Spoofing & Phishing
Unknown servers abusing your domain as a sender – including volume, sending IP and the effect of your current policy.
Managed DMARC & TLS-RPT – explained in two minutes
What we do for you
DMARC defines what should happen to e-mails that claim to come from your domain but are not authorised by you. For this to work reliably, you need to know who is actually sending in your name.
DMARC aggregate reports provide exactly that information: major mailbox providers report, usually daily, which servers sent using your domain and whether SPF and DKIM passed. TLS-RPT adds the question of whether e-mails to you could be delivered encrypted.
dmarc.cloud is where these reports arrive and are understood and assessed – so you can focus on your business.
At a glance
- Receipt of all DMARC aggregate reports (RUA)
- Receipt of all TLS-RPT reports (SMTP TLS Reporting)
- Sender classification by analysts (from Business)
- Regular DNS check (SPF, DKIM, DMARC, MTA-STS)
- E-mail alerts to recipients of your choice per domain and report type
- Monthly report for IT and management
- Guidance up to the policy
p=reject - Archiving, export on request, operated in an EU data centre on our own hardware
What we detect in your reports
Analysis
Shadow IT
New cloud services suddenly sending in your name: CRM, online shop, recruiting, accounting. From Business upwards our analysts clarify: authorised or not?
Misconfiguration
Missing DKIM signatures, SPF over the 10-lookup limit, incorrect alignment, forwarding that breaks signatures.
Encryption errors
From TLS-RPT: expired or incomplete certificates, MTA-STS policy errors, STARTTLS problems with remote servers.
Trends & reputation
Compliance rate over time, volume per sender, outliers – the basis for informed decisions.
DNS changes
The regular DNS check (SPF, DKIM, DMARC, MTA-STS) shows changes to your records. From Business upwards our analysts assess the impact.
Three levels. Zero noise.
Alerting
You decide per domain and report type who receives which alerts by e-mail. We make sure every alert has a reason.
| Level | Examples | Alert |
|---|---|---|
| Critical | Spoofing wave, DMARC record deleted, main sender failing | by e-mail as soon as the reports arrive, usually daily |
| Action required | new sender without DKIM, SPF limit exceeded, TLS errors | from Business: within one business day, with a recommendation |
| Info | Changing trends, isolated TLS warnings, room for optimisation | in the monthly report |
From the first report to p=reject
Process
Onboarding
Order, personal reporting addresses, finished DNS records for DMARC and TLS-RPT.
Inventory
One to two weeks of observation with p=none. We record all legitimate senders.
Clean-up
A prioritised action list: tidy up SPF, enable DKIM, clarify anything unknown.
Enforcement
Gradually via quarantine to reject – then monitored permanently.
Compliance evidence included
NIS2, DORA, cyber insurers and supplier audits increasingly ask about e-mail authentication.
Our monthly report documents policy, compliance rate, incidents and actions taken in clear language. This lets you show auditors and insurers that your domain is actively monitored.
Note: our reports support your documentation but do not replace legal advice or formal certification.
What the monthly report contains
- One-page management summary
- Status per domain: policy, compliance, trend
- All authorised senders and their status
- Incidents, spoofing attempts, sending IPs
- TLS-RPT: delivery and encryption
- Open recommendations with priority
Ready for full visibility?
Set up in under 10 minutes – your first analyses are ready within 24 to 48 hours.