HostSherlock

Someone can send your customers an invoice from your domain with a different bank account, and without a DMARC policy their mail servers have no rule from you on what to do with it. Move to p=reject too early, and your own newsletter or accounting mail bounces as well. HostSherlock reads the DMARC reports that mail providers such as Gmail and Outlook send about your domain, and gives your assistant what only those reports show.

For a domain your HostSherlock account monitors, your assistant can tell you whether anyone sent mail in your name from a server that is not one of your services, with message counts, network and country. It can tell you which of your own services would bounce if you moved to p=reject today, why each one fails, and the DNS record that fixes it where we know the service. It can give you the share of your mail that passed DMARC over a period you choose, the changes to your DNS records over the last weeks, and whether mail to your domain arrived without encryption, from the TLS reports of receiving servers.

For any domain, your assistant can look up the published DMARC, SPF, DKIM and MX records.

If you allow it in the sign-in window, your assistant can also add a domain to monitoring and give you the DMARC record to publish. The record starts at p=none or keeps your current policy, so it blocks nothing that is not blocked today. Your assistant then checks whether the record is live.

You sign in with your HostSherlock account in a window on hostsherlock.com, or create a free account there. No tool changes your DNS, buys a plan or deletes anything, and you can revoke the connection any time under Account → API keys.