Free DMARC monitoring.
Know who's sending as your domain.
PlugNDmarc reads the DMARC and TLS reports Google, Microsoft and the rest send about your domain, and shows you every sender, what passes, what fails and what got blocked. Then it helps you lock it down.
No sign-up to check. Start monitoring free.
Set up DMARC in three steps
We read its mail records and show you what's there and what's missing.
None, quarantine or reject. We write the DMARC record for you, keeping anything you already have.
Paste it at your DNS host and press Check now. Reports start within a day or two.
DMARC, TLS reports and MTA-STS, all free
Microsoft 365, Google, SendGrid, Mailchimp and the rest, recognised for you. Unknown senders and forgotten services are flagged at the top.
SPF and DKIM alignment, and whether receivers delivered, junked or refused your mail, day by day.
Find out when mail to you fails to connect securely, before it becomes a delivery problem.
Encrypted delivery enforced, without running a web server: add two records once and we host the policy and its certificate.
SPF built from your mail provider, DKIM steps for Microsoft 365 and Google, and a report card that goes green as you go.
Send the raw reports to a second address too. We keep only the numbers, never your email, and never ask for forensic reports.
DMARC questions, answered
What is DMARC?
DMARC is a DNS record, a TXT record at _dmarc.yourdomain, that tells receivers like Gmail and Outlook what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it anyway (p=none), send it to junk (p=quarantine) or refuse it (p=reject). It also asks them to send you a daily report of everyone sending as you.
Is PlugNDmarc really free?
Yes. Up to 5 domains per account, with no card and no trial, and there is no paid tier. It's from PlugNApps, which makes simple apps for businesses; this one is free.
How does DMARC monitoring work?
The record we write adds a report address (rua=) on plugndmarc.app. Google, Microsoft, Yahoo and the rest then send their daily DMARC aggregate reports there. We read them, name each service sending as your domain, show what passes and fails, and flag anything you should look at.
Do you read my email?
No. DMARC aggregate reports only hold counts per sending server and their SPF and DKIM results, never message content. We never ask for forensic (ruf) reports.
Should my DMARC policy be none, quarantine or reject?
Start with none: mail is delivered as normal and the reports show every service sending as you. Once your own mail passes, move to quarantine, then reject. The setup warns you before a stricter policy could catch your own mail.
I already have a DMARC record. Will this replace it?
We keep everything in it and just add our report address. You edit the one record you have rather than adding a second, because two DMARC records make receivers ignore both.
What are TLS-RPT and MTA-STS?
TLS-RPT is a TXT record at _smtp._tls that gets you reports when mail to you fails to connect securely. MTA-STS tells senders to deliver to you only over verified TLS. We host MTA-STS for you, policy and certificate, behind two CNAME records you add once.
Does it work with Microsoft 365 and Google Workspace?
With any mail provider. For Microsoft 365 and Google Workspace it also gives you the SPF record and the steps to turn on DKIM, so every line of your report card goes green.
Without DMARC, anyone can send email that says it's from you.
Start on monitor, see every service sending as you, then move to quarantine or reject when your own mail passes. Up to 5 domains, free.
Start monitoring freeMore from PlugNApps
Your login already works on these. Nothing new to sign up for.