Unspam collects the DMARC aggregate reports mailbox providers send about your domain, turns them into named sending sources, and tells you when your policy is ready for p=quarantine or p=reject.
Once your record has a rua address, receivers like Gmail, Outlook and Yahoo send you compressed XML files every day. Each one lists IP addresses and raw results, and none of them says which of your tools sent the mail.
Marketing platforms, billing systems, help desks and CRMs all send as your domain. Tighten the policy before every one of them aligns, and that tool’s mail starts going to spam or bouncing.
Mail that fails DMARC is either a legitimate tool you forgot to authenticate or someone using your domain without permission. As raw IP addresses, the two look exactly alike.
At p=none, anyone can still send as your domain. Move to p=reject too early and you block your own mail. Without evidence that it is safe, the policy stays where it is for years.
The domain list covers the last 30 days: messages reported, the share that passed DMARC, SPF and DKIM alignment, and the policy each record publishes. Open a domain for its daily volume timeline, with the policy changes receivers reported marked on it.
Reported IP addresses are grouped into sources and categorized as an email service provider, your own infrastructure, a forwarder, or suspected spoofing, each marked compliant, partially failing, failing or unauthorized. Open a source to see why its mail fails and how to fix it.
For each domain, Unspam checks whether you can move to p=quarantine or p=reject and lists what stands in the way: too few days of data, compliance below the threshold, a failing source, or traffic nobody has reviewed yet.
We generate the exact record to publish. If you already have one, you get that record with our reporting address added, so your policy stays as it is. Unspam checks your DNS on its own and verifies the record the moment it appears.
DMARC monitoring is part of the Custom plan at $6 per domain per month. Your first domain is included at no charge, you can add up to 500, and annual billing takes 15% off.
Eight endpoints cover it end to end: register a domain, read the exact record to publish, verify it once the record is live, then list aggregate reports and open one down to its per-source rows. One bearer token, JSON in and JSON out, so onboarding a domain can be a step in your own provisioning.
Those eight are tools on the MCP server too, reached over OAuth with nothing to paste. Ask in plain language for a domain to be added, or for a summary of who sent as it last week, and the assistant chains the calls itself.
Every Monday, Unspam emails you the past week across all your domains: the share of messages that passed DMARC, how many passed and failed, a day-by-day volume chart, and each domain’s compliance rate. It is on by default, skips weeks with no traffic, and can be turned off in your account settings.
Enter the domain in DMARC Reports. Unspam generates the record to publish, or adds our reporting address to the record you already have.
Paste the value at your DNS provider. Your mail flow does not change, and neither does your current policy.
Unspam checks your DNS and verifies the domain as soon as the record is live. If our reporting address is later removed from the record, the domain says so.
Mailbox providers usually send their first aggregate reports 24 to 48 hours after verification. From then on, every report is parsed, attributed to a source and added to your charts.
Reading reports is the means. These are the jobs teams use DMARC monitoring for.
Before you touch the policy, use the sources list as the inventory: every platform that sends as your domain, how much it sends, and whether it aligns.
Work through the readiness blockers one at a time, mark the sources you recognize as legitimate, and tighten the policy when nothing stands in the way.
Sources flagged as suspected spoofing or unauthorized show mail that uses your domain without passing DMARC, and how much of it receivers saw.
After you enable DKIM on a new tool or correct an SPF include, watch that source move from failing to compliant as the next days of reports come in.
Switching email providers or adding a sending subdomain? The daily timeline shows whether mail on the new path aligns while the old one is still running.
Agencies and multi-brand teams add every domain to one account and compare compliance, alignment and policy across all of them in a single list.
What DMARC monitoring is, what it costs, and how Unspam handles your reports.
DMARC monitoring is collecting and reading the aggregate reports that mailbox providers send about mail using your domain. The rua tag in your DMARC record tells receivers where to send them. A monitoring service parses those XML files, groups the results by sending source, and shows which mail passes DMARC, which fails, and why. It is how you move from p=none to an enforced policy without blocking your own mail. To inspect the record itself, use the free DMARC checker.
DMARC monitoring is part of the Custom plan. Each domain costs $6 per month, your first domain is included free, you can monitor up to 500 domains, and annual billing takes 15% off. The Free plan does not include it. Build a plan on the pricing page.
For a one-off look, yes. The free DMARC report analyzer reads a single aggregate report. Monitoring does that for every report as it arrives, attributes the traffic to sources, keeps the history, and tracks whether your domain is ready for a stricter policy.
Only the reporting address changes. With no DMARC record yet, Unspam generates one for you. With an existing record, you get the same record with our address added, so your policy and any other report recipients stay as they are. Some receivers honor only the first two rua addresses, so keep ours among them. To write a record from scratch, try the DMARC record generator.
Mailbox providers send aggregate reports on their own schedule, usually once a day. Most send the first one 24 to 48 hours after your record goes live, and the latest day or two of data can still be filling in.
Monitoring for that domain stops immediately, and every report received for it, including the archived report files, is permanently deleted.
They answer different questions. DMARC monitoring reads what receivers report about authentication for all mail that uses your domain. Deliverability Monitoring sends a test message on a schedule and checks whether it lands in the inbox or in spam at each provider. DMARC controls who can send as your domain; placement tests confirm that the mail you send reaches the inbox.
Yes. Behind the charts, every aggregate report received is listed reporter by reporter. Open one to see each record’s source IP, what the receiver did with the mail, the aligned DKIM and SPF verdicts, and the raw authentication results they came from. The badge beside each reporter shows how far its data can be trusted.
Yes. The REST API covers it end to end: register a domain, read the exact DNS record to publish, verify it once the record is live, list a domain’s aggregate reports, and open a single report down to its per-source records. The same operations are tools on the MCP server, so an assistant can add a domain or tell you who sent as it in plain language. Both need the Custom plan, the same plan DMARC monitoring itself is on.
Yes, as a weekly summary rather than the raw XML files. Every Monday, each account with a monitored domain gets an email covering the previous seven days: the share of messages that passed DMARC, the total, compliant and failing message counts, a daily volume chart, and the compliance rate of every domain. No email goes out for a week with no reported traffic. The summary is on by default, and you can switch it off under Notifications in your account settings. Sending sources and the individual reports stay in the dashboard.
Add a domain, publish one DNS record, and read your first DMARC reports within about two days.
