DMARC monitoring and enforcement
Stop spoofing without stopping your own mail.
Pistos DMARC finds every service that sends as your domain, helps you fix the ones that fail, and shows you when it is safe to block the rest.
Free for one domain and up to 1,000 reported messages a month.
example.com
Last 30 days
72 / 100
Enforcement readiness
3 services send as you but fail authentication. Fix Mailchimp and you can move to quarantine without holding any real mail.
| Sender | Messages | Status |
|---|---|---|
Google Workspace SPF and DKIM pass | 8,410 | Passing |
HubSpot SPF and DKIM pass | 1,180 | Passing |
Mailchimp Sends without DKIM. Add the CNAME. | 3,200 | Needs a fix |
Unknown server 203.0.113.42 Not a service you use | 1,204 | Failing |
The path
Three policy states. One safe order.
Each step is a change to one value in one DNS record. We show you what would happen to real mail before you take it.
Step 1p=noneWe found 14 senders.
Receivers deliver everything and send you reports. Nothing changes for your mail while you learn who sends as you.
Step 2p=quarantine2 senders still fail.
Mail that fails goes to spam. A good first step once your real senders pass, because mistakes are recoverable.
Step 3p=rejectSpoofed mail is blocked.
Receivers refuse mail that claims to be you and fails authentication. This is the goal.
What you get
Everything between p=none and p=reject.
Most teams stop at p=none because the next step feels risky. These are the pieces that make it routine.
Every sender, in plain language
Reports list servers by IP. We name the service behind them, such as your CRM, helpdesk or invoicing tool, and tell you whether it passes.
The exact fix for each failure
For every service that fails, you get the DNS record to add: the SPF include, the DKIM CNAME, or the setting to change in the service.
Policy simulation
Replay your last 30 days of reports against p=quarantine or p=reject and see which real messages would have been held, before you publish.
SPF that stays valid
SPF allows 10 DNS lookups. We count yours, warn before you pass the limit, and flatten the record on paid plans.
Forensic reports
Where receivers send failure samples, we show what failed and why. Not every receiver sends them, so we say so rather than imply coverage.
MTA-STS, TLS-RPT and BIMI
Check that mail to you is encrypted in transit, read TLS reports, and see whether your domain is ready for BIMI.
Alerts when something changes
A new sender appears, a record changes, or your SPF nears its limit. Email or webhook, with the next step in the message.
Built for many domains
MSPs get one view across every client, a portfolio readiness score, and monthly reports their clients can read.
How it starts
One DNS record is the whole setup.
You do not install anything and you do not move your DNS. Add a record that tells mailbox providers where to send reports.
- 1
Add the record
Publish a DMARC record at p=none with your Pistos DMARC address as the report destination. Your mail is not affected.
- 2
Read the senders
Within a day or two, providers start sending reports. We turn them into a list of services and a pass or fail for each.
- 3
Fix what fails
Follow the exact DNS change for each service. We re-check and tell you when it passes.
- 4
Move up when it is safe
When the simulation shows no real mail would be held, change p=none to p=quarantine, then p=reject.
Step 1: the record you publish
v=DMARC1; p=none; rua=mailto:your-id@rua.pistosdmarc.com
Step 4: the same record when it is safe
v=DMARC1; p=reject; rua=mailto:your-id@rua.pistosdmarc.com
Your report address is shown in the app. The values above are examples.
What DMARC is for
DMARC stops one thing, and does it well.
At p=reject, mail that forges your exact domain is refused by receivers that honor DMARC. That protects your customers and partners from messages that look like they came from you.
- Mail forged from your exact domain
- Showing you every service that sends as you
- Meeting the DMARC requirement large mailbox providers set for bulk senders
- Lookalike domains such as examp1e.com
- Mail sent from a hijacked mailbox
- Phishing sent from someone else's domain
Read the longer version: What DMARC does and does not do.
For MSPs
Forty client domains, one screen.
See which clients are at p=none, which are partway and which are enforced. Work the ones that need you, and send each client a report they can read in two minutes.
Portfolio by policy state (example)
- Enforced18 domains
- Quarantine9 domains
- Monitor13 domains
Example data, shown for illustration.
Pricing
Start free. Pay per domain, never per message.
One flat price per domain. No overage fees.
Free
Start here$0
for one domain
Everything you need to see who sends as your domain and get it to enforcement.
- 1 domain
- Up to 1,000 reported messages a month
- Sender catalog in plain language
- Policy simulation before you publish
- SPF, DKIM and DMARC record checks
- Weekly email summary
Per domain
Announced at launch
Flat per domain, per month. No overage fees.
For companies with more domains or more mail. One flat price per domain, no overage fees.
- Everything in Free
- Unlimited reported messages
- Forensic (RUF) report handling
- SPF flattening that stays inside the 10-lookup limit
- MTA-STS, TLS-RPT and BIMI checks
- Change alerts by email and webhook
- History for as long as you stay
MSP
Announced at launch
Flat per client domain, per month. No overage fees.
Run every client from one place, with each client seeing only their own domains.
- Everything in Per domain
- Multi-client view with a portfolio readiness score
- Client-ready monthly reports
- Roles for your team and read-only client access
- Bulk domain onboarding
Questions
Plain answers.
See who sends as your domain.
Start free with one domain. Publish one DNS record and your first sender list is ready once reports arrive.