Support | Yes | No |

**Why switch:** Domain math, not mailbox math · From reporting to done · The full protocol stack · An honest fit note

---

### [DMARCguard vs Red Sift](https://dmarcguard.io/compare/redsift/)

Red Sift OnDMARC is a genuinely strong platform: Dynamic SPF, in-app VMC issuance, and support quality G2 reviewers consistently praise. But only one tier has a public price, aggregators still show conflicting older figures, and DANE sits outside the product. DMARCguard publishes one per-domain price and monitors the full stack.

| Feature | DMARCguard | Red Sift |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| SPF Flattening / Hosting | Yes | Yes |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Hosting | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| Forensic (RUF) Reports | Yes | Yes |
| ARC Chain Support | Yes | Partial |

**Why switch:** One published price for every tier · No one-year renewal floor · Data export without restrictions · When OnDMARC is the honest pick

---

### [DMARCguard vs Sendmarc](https://dmarcguard.io/compare/sendmarc/)

Searching for Sendmarc pricing turns up no published number: every paid tier is quote-only, the domain is the pricing unit, and no rate card exists anywhere. Sendmarc pairs hands-on onboarding with a mature MSP channel, and G2 reviewers reward that with a 4.9 average. DMARCguard puts the number first.

| Feature | DMARCguard | Sendmarc |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| Hosted DMARC Record | Yes | Yes |
| SPF Flattening / Hosting | Yes | Yes |
| Hosted DKIM | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Hosting | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| Forensic (RUF) Reports | Yes | Yes |

**Why switch:** A number before the sales call · Buy direct, not through a channel · Your data, exportable · When Sendmarc is the better fit

---

### [DMARCguard vs Suped](https://dmarcguard.io/compare/suped/)

Suped is the newest entrant in the DMARC space — launched mid-2025, transparently priced, and well-liked by its early reviewers. Its surface is DMARC, SPF, and DKIM monitoring plus hosted DMARC, SPF, and MTA-STS; BIMI, TLS-RPT, ARC, DANE, and ARF are absent. DMARCguard monitors all nine protocols.

| Feature | DMARCguard | Suped |
|---------|------------|-------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| DKIM Validation | Yes | Yes |
| MTA-STS Hosting | Yes | Yes |
| BIMI Support | Yes | No |
| TLS-RPT Support | Yes | No |
| ARC Chain Support | Yes | No |
| DANE/TLSA Support | Yes | No |

**Why switch:** Nine protocols, not four surfaces · Pay per domain, not per email · Data you can take with you · When Suped is the right call

---

### [DMARCguard vs Skysnag](https://dmarcguard.io/compare/skysnag/)

Skysnag pricing starts at $39/mo for Comply, and its autonomous enforcement is real - its reviewers confirm hands-off operation - but that automation starts at the $249/mo Protect tier. DMARCguard publishes per-domain pricing, with guided enforcement included in Pro.

| Feature | DMARCguard | Skysnag |
|---------|------------|---------|
| DMARC Monitoring | Yes | Yes |
| Automated Policy Enforcement | Guided (assessment + simulation) | Protect tier and above |
| SPF Flattening / Hosting | Yes | Yes |
| DKIM Management | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Hosting | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | No |

**Why switch:** An enforcement path without the $249 gate · One price per domain, no bands · A surface you can verify before buying · When Skysnag is the right call

---

### [DMARCguard vs URIports](https://dmarcguard.io/compare/uriports/)

URIports is the price-transparency leader in this category: five published terrain-named tiers from $1.25/mo plus a quote-only Enterprise plan, quotas counted in reports received, and processing that simply halts at quota instead of surprise-billing you. The trade-offs are a 90-day history ceiling, monitoring without hosted SPF or DMARC, and no SLA or certifications. DMARCguard picks up where monitoring stops.

| Feature | DMARCguard | URIports |
|---------|------------|----------|
| DMARC Monitoring | Yes | Yes |
| Hosted DMARC Record | Yes | No |
| SPF Flattening / Hosting | Yes | No |
| DKIM Validation | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Hosting | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| Forensic (RUF) Reports | Yes | Yes |

**Why switch:** A year of history vs a 90-day ceiling · Hosted SPF and DMARC · Answers for procurement · When URIports is the better fit

---

### [DMARCguard vs DMARCLY](https://dmarcguard.io/compare/dmarcly/)

DMARCLY publishes flat, genuinely low prices — $17.99/mo entry and a 200-domain Enterprise tier at a flat $199/mo. The trade-offs sit elsewhere: 2 months of history on the entry tier, no free plan, email-only alerting, and an API locked to the top tier. DMARCguard pairs a published per-domain price with 1 year of history on Pro.

| Feature | DMARCguard | DMARCLY |
|---------|------------|---------|
| DMARC Monitoring | Yes | Yes |
| SPF Monitoring | Yes | Yes |
| DKIM Monitoring | Yes | Yes |
| SPF Flattening (Hosted SPF) | Yes | From Growth ($39.99/mo) |
| BIMI Support | Yes | Record only |
| MTA-STS Support | Yes | Record only |
| TLS-RPT Support | Yes | Yes |
| ARC Chain Support | Yes | Partial |

**Why switch:** History that outlasts the rollout · Automatic sender classification · Alerts and API without the Enterprise gate · When DMARCLY is the better fit

---

### [DMARCguard vs DMARC Report](https://dmarcguard.io/compare/dmarcreport/)

DMARC Report pricing runs from a free Core tier to $3,900/mo Ultimate, and it is the most-reviewed DMARC product on G2 — 4.8/5 across 471 reviews — with a mature REST API and SOC 2 Type II. The evaluation questions are the 5/10/25 domain caps on paid tiers, and which protocol unlocks at which tier. Here is the full map.

| Feature | DMARCguard | DMARC Report |
|---------|------------|--------------|
| DMARC Monitoring | Yes | Yes |
| Free Tier | Yes | Yes |
| SPF Monitoring | Yes | Yes |
| SPF Flattening (Hosted SPF) | Yes | Separate product |
| DKIM Monitoring | Yes | Yes |
| BIMI Support | Yes | Yes |
| MTA-STS Hosting | Yes | From Shield ($75/mo) |
| TLS-RPT Support | Yes | From Shield ($75/mo) |

**Why switch:** One pricing model, no cap ladder · Exceeding a cap shouldn't cost your history · ARC, DANE, and SPF flattening in-platform · When DMARC Report is the better fit

---

### [DMARCguard vs Mailhardener](https://dmarcguard.io/compare/mailhardener/)

Mailhardener earns real respect: EUR-native flat pricing, DANE and hosted MTA-STS depth most vendors skip, and SSO with 2FA on every tier — Free included. What it leaves out, by design, is the layer after detection: guided remediation, blocklist monitoring, webhook alerting, and an entry-tier API. That layer is the comparison.

| Feature | DMARCguard | Mailhardener |
|---------|------------|--------------|
| DMARC Monitoring | Yes | Yes |
| SPF Monitoring | Yes | Yes |
| DKIM Monitoring | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| DANE/TLSA Support | Yes | Yes |
| MTA-STS Hosting | Yes | From Standard (EUR 19/mo) |
| BIMI Support | Yes | From Standard (EUR 19/mo) |
| ARC Chain Support | Yes | No |

**Why switch:** A platform that says what to do next · Blocklists watched alongside authentication · Slack, webhooks, and an API from day one · When Mailhardener is the better fit

---

### [DMARCguard vs Fraudmarc](https://dmarcguard.io/compare/fraudmarc/)

Fraudmarc pairs hosted DMARC report analysis with deep, dedicated SPF flattening - two productized lines, one SLA-backed - plus an Apache-2.0 Community Edition you can run in your own AWS. The trade-off is scope: DMARC and SPF are the whole product, where DMARCguard productizes nine protocols under one published per-domain price.

| Feature | DMARCguard | Fraudmarc |
|---------|------------|-----------|
| DMARC Monitoring | Yes | Yes |
| SPF Flattening / Hosting | Yes | Yes |
| DKIM Validation | Yes | Partial |
| Forensic (RUF/ARF) Reports | Yes | Yes |
| BIMI Support | Yes | No |
| MTA-STS Hosting | Yes | No |
| TLS-RPT Support | Yes | No |
| ARC Chain Support | Yes | No |

**Why switch:** The full stack, not two protocols · A per-domain rate built for portfolios · Hosted platform vs DIY ops · Where Fraudmarc genuinely wins

---

### [DMARCguard vs DMARC Advisor](https://dmarcguard.io/compare/dmarcadvisor/)

DMARC Advisor is a genuinely EU-operated platform: a Dutch entity since 2013, EU data hosting, and hands-on support in four languages. Two structural facts shape any 2026 evaluation: the legacy DMARC Advisor Platform retires on June 30, 2026 in favor of the company's new DMARC Manager platform, and a court-ordered geofence limits service to Europe and Africa. Here is the factual comparison.

| Feature | DMARCguard | DMARC Advisor |
|---------|------------|---------------|
| DMARC Monitoring | Yes | Yes |
| SPF Validation | Yes | Yes |
| SPF Flattening (Hosted SPF) | Yes | Yes |
| DKIM Validation | Yes | Yes |
| TLS-RPT Support | Yes | Yes |
| BIMI Support | Yes | Paid add-on |
| MTA-STS Hosting | Yes | Partial |
| ARC Chain Support | Yes | Not documented |

**Why switch:** Scale past 2 domains at a per-domain rate · Nine protocols, including hosted MTA-STS · Serve your whole footprint · When DMARC Advisor is the right choice

### Head-to-Head Comparisons

Third-party matchups compared on published pricing and features:

- [PowerDMARC vs Valimail: 2026 Pricing Compared](https://dmarcguard.io/compare/powerdmarc-vs-valimail/) — PowerDMARC publishes $8–$250/mo volume pricing; Valimail Enforce is quote-only, no public price. Features, free tiers and pricing compared.
- [EasyDMARC vs PowerDMARC: Which Fits in 2026?](https://dmarcguard.io/compare/easydmarc-vs-powerdmarc/) — EasyDMARC Plus starts at $44.99/mo with 2 domains; PowerDMARC Basic scales $8–$250/mo with 5. Features, free options and pricing compared.
- [dmarcian vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/dmarcian-vs-easydmarc/) — dmarcian Basic is $24/mo, metering legitimate mail only; EasyDMARC Plus is $44.99/mo with managed hosting. Features and pricing compared.
- [dmarcian vs Valimail: Published vs Quote-Only](https://dmarcguard.io/compare/dmarcian-vs-valimail/) — dmarcian publishes $24–$600/mo tiers; Valimail Enforce is quote-only with no public price. Automation, features and free tiers compared.
- [PowerDMARC vs dmarcian: 2026 Comparison](https://dmarcguard.io/compare/powerdmarc-vs-dmarcian/) — PowerDMARC hosts your records with plans from $8–$250/mo; dmarcian is reporting-first from $24/mo, metering legitimate mail only. Compared with sources.
- [Valimail vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/valimail-vs-easydmarc/) — EasyDMARC publishes $44.99–$89.99/mo plans; Valimail Enforce is quote-only with no public price. Automation, free tiers and features compared.
- [DMARC Report vs Valimail: The Affordable Alternative?](https://dmarcguard.io/compare/dmarcreport-vs-valimail/) — DMARC Report publishes plans from $25/mo; Valimail Enforce is quote-only with no public price. Pricing, free tiers and features compared.
- [DMARCLY vs dmarcian: 2026 Pricing Compared](https://dmarcguard.io/compare/dmarcly-vs-dmarcian/) — DMARCLY publishes flat tiers from $17.99/mo; dmarcian meters legitimate mail from $24/mo with a 10x Basic-to-Plus jump. Pricing and features compared.
- [MXToolbox vs dmarcian: DMARC Compared (2026)](https://dmarcguard.io/compare/mxtoolbox-vs-dmarcian/) — MXToolbox Delivery Center runs $129–$399/mo with a 90-day DMARC history cap; dmarcian publishes $24–$600/mo tiers. Features and pricing compared.

## Research

Original email authentication research conducted by the DMARCguard team.

### State of Email Authentication 2026

Comprehensive analysis of DMARC, SPF, DKIM, MTA-STS, BIMI adoption across 5,499,028 domains from the complete Tranco Top Sites ranking, scanned February 27, 2026.

**Key findings:**

- **30.4% DMARC adoption** across all 5,499,028 scanned Tranco domains; **12.8% enforce** (p=quarantine or p=reject)
- **56.0% SPF adoption** across all 5,499,028 scanned Tranco domains
- **4.0% of SPF lookups failed** (timeout or server failure) and counted as no SPF; leaving them out, SPF adoption is 58.3%. Every February share is therefore a lower bound.
- **at least 22.7% publish DKIM**: a floor, since the scan probed six common selectors and a domain signing under another selector counted as having none
- **0.3% MTA-STS adoption**: transport-layer security stays rare despite defending against email-in-transit downgrade attacks
- **0.4% BIMI adoption**: brand-logo authentication is still niche
- DANE/TLSA: the February figure is withdrawn — it was produced by querying TLSA as a TXT record; the Q3 census measures TLSA over DNS with DNSSEC validation.

Protocols covered: DMARC, SPF, DKIM, MTA-STS, BIMI

**Corrections:**

- 2026-09-11, Corrected: _The SPF lookup table listed SendGrid's include as 1 DNS lookup._ It costs 2: include:sendgrid.net nests include:ab.sendgrid.net. Both research pages now read the value from one source.
- 2026-10-21, Withdrawn: _A Top 10K table (DMARC 62.5%, SPF 67.4%, DKIM 38.9%, MTA-STS 1.8%, BIMI 7.5%) and the Top 10K Sample CSV._ That sample was resolved through an ad-blocking DNS filter, which answers blocked domains as if they did not exist. The scanner recorded that as a missing record, so ad and analytics domains that publish DMARC, such as doubleclick.net, counted as having none. Blocked lookups cannot be told apart from real absences in that file, so we removed the table and the file.
- 2026-10-21, Withdrawn: _30 of 5,499,028 domains publish DANE/TLSA records for email._ The scanner requested each TLSA name as a TXT record, so the figure does not measure DANE. Our next census queries TLSA records directly and validates DNSSEC.
- 2026-10-21, Withdrawn: _46.9% of domains (2,581,479) support STARTTLS on port 25._ A domain counted only if one of its mail servers completed a STARTTLS handshake with our scanner within that domain's 15-second budget. A blocked, slow or rate-limited connection counted as no STARTTLS, and the share was taken over every domain, including those with no mail server.
- 2026-10-21, Corrected: _DMARC policies: none 967,474, quarantine 374,041, reject 327,959. These summed to 1,669,474, leaving 1,501 DMARC records in no bucket._ Policy values are case-insensitive, so p=Reject is reject. Recounted: none 967,563, quarantine 374,156, reject 328,090, and 1,166 records whose p= value is not a policy (for example p=quarentine). 702,246 domains enforce: 12.8% of all domains and 42.0% of DMARC publishers, the same shares as before at one decimal.
- 2026-10-21, Corrected: _Both SPF and DKIM: 48.5% of DMARC domains (810,525)._ 48.6% (812,465). The list left out the 1,940 domains that also publish MTA-STS and BIMI; the table below it was right.
- 2026-10-21, Corrected: _MTA-STS modes: enforce 9,364 and testing 6,383, of 15,997 domains with a policy record._ The other 250 publish mode=none, which tells senders the domain has no active policy (RFC 8461 section 5).
- 2026-10-21, Removed: _No domains in our sample deployed DKIM-only configurations: DKIM is always paired with at least SPF._ The same page counts 25,109 DMARC domains with DKIM and no SPF.
- 2026-10-21, Clarified: _DKIM adoption: 22.7%. Actual DKIM adoption may be 5-10 percentage points higher._ 22.7% is a floor, not an adoption rate: we probed six common selectors, and a domain signing under any other selector counted as having no DKIM. The page now says "at least 22.7%". The 5 to 10 point estimate had no source and is removed.
- 2026-10-21, Clarified: _Adoption shares stated as measurements._ For 217,774 domains (4.0%) the SPF lookup timed out or the resolver reported a server failure, and the scanner recorded no SPF. Leaving those domains out, SPF adoption is 58.3% rather than 56.0%. DMARC and DKIM lookup failures were not recorded, so those shares are lower bounds as well, and the page now states what domains publish rather than what they lack.
- 2026-10-21, Corrected: _DMARC (RFC 9989) listed as the specification the scan applied._ The February 2026 scan parsed records per RFC 7489, the DMARC specification in force at the time. RFC 9989 replaced it in May 2026.
- 2026-10-21, Clarified: _DNS queries via system resolver._ Queries went to our hosting provider's shared recursive resolver with the host's default timeout and retry settings and a 15-second budget per domain. The Tranco list was the full list; its list ID was not recorded.
- 2026-10-21, Removed: _The largest email security study, with 5.5 million domains._ Other public scans cover more than 300 million domains.
- 2026-10-21, Removed: _A Full Dataset download: complete scan results for all 5,499,028 domains (CSV)._ The link had stopped working in April 2026, and the file carries Tranco rank values, which we do not republish per domain. Our next census publishes per-domain data with rank tiers instead. The aggregate statistics remain available.

- [Full study](https://dmarcguard.io/research/email-authentication/)

### SPF Supply Chain 2026: Email Sender Market Share

Microsoft 365 and Google Workspace appear in 33% of all SPF records: email sender market share measured by SPF include. Analysis across 5,499,028 domains from the complete Tranco Top Sites ranking.

**Key findings:**

- **19.6% Microsoft 365**
- **13.6% Google Workspace**
- **148,655 PermError Risk**
- **53.5% Softfail Rate**

Protocols covered: SPF

**Corrections:**

- 2026-10-21, Clarified: _Adoption shares stated as measurements._ For 217,774 domains (4.0%) the SPF lookup timed out or the resolver reported a server failure, and the scanner recorded no SPF. Leaving those domains out, SPF adoption is 58.3% rather than 56.0%. DMARC and DKIM lookup failures were not recorded, so those shares are lower bounds as well, and the page now states what domains publish rather than what they lack.
- 2026-10-21, Clarified: _DNS queries via system resolver._ Queries went to our hosting provider's shared recursive resolver with the host's default timeout and retry settings and a 15-second budget per domain. The Tranco list was the full list; its list ID was not recorded.
- 2026-10-21, Corrected: _All-qualifier table: -all 1,238,165, ~all 1,648,731, ?all 112,406, +all 3,575, no qualifier 79,245. These summed to 3,082,122, which is 4,903 more than the 3,077,219 SPF records._ Recounted with one qualifier per record, taken from the record's first all term, which is the one receivers apply: -all 1,236,626, ~all 1,645,499, ?all 112,144, +all 3,562, and no all term 79,388. The softfail share is 53.5%, not 53.6%.
- 2026-10-21, Corrected: _SPF adoption bars labelled Top 10K, Top 100K and Top 1M._ Those bars cover rank bands: 1,001 to 10,000, 10,001 to 100,000 and 100,001 to 1,000,000. The labels now say so; the counts were right.
- 2026-10-21, Clarified: _Scanned March 15, 2026._ The DNS scan ran on February 27, 2026. March 15 is when we analyzed its SPF records and published this page.
- 2026-10-21, Removed: _Zero parse errors encountered._ The scanner had no way to report a parse error, so zero was not a measurement.
- 2026-10-21, Removed: _Lookup counts use the same DNS resolver and timeout settings as production email receivers._ We never compared our resolver with receivers' resolvers.
- 2026-10-21, Removed: _First-ever email sender market share by SPF include. No one publishes this data._ We cannot show that no earlier study measured this.
- 2026-10-21, Removed: _Full Dataset (CSV) and Top 10K Sample (CSV) downloads._ Neither file was ever available at its link. The aggregate statistics (JSON) and the Markdown report remain.

- [Full study](https://dmarcguard.io/research/spf-supply-chain/)

## Learn

Protocol and compliance explainers -- 12 published articles.

### [DMARC Email Auth Guide \[2026\]](https://dmarcguard.io/learn/dmarc/)

Protocol: DMARC | Category: Email Authentication | RFC: RFC 9989

Learn how DMARC protects your domain from email spoofing. Covers DMARC records, policies (none/quarantine/reject), alignment, reporting, and SPF/DKIM.

- [Full article](https://dmarcguard.io/learn/dmarc/)
- [Markdown version](https://dmarcguard.io/learn/dmarc.md)

### [What Is SPF? How It Works, Provider Setup & Alignment \[2026\]](https://dmarcguard.io/learn/spf/)

Protocol: SPF | Category: Email Authentication | RFC: RFC 7208

How SPF works, how to set it up for Google Workspace and Microsoft 365, how SPF alignment feeds DMARC, and how to fix common failures.

- [Full article](https://dmarcguard.io/learn/spf/)
- [Markdown version](https://dmarcguard.io/learn/spf.md)

### [What is DKIM? How DKIM Signatures & Records Work \[2026\]](https://dmarcguard.io/learn/dkim/)

Protocol: DKIM | Category: Email Authentication | RFC: RFC 6376

DKIM adds cryptographic signatures to emails, verifying sender identity and message integrity. Learn how it works, record examples, and key rotation.

- [Full article](https://dmarcguard.io/learn/dkim/)
- [Markdown version](https://dmarcguard.io/learn/dkim.md)

### [What Is ARC? Authenticated Received Chain \[2026\]](https://dmarcguard.io/learn/arc/)

Protocol: ARC | Category: Email Authentication | RFC: RFC 8617

ARC (Authenticated Received Chain, RFC 8617) preserves email authentication through forwarding and mailing lists — and how it fixes DMARC failures.

- [Full article](https://dmarcguard.io/learn/arc/)
- [Markdown version](https://dmarcguard.io/learn/arc.md)

### [TLS-RPT SMTP TLS Reporting \[2026\]](https://dmarcguard.io/learn/tls-rpt/)

Protocol: TLS-RPT | Category: Transport Security | RFC: RFC 8460

TLS-RPT (RFC 8460) monitors SMTP TLS failures between mail servers. Learn how to set up your DNS record, read reports, and fix errors.

- [Full article](https://dmarcguard.io/learn/tls-rpt/)
- [Markdown version](https://dmarcguard.io/learn/tls-rpt.md)

### [What Is MTA-STS? DNS Record & Policy File \[2026\]](https://dmarcguard.io/learn/mta-sts/)

Protocol: MTA-STS | Category: Transport Security | RFC: RFC 8461

Learn what MTA-STS is, how it prevents TLS downgrade attacks, and how to set up your DNS record and policy file. RFC 8461 guide with provider examples.

- [Full article](https://dmarcguard.io/learn/mta-sts/)
- [Markdown version](https://dmarcguard.io/learn/mta-sts.md)

### [What Is BIMI? Record Setup & DNS Examples \[2026\]](https://dmarcguard.io/learn/bimi/)

Protocol: BIMI | Category: Brand & Reporting

BIMI puts your brand logo in the inbox once you reach DMARC enforcement. Learn how to create a BIMI record, VMC requirements, and which clients support BIMI.

- [Full article](https://dmarcguard.io/learn/bimi/)
- [Markdown version](https://dmarcguard.io/learn/bimi.md)

### [What Is DANE? TLSA Records & SMTP DANE \[2026\]](https://dmarcguard.io/learn/dane/)

Protocol: DANE | Category: Transport Security | RFC: RFC 6698

DANE binds your mail server's TLS certificate to DNS with DNSSEC and TLSA records. Learn how TLSA records work, DANE vs MTA-STS, and SMTP DANE setup.

- [Full article](https://dmarcguard.io/learn/dane/)
- [Markdown version](https://dmarcguard.io/learn/dane.md)

### [Abuse Reporting Format (ARF) for Email (RFC 5965) \[2026\]](https://dmarcguard.io/learn/arf/)

Protocol: ARF | Category: Brand & Reporting | RFC: RFC 5965

ARF (Abuse Reporting Format, RFC 5965) is the format behind DMARC failure reports and feedback-loop complaints — and how to read one.

- [Full article](https://dmarcguard.io/learn/arf/)
- [Markdown version](https://dmarcguard.io/learn/arf.md)

### [PCI DSS 4.0 DMARC Requirement \[2026\]](https://dmarcguard.io/learn/pci-dss/)

Protocol: PCI DSS | Category: Compliance

PCI DSS v4.0 Section 5.4.1 requires anti-phishing controls including DMARC, SPF, and DKIM. Learn what changed, compliance deadlines, and how to implement.

- [Full article](https://dmarcguard.io/learn/pci-dss/)
- [Markdown version](https://dmarcguard.io/learn/pci-dss.md)

### [Content Security Policy (CSP) Explained \[2026\]](https://dmarcguard.io/learn/csp/)

Protocol: CSP | Category: Client-Side Security

What Content Security Policy is, how browsers enforce it, and how to configure, roll out, and debug one. With live examples.

- [Full article](https://dmarcguard.io/learn/csp/)
- [Markdown version](https://dmarcguard.io/learn/csp.md)

### [APRF: Aggregate Performance Reporting for Email \[2026\]](https://dmarcguard.io/learn/aprf/)

Protocol: APRF | Category: Brand & Reporting

APRF (Aggregate Performance Reporting) lets mailbox providers send DKIM signers daily inbox placement and engagement reports. Record, report format, setup.

- [Full article](https://dmarcguard.io/learn/aprf/)
- [Markdown version](https://dmarcguard.io/learn/aprf.md)

## Blog

51 published guides on DMARC, SPF, DKIM, and email authentication troubleshooting, newest first. Every post also has a markdown twin at the same path.

### [Content Security Policy Examples by Stack](https://dmarcguard.io/blog/csp-header-examples/)

Published: 2026-09-17 | Tags: csp, content-security-policy, web-security, nginx, cloudflare, nextjs, setup

Content Security Policy examples for nginx, Cloudflare, and Next.js — plus the add_header trap that silently drops your header. Grade yours free.

- [Full article](https://dmarcguard.io/blog/csp-header-examples/)
- [Markdown version](https://dmarcguard.io/blog/csp-header-examples.md)

### [DMARC rua Tag: Are Reports Reaching You?](https://dmarcguard.io/blog/dmarc-rua-collection/)

Published: 2026-09-10 | Tags: dmarc, rua, dmarc-rua, aggregate-reports, rfc-9990, dmarcbis

The DMARC rua tag decides whether you get aggregate reports at all. Where to point it, the _report._dmarc record, and why reports stop. Check yours free.

- [Full article](https://dmarcguard.io/blog/dmarc-rua-collection/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-rua-collection.md)

### [How to Decode Email Headers: Read the ARC Set](https://dmarcguard.io/blog/read-email-headers/)

Published: 2026-09-03 | Tags: email-headers, arc, authentication-results, rfc-8601, rfc-8617, email-forensics, email-authentication

Decode email headers line by line: trace the Received chain, find your trust boundary, and read the ARC set. Walk one real dump, then analyze yours.

- [Full article](https://dmarcguard.io/blog/read-email-headers/)
- [Markdown version](https://dmarcguard.io/blog/read-email-headers.md)

### [Free vs Paid DMARC Monitoring: When Each Makes Sense](https://dmarcguard.io/blog/free-vs-paid-dmarc-monitoring/)

Published: 2026-08-31 | Tags: comparisons, dmarc-monitoring, pricing, free-tools, decision-framework, bofu

Free DMARC monitoring is often enough — and sometimes it isn't. Real free-tier caps, real paid prices, contract fine print, and a decision table to pick well.

- [Full article](https://dmarcguard.io/blog/free-vs-paid-dmarc-monitoring/)
- [Markdown version](https://dmarcguard.io/blog/free-vs-paid-dmarc-monitoring.md)

### [BIMI DMARC Requirements: The Policy Your Logo Needs](https://dmarcguard.io/blog/bimi-dmarc-requirements/)

Published: 2026-08-27 | Tags: bimi, dmarc, dmarc-policy, vmc, cmc, email-authentication

BIMI requires DMARC at enforcement: p=quarantine or reject, pct=100, sp not none. See the exact requirements and fix bimi=skipped insufficient dmarc.

- [Full article](https://dmarcguard.io/blog/bimi-dmarc-requirements/)
- [Markdown version](https://dmarcguard.io/blog/bimi-dmarc-requirements.md)

### [DMARC Aggregate Report: Anatomy, Senders, RFC 9990](https://dmarcguard.io/blog/dmarc-aggregate-report/)

Published: 2026-08-24 | Tags: dmarc, aggregate-reports, rua, rfc-9990, dmarcbis, email-authentication

What a DMARC aggregate report is, who sends the XML and how often, an annotated sample file, and what RFC 9990 changed. Analyze yours free.

- [Full article](https://dmarcguard.io/blog/dmarc-aggregate-report/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-aggregate-report.md)

### [TLSA Mismatch: Debug a DANE 3 1 1 Failure with OpenSSL](https://dmarcguard.io/blog/tlsa-mismatch-troubleshooting/)

Published: 2026-08-20 | Tags: dane, tlsa, dnssec, smtp, openssl, tls-rpt, troubleshooting

A DANE TLSA 3 1 1 mismatch means the published hash no longer matches the served key. Compute the hash with OpenSSL, isolate the root cause, and fix it fast.

- [Full article](https://dmarcguard.io/blog/tlsa-mismatch-troubleshooting/)
- [Markdown version](https://dmarcguard.io/blog/tlsa-mismatch-troubleshooting.md)

### [Google Workspace SPF Record: What Docs Don't Tell You](https://dmarcguard.io/blog/google-workspace-spf-record/)

Published: 2026-08-17 | Tags: spf, google-workspace, gmail, dns-lookups, email-authentication, rfc-7208

The exact Google Workspace SPF record to publish, third-party sender combos, the DNS lookup math, and ~all vs -all under RFC 7208.

- [Full article](https://dmarcguard.io/blog/google-workspace-spf-record/)
- [Markdown version](https://dmarcguard.io/blog/google-workspace-spf-record.md)

### [DNS Authentication DMARC Fail: The Mimecast Fix](https://dmarcguard.io/blog/dmarc-fail-mimecast-fix/)

Published: 2026-08-13 | Tags: dmarc, mimecast, spf, dkim, troubleshooting

"DNS Authentication: DMARC Fail" is Mimecast's inbound hold verdict. Decode the string, read the headers, and fix it as admin or sender.

- [Full article](https://dmarcguard.io/blog/dmarc-fail-mimecast-fix/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-fail-mimecast-fix.md)

### [Best DMARC Reporting Tools in 2026: 9 Compared by Depth](https://dmarcguard.io/blog/best-dmarc-reporting-tools/)

Published: 2026-08-10 | Tags: comparisons, dmarc-tools, dmarc-reporting, listicle, bofu

Compare 9 DMARC reporting tools on RUF parsing, source naming, retention, and export — with dated, source-linked pricing. Find the depth your rollout needs.

- [Full article](https://dmarcguard.io/blog/best-dmarc-reporting-tools/)
- [Markdown version](https://dmarcguard.io/blog/best-dmarc-reporting-tools.md)

### [Fix "MTA-STS Policy Is Missing: STSFetchResult.NONE"](https://dmarcguard.io/blog/mta-sts-policy-missing-fix/)

Published: 2026-08-06 | Tags: mta-sts, troubleshooting, tls-rpt, mail-in-a-box, dns, email-authentication

Seeing "MTA-STS policy is missing: STSFetchResult.NONE"? Diagnose it in 3 stages — DNS TXT record, HTTPS policy fetch, TLS cert — with copy-paste commands.

- [Full article](https://dmarcguard.io/blog/mta-sts-policy-missing-fix/)
- [Markdown version](https://dmarcguard.io/blog/mta-sts-policy-missing-fix.md)

### [SPF Record Syntax Guide: RFC 7208 Rules & Macros](https://dmarcguard.io/blog/spf-record-syntax/)

Published: 2026-08-03 | Tags: spf, spf-record-syntax, spf-mechanisms, spf-macros, rfc-7208, dns, email-authentication

Every SPF record syntax element in one place — mechanisms, qualifiers, modifiers, and macros — with RFC 7208 section cites and real record examples.

- [Full article](https://dmarcguard.io/blog/spf-record-syntax/)
- [Markdown version](https://dmarcguard.io/blog/spf-record-syntax.md)

### [TLSA Record Setup: Generate & Fix the 3 1 1 Hash](https://dmarcguard.io/blog/tlsa-record-setup/)

Published: 2026-07-30 | Tags: dane, tlsa, dnssec, smtp, openssl, tls-rpt, email-authentication

Generate a TLSA record with OpenSSL, publish it, then fix the common DANE 3 1 1 mismatch. Copy-paste commands plus a free TLSA record checker. Step by step.

- [Full article](https://dmarcguard.io/blog/tlsa-record-setup/)
- [Markdown version](https://dmarcguard.io/blog/tlsa-record-setup.md)

### [DMARC Subdomain Policy: sp= and np= Explained](https://dmarcguard.io/blog/dmarc-subdomain-policy/)

Published: 2026-07-27 | Tags: dmarc, dmarc-subdomain-policy, sp-tag, np-tag, dmarcbis, rfc-9989

DMARC subdomain policy sets how subdomains inherit p=, sp=, and np=. See the DMARCbis tree walk, sp= vs np=, and how to stop non-existent-subdomain spoofing.

- [Full article](https://dmarcguard.io/blog/dmarc-subdomain-policy/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-subdomain-policy.md)

### [PCI DSS DMARC Requirement: What 5.4.1 Actually Says](https://dmarcguard.io/blog/pci-dss/)

Published: 2026-07-23 | Tags: pci-dss, compliance, dmarc, spf, dkim, email-authentication, section-5-4-1

PCI DSS v4.0.1 Section 5.4.1 mandates anti-phishing controls — and names DMARC, SPF, and DKIM as examples, not requirements. See what your auditors expect.

- [Full article](https://dmarcguard.io/blog/pci-dss/)
- [Markdown version](https://dmarcguard.io/blog/pci-dss.md)

### [Best Free DMARC Tools in 2026: Checkers & Analyzers](https://dmarcguard.io/blog/best-free-dmarc-tools/)

Published: 2026-07-20 | Tags: comparisons, dmarc-tools, free-tools, dmarc-monitoring, listicle, bofu

Compare every genuinely free DMARC tool: no-signup checkers, free DMARC analyzers, and free monitoring tiers, with real limits and when to upgrade.

- [Full article](https://dmarcguard.io/blog/best-free-dmarc-tools/)
- [Markdown version](https://dmarcguard.io/blog/best-free-dmarc-tools.md)

### [Valimail Alternative: Transparent Pricing, No Demo Gate](https://dmarcguard.io/blog/valimail-alternative/)

Published: 2026-07-16 | Tags: comparisons, dmarc-tools, alternatives, valimail, dmarc-monitoring

Looking for a Valimail alternative? Compare transparent per-domain pricing, self-serve signup with no demo gate, and 9-protocol DMARC coverage. Check free.

- [Full article](https://dmarcguard.io/blog/valimail-alternative/)
- [Markdown version](https://dmarcguard.io/blog/valimail-alternative.md)

### [PowerDMARC Alternative: Experience Over Feature Count](https://dmarcguard.io/blog/powerdmarc-alternative/)

Published: 2026-07-13 | Tags: comparisons, dmarc-tools, alternatives

Weighing a PowerDMARC alternative? Compare real pricing ($8–$250/mo), protocol coverage, honest reviews, and a zero-gap migration path before you switch.

- [Full article](https://dmarcguard.io/blog/powerdmarc-alternative/)
- [Markdown version](https://dmarcguard.io/blog/powerdmarc-alternative.md)

### [How to Set Up DKIM: Selectors, Keys & Records (2026)](https://dmarcguard.io/blog/dkim-setup-guide/)

Published: 2026-07-09 | Tags: dkim, dkim-record, selector, key-rotation, setup, email-authentication

Set up DKIM the right way: how signing works, choosing 2048-bit keys, finding your selector, and publishing the record. A 2026 guide — check yours free.

- [Full article](https://dmarcguard.io/blog/dkim-setup-guide/)
- [Markdown version](https://dmarcguard.io/blog/dkim-setup-guide.md)

### [How to Set Up BIMI (and Why 28% of Records Break)](https://dmarcguard.io/blog/bimi-record-setup/)

Published: 2026-07-06 | Tags: bimi, bimi-record, vmc, setup, email-authentication, dns

BIMI puts your logo in the inbox — but 28% of records break. Here's how to set up BIMI: the DNS TXT record, SVG Tiny PS logo, and VMC vs CMC. Check yours free.

- [Full article](https://dmarcguard.io/blog/bimi-record-setup/)
- [Markdown version](https://dmarcguard.io/blog/bimi-record-setup.md)

### [Email Provider Market Share 2026: Who Sends the Mail](https://dmarcguard.io/blog/email-provider-market-share/)

Published: 2026-07-02 | Tags: email-provider-market-share, spf, microsoft-365, google-workspace, transactional-email, email-authentication, research

Microsoft 365 = 19.6%, Google Workspace = 13.6% of 3.08M SPF-enabled domains (DMARCguard scan, Mar 2026). The 2026 email provider market share, sourced.

- [Full article](https://dmarcguard.io/blog/email-provider-market-share/)
- [Markdown version](https://dmarcguard.io/blog/email-provider-market-share.md)

### [DORA Compliance for Email: Map DMARC to Art. 9-11](https://dmarcguard.io/blog/dora-email-authentication/)

Published: 2026-06-29 | Tags: dora, compliance, email-authentication, dmarc, mta-sts, tls-rpt, nis2, bafin

DORA compliance for email, mapped to Articles 9, 10 and 11. How DMARC, SPF, MTA-STS and TLS-RPT meet the regulation's data-in-transit duties.

- [Full article](https://dmarcguard.io/blog/dora-email-authentication/)
- [Markdown version](https://dmarcguard.io/blog/dora-email-authentication.md)

### [MTA-STS vs DANE: Verdict by Scenario (2026 Data)](https://dmarcguard.io/blog/mta-sts-vs-dane/)

Published: 2026-06-25 | Tags: mta-sts, dane, tlsa, dnssec, smtp, tls-rpt, nis2

Only 0.3% of 5.5M domains publish MTA-STS. Get the per-scenario verdict, RFC 8461 vs 7672, Microsoft's connector modes, and NIS2 fit.

- [Full article](https://dmarcguard.io/blog/mta-sts-vs-dane/)
- [Markdown version](https://dmarcguard.io/blog/mta-sts-vs-dane.md)

### [Email Deliverability Monitoring: 7 Signals to Track](https://dmarcguard.io/blog/email-deliverability-monitoring/)

Published: 2026-06-22 | Tags: deliverability, monitoring, email-authentication, dmarc, sender-reputation

Email deliverability monitoring: the protocol signals that predict spam-folder placement, the metrics to track, and the tools that surface each one.

- [Full article](https://dmarcguard.io/blog/email-deliverability-monitoring/)
- [Markdown version](https://dmarcguard.io/blog/email-deliverability-monitoring.md)

### [Does HIPAA Require DMARC? §164.312 Email Auth Mapping \[2026\]](https://dmarcguard.io/blog/hipaa-email-authentication/)

Published: 2026-06-18 | Tags: hipaa, compliance, dmarc, email-authentication, 164-312, ephi, healthcare

Does HIPAA require DMARC? Not by name. How §164.312 technical safeguards map to DMARC, SPF, DKIM, MTA-STS, TLS-RPT — plus the Dec 2024 NPRM.

- [Full article](https://dmarcguard.io/blog/hipaa-email-authentication/)
- [Markdown version](https://dmarcguard.io/blog/hipaa-email-authentication.md)

### [How to Create a DMARC Record: Tags, Examples & Setup](https://dmarcguard.io/blog/how-to-create-dmarc-record/)

Published: 2026-06-15 | Tags: dmarc, dmarc-record, setup, dmarcbis, rfc-9989, email-authentication

How to create a DMARC record step by step — tags, syntax, real examples, and the p=none → p=reject rollout. Verify it with a free DMARC checker.

- [Full article](https://dmarcguard.io/blog/how-to-create-dmarc-record/)
- [Markdown version](https://dmarcguard.io/blog/how-to-create-dmarc-record.md)

### [DMARC Adoption Rate 2026: The 12.8% Enforcement Gap](https://dmarcguard.io/blog/dmarc-enforcement-gap/)

Published: 2026-06-11 | Tags: dmarc, research, email-authentication, dmarc-adoption, enforcement

30.4% of 5.5 million domains have DMARC; only 12.8% enforce p=quarantine or p=reject. The 2026 enforcement gap, with sources. Run a free check.

- [Full article](https://dmarcguard.io/blog/dmarc-enforcement-gap/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-enforcement-gap.md)

### [DMARC for Google Workspace: Step-by-Step Setup \[2026\]](https://dmarcguard.io/blog/dmarc-google-workspace-setup/)

Published: 2026-06-08 | Tags: google-workspace, dmarc, email-authentication, setup, dns

Set up DMARC for Google Workspace step-by-step: the exact TXT record, where to publish it, and the p=none to reject rollout. 2026 guide.

- [Full article](https://dmarcguard.io/blog/dmarc-google-workspace-setup/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-google-workspace-setup.md)

### [Why Are My Emails Going to Spam? Authentication-First Fix](https://dmarcguard.io/blog/emails-going-to-spam/)

Published: 2026-06-04 | Tags: deliverability, email-authentication, spam, dmarc, sender-reputation

Emails landing in spam? Only 59.2% of 5.5M scanned domains publish DMARC, SPF or DKIM. Use this authentication-first checklist to get back in the inbox.

- [Full article](https://dmarcguard.io/blog/emails-going-to-spam/)
- [Markdown version](https://dmarcguard.io/blog/emails-going-to-spam.md)

### [NIS2 Email Security: Article 21 → DMARC, MTA-STS, DANE](https://dmarcguard.io/blog/nis2-email-security/)

Published: 2026-06-01 | Tags: nis2, compliance, dmarc, mta-sts, dane, tls-rpt, email-authentication, article-21

NIS2 compliance: map Article 21(2) to email auth — DMARC, SPF, MTA-STS, DANE, TLS-RPT. The control map, copy-paste DNS checks, and a 2026 readiness plan.

- [Full article](https://dmarcguard.io/blog/nis2-email-security/)
- [Markdown version](https://dmarcguard.io/blog/nis2-email-security.md)

### [RFC 9989 DMARC: What Changed From RFC 7489](https://dmarcguard.io/blog/dmarc-rfc-9989-9990-9991/)

Published: 2026-05-20 | Tags: dmarc, dmarcbis, rfc-9989, rfc-9990, rfc-9991, standards, ietf

RFC 9989 replaces RFC 7489 as DMARC's Standards-Track spec (May 2026). What changed: the RFC 9990 aggregate / 9991 failure split, tree walk, pct removed.

- [Full article](https://dmarcguard.io/blog/dmarc-rfc-9989-9990-9991/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-rfc-9989-9990-9991.md)

### [Best DMARC Monitoring Tools in 2026: 6 Compared](https://dmarcguard.io/blog/best-dmarc-monitoring-tools/)

Published: 2026-05-20 | Tags: comparisons, dmarc-tools, dmarc-monitoring, listicle, bofu

Honest comparison of 6 DMARC monitoring tools in 2026: protocol coverage, pricing, free-tier limits, MSP fit. Pick the right one.

- [Full article](https://dmarcguard.io/blog/best-dmarc-monitoring-tools/)
- [Markdown version](https://dmarcguard.io/blog/best-dmarc-monitoring-tools.md)

### [Best dmarcian Alternatives in 2026: Pricing & Protocols](https://dmarcguard.io/blog/dmarcian-alternative/)

Published: 2026-05-18 | Tags: comparisons, dmarc-tools, alternatives, dmarcian, dmarc-monitoring

Comparing the best dmarcian alternatives in 2026. Protocol coverage, pricing, free tiers, switcher quotes, and a step-by-step migration guide.

- [Full article](https://dmarcguard.io/blog/dmarcian-alternative/)
- [Markdown version](https://dmarcguard.io/blog/dmarcian-alternative.md)

### [How to Read a DMARC Aggregate Report (XML Made Simple)](https://dmarcguard.io/blog/how-to-read-dmarc-report/)

Published: 2026-05-15 | Tags: dmarc, monitoring, email-authentication, reports, xml

Read DMARC aggregate reports field by field. Annotated XML, Google vs Microsoft variants, and a live drawer demo. Free analyzer inside.

- [Full article](https://dmarcguard.io/blog/how-to-read-dmarc-report/)
- [Markdown version](https://dmarcguard.io/blog/how-to-read-dmarc-report.md)

### [MTA-STS Example: Working Policy File & DNS Record \[2026\]](https://dmarcguard.io/blog/mta-sts-example/)

Published: 2026-05-13 | Tags: mta-sts, tls, rfc-8461, smtp, transport-security

Copy-paste a working MTA-STS DNS record and policy file. RFC 8461 examples for Google Workspace, Microsoft 365, and Postfix, plus mode progression.

- [Full article](https://dmarcguard.io/blog/mta-sts-example/)
- [Markdown version](https://dmarcguard.io/blog/mta-sts-example.md)

### [DMARC for MSPs: The Independent Operator's Guide (2026)](https://dmarcguard.io/blog/dmarc-for-msps/)

Published: 2026-05-11 | Tags: msp, dmarc-monitoring, multi-tenant, compliance, channel, pricing

Vendor-neutral DMARC guide for MSPs: wholesale pricing, multi-tenant ops, PSA integrations, and ROI math — without the partner-program pitch.

- [Full article](https://dmarcguard.io/blog/dmarc-for-msps/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-for-msps.md)

### [TLS-RPT Reports: SMTP TLS Reporting Explained (RFC 8460)](https://dmarcguard.io/blog/tls-rpt-report/)

Published: 2026-05-08 | Tags: tls-rpt, mta-sts, dane, email-authentication, rfc-8460

TLS-RPT reports tell you when SMTP TLS fails between mail servers. See an annotated RFC 8460 JSON example, every result type, and how to set it up.

- [Full article](https://dmarcguard.io/blog/tls-rpt-report/)
- [Markdown version](https://dmarcguard.io/blog/tls-rpt-report.md)

### [What Is ARF in Email? Abuse Reporting Format](https://dmarcguard.io/blog/what-is-arf/)

Published: 2026-05-06 | Tags: arf, dmarc, email-authentication, rfc-5965, feedback-loops

ARF (Abuse Reporting Format, RFC 5965) is the standard for DMARC forensic reports and email feedback loops. Annotated sample inside.

- [Full article](https://dmarcguard.io/blog/what-is-arf/)
- [Markdown version](https://dmarcguard.io/blog/what-is-arf.md)

### [DKIM2 Explained: The 2026 Successor to ARC and DKIM](https://dmarcguard.io/blog/arc-to-dkim2-future/)

Published: 2026-05-04 | Tags: dkim2, arc, dkim, ietf, email-authentication, future

DKIM2 is the IETF's per-hop chained-signature successor to ARC and DKIM. Eight active drafts, six contested questions, and what admins track in 2026.

- [Full article](https://dmarcguard.io/blog/arc-to-dkim2-future/)
- [Markdown version](https://dmarcguard.io/blog/arc-to-dkim2-future.md)

### [ARC Email Authentication: Forwarded Mail in 2026](https://dmarcguard.io/blog/arc-email-authentication/)

Published: 2026-04-29 | Tags: arc, email-authentication, dmarc, forwarding, rfc-8617

ARC email authentication carries SPF, DKIM, and DMARC verdicts across forwarding hops. Real headers, cv=fail debugging, trusted-sealer fixes, IETF status.

- [Full article](https://dmarcguard.io/blog/arc-email-authentication/)
- [Markdown version](https://dmarcguard.io/blog/arc-email-authentication.md)

### [Does Outlook Require DMARC? Yes, Since May 2025](https://dmarcguard.io/blog/microsoft-dmarc-enforcement/)

Published: 2026-04-27 | Tags: microsoft-365, compliance, email-authentication, dmarc, outlook

Yes — Microsoft has required DMARC for Outlook senders since May 5, 2025. Set up DMARC for Microsoft 365 step by step with DNS examples.

- [Full article](https://dmarcguard.io/blog/microsoft-dmarc-enforcement/)
- [Markdown version](https://dmarcguard.io/blog/microsoft-dmarc-enforcement.md)

### [Google, Yahoo & Microsoft DMARC Requirements](https://dmarcguard.io/blog/google-yahoo-dmarc-requirements/)

Published: 2026-04-24 | Tags: dmarc, compliance, bulk-sender, gmail, yahoo, microsoft, email-authentication

Google, Yahoo, and Microsoft now require DMARC for bulk senders — including Gmail's 2025 SMTP rejection escalation. See the full compliance checklist.

- [Full article](https://dmarcguard.io/blog/google-yahoo-dmarc-requirements/)
- [Markdown version](https://dmarcguard.io/blog/google-yahoo-dmarc-requirements.md)

### [DMARC Fails on Forwarded Emails: Why ARC Is the Fix](https://dmarcguard.io/blog/dmarc-forwarding-arc-fix/)

Published: 2026-04-23 | Tags: dmarc, arc, forwarding, email-authentication, troubleshooting

Forwarded emails fail DMARC because SPF breaks in transit. See why, when DKIM survives, and how ARC seals the chain across every forwarding hop.

- [Full article](https://dmarcguard.io/blog/dmarc-forwarding-arc-fix/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-forwarding-arc-fix.md)

### [MXToolbox Alternatives: Free DMARC Tools Compared (2026)](https://dmarcguard.io/blog/mxtoolbox-alternative/)

Published: 2026-04-20 | Tags: comparisons, dmarc-tools, alternatives, mxtoolbox, dmarc-monitoring

MXToolbox SuperTool covers lookups but stops at DMARC monitoring. Compare free alternatives — DMARCguard, EasyDMARC, dmarcian, PowerDMARC — on pricing.

- [Full article](https://dmarcguard.io/blog/mxtoolbox-alternative/)
- [Markdown version](https://dmarcguard.io/blog/mxtoolbox-alternative.md)

### [SPF Flattening: Fix Too Many DNS Lookups (2026)](https://dmarcguard.io/blog/spf-too-many-dns-lookups/)

Published: 2026-04-16 | Tags: spf, troubleshooting, email-authentication, dmarc, dns, spf-flattening

148,655 domains exceed the SPF 10-lookup limit. Learn what SPF flattening is, when to use it, 4 safer alternatives, and step-by-step fixes. Check free.

- [Full article](https://dmarcguard.io/blog/spf-too-many-dns-lookups/)
- [Markdown version](https://dmarcguard.io/blog/spf-too-many-dns-lookups.md)

### [SPF Softfail vs Hardfail: Which to Use?](https://dmarcguard.io/blog/spf-softfail-vs-hardfail/)

Published: 2026-04-13 | Tags: spf, email-authentication, dmarc, deliverability, dns

53.5% of domains use SPF softfail, 40.2% use hardfail. Learn how each qualifier works, how DMARC changes the equation, and which to choose. Check your SPF free.

- [Full article](https://dmarcguard.io/blog/spf-softfail-vs-hardfail/)
- [Markdown version](https://dmarcguard.io/blog/spf-softfail-vs-hardfail.md)

### [SPF PermError: How to Find and Fix It (2026 Guide)](https://dmarcguard.io/blog/spf-permerror-fix/)

Published: 2026-03-25 | Tags: spf, troubleshooting, email-authentication, dmarc, dns

SPF PermError breaks DMARC alignment and kills deliverability. Learn the 5 causes, step-by-step fixes, and platform-specific examples. Check your SPF free.

- [Full article](https://dmarcguard.io/blog/spf-permerror-fix/)
- [Markdown version](https://dmarcguard.io/blog/spf-permerror-fix.md)

### [DKIM Fail: How to Fix Alignment and Verification Errors](https://dmarcguard.io/blog/dkim-alignment-failure-fix/)

Published: 2026-03-13 | Tags: dkim, troubleshooting, email-authentication, dmarc, dns

DKIM failing? Learn why DKIM alignment breaks, how to fix body hash errors, and how to configure third-party senders. Step-by-step guide with CLI commands.

- [Full article](https://dmarcguard.io/blog/dkim-alignment-failure-fix/)
- [Markdown version](https://dmarcguard.io/blog/dkim-alignment-failure-fix.md)

### [DMARC Quarantine/Reject Policy Not Enabled: Fix It](https://dmarcguard.io/blog/dmarc-policy-not-enabled-fix/)

Published: 2026-03-11 | Tags: dmarc, troubleshooting, email-authentication, dns, enforcement

See 'DMARC quarantine/reject policy not enabled'? Learn what it means and how to fix it step by step for any DNS provider. Free checker included.

- [Full article](https://dmarcguard.io/blog/dmarc-policy-not-enabled-fix/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-policy-not-enabled-fix.md)

### [EasyDMARC Alternatives: Why Teams Switch in 2026](https://dmarcguard.io/blog/easydmarc-alternative/)

Published: 2026-03-03 | Tags: comparisons, dmarc-tools, alternatives

EasyDMARC's Plus plan runs $44.99/mo, with TLS-RPT and MTA-STS gated to Premium. Compare alternatives on pricing, protocols, and free tiers.

- [Full article](https://dmarcguard.io/blog/easydmarc-alternative/)
- [Markdown version](https://dmarcguard.io/blog/easydmarc-alternative.md)

### [DMARC Fail: 7 Causes & How to Fix Each (2026 Guide)](https://dmarcguard.io/blog/dmarc-failed-how-to-fix/)

Published: 2026-02-25 | Tags: dmarc, troubleshooting, email-authentication, spf, dkim

DMARC failed? Fix it fast: 7 causes (SPF/DKIM misalignment, third-party senders, forwarding) with diagnose steps, fixes, and a free DMARC checker.

- [Full article](https://dmarcguard.io/blog/dmarc-failed-how-to-fix/)
- [Markdown version](https://dmarcguard.io/blog/dmarc-failed-how-to-fix.md)

## Getting Started

1. **Sign up free** at [https://app.dmarcguard.io/register](https://app.dmarcguard.io/register) — no credit card required
2. **Add your domain** — enter your domain name in the dashboard
3. **Verify DNS ownership** — add a TXT record to prove domain control
4. **Configure DMARC reporting** — add DMARCguard's address to your DMARC rua= tag
5. **Wait for reports** — aggregate reports arrive within 24-48 hours from major receivers (Gmail, Outlook, Yahoo)
6. **Review dashboard** — compliance health score, source breakdown, and fix recommendations appear automatically

## API Documentation

Every docs page has a Markdown twin at the same path with a `.md` suffix.

- [Getting started with the API](https://dmarcguard.io/docs/getting-started.md): Create an API key, make your first request and learn the conventions every endpoint follows.
- [Authentication](https://dmarcguard.io/docs/authentication.md): How API keys are issued, scoped, bound to an organization and revoked, and what each 401 and 403 means.
- [Rate limits](https://dmarcguard.io/docs/rate-limits.md): The hourly quota, the abuse controls in front of it, the headers that report them and how to pace a client.
- [Single sign-on](https://dmarcguard.io/docs/sso.md): Connect your identity provider with OpenID Connect, verify your email domain, and decide whether password login stays available.
- [Changelog](https://dmarcguard.io/docs/changelog.md): Dated changes to the API contract and the documentation.
- [DMARCguard API v1](https://dmarcguard.io/docs/api/v1.md): Base URL, authentication, conventions, errors and the endpoint list
- [Reports · API v1](https://dmarcguard.io/docs/api/v1/reports.md): Aggregate (RUA) reports as received, parsed and classified.
- [Analytics · API v1](https://dmarcguard.io/docs/api/v1/analytics.md): Organization-wide and per-domain rollups computed by DMARCguard.
- [Domains · API v1](https://dmarcguard.io/docs/api/v1/domains.md): The domains you monitor and their health.
- [Sources · API v1](https://dmarcguard.io/docs/api/v1/sources.md): Who sends mail as your domains, and whether they should.
- [Events · API v1](https://dmarcguard.io/docs/api/v1/events.md): Conditions that needed attention and whether they were acknowledged.
- [API keys · API v1](https://dmarcguard.io/docs/api/v1/api-keys.md): How much of the hourly budget the organization's keys have used.
- [Vocabulary · API v1](https://dmarcguard.io/docs/api/v1/vocabulary.md): The enumerations other responses use, keyed by category: verification states, severities, grades, policies and reputation.

## Links

- Website: [https://dmarcguard.io](https://dmarcguard.io)
- App: [https://app.dmarcguard.io](https://app.dmarcguard.io)
- Parse DMARC, our open-source DMARC report parser (separate codebase, Apache-2.0): [https://github.com/dmarcguardhq/parse-dmarc](https://github.com/dmarcguardhq/parse-dmarc)
- RSS: [https://dmarcguard.io/rss.xml](https://dmarcguard.io/rss.xml)
- Contact: [contact@dmarcguard.io](mailto:contact@dmarcguard.io)