Product
From p=none to p=reject, without breaking your mail.
Pistos DMARC reads your DMARC reports, explains them in plain language, and keeps you moving toward enforcement. Here is what each part does.
Sender catalog
Know every service that sends as you.
A DMARC report names a sending server by IP address and says how many messages it sent and whether they passed. That is accurate and hard to read.
Pistos DMARC matches each server to the service behind it, such as your CRM, your helpdesk or your invoicing tool, and groups the volume under one name. Servers we cannot place stay listed as unknown, with the volume and the result, so you can decide what they are.
- Passing
Google Workspace
8,410 messages
- Needs a fix
Mailchimp
3,200 messages
- Failing
203.0.113.42
1,204 messages
Examples use made-up data.
Fixes
Each failure comes with its fix.
When a service sends as you but fails authentication, the cause is almost always one of two things: it is missing from your SPF record, or it is not signing with DKIM for your domain.
We tell you which, and give you the record to publish. When you have added it, we re-check and tell you it passes, so you are not waiting for the next report to find out.
dkim.mcsv.net
Examples use made-up data.
Policy simulation
See what a stricter policy would have done.
Before you change p=none to p=quarantine or p=reject, we replay the last 30 days of reports against the new policy.
The result is a list of real messages that would have been held, grouped by sender, with the reason. If the list is empty, it is safe to move. If it is not, you know exactly which service to fix first.
If you published p=quarantine today
Messages that would pass9,590
Real messages that would be held3,200
Unknown senders that would be held1,204
Fix Mailchimp and the second line drops to 0.
Examples use made-up data.
SPF
Keep SPF inside its 10-lookup limit.
An SPF record may trigger at most 10 DNS lookups. Every include for a service counts, and so do the includes inside those. Go over and SPF returns a permanent error, which means mail can fail.
We count your lookups, show where they come from, and warn before you reach the limit. On paid plans we can flatten the record and keep it current as providers change their servers.
v=spf1 include:_spf.google.com include:servers.mcsv.net include:spf.hubspot.com ~all
Examples use made-up data.
Transport security
MTA-STS, TLS-RPT and BIMI, in the same place.
MTA-STS tells other mail servers to use encrypted connections when sending to you. TLS-RPT sends you reports when they could not. BIMI can show your logo next to your mail in supporting inboxes once your DMARC policy is enforced.
We check each record, tell you what is missing, and read the TLS reports so you see delivery problems that would otherwise go unnoticed.
v=TLSRPTv1; rua=mailto:your-id@rua.pistosdmarc.com
Examples use made-up data.
Readiness score
One number for “is it safe to move?”
The enforcement readiness score combines how much of your mail passes, how many known senders still fail, how much volume comes from unknown servers, and how long the picture has been stable.
Under 60 the gate is dashed slate: keep observing. From 60 to 89 it is dashed amber: close, with fixes outstanding. At 90 and above the gate is solid green: it is safe to move up.
34
Keep observing
72
Fixes outstanding
96
Safe to move
Examples use made-up data.
Alerts
Hear about changes, with the next step attached.
We alert you when a new sender starts using your domain, when your DMARC, SPF or DKIM record changes, when SPF approaches its lookup limit, and when a service that used to pass starts to fail.
Every alert says what happened to real mail and what to do about it. Email and webhook are supported.
New sender: Zendesk
Zendesk sent 212 messages as example.com yesterday for the first time, and all 212 failed DKIM. Add the Zendesk DKIM records to fix it.
Examples use made-up data.
Also included
The parts you would otherwise build yourself.
Aggregate (RUA) reports
Accepted as XML, zip or gzip, from the mailbox providers that send them, and kept for as long as you stay.
Forensic (RUF) reports
Where receivers send them, with the message headers that failed. Personal data is handled as described in our privacy notice.
Weekly summary
A short email: what changed, what still fails and the next step. Nothing to log in for unless you want to.
See who sends as your domain.
Start free with one domain. Publish one DNS record and your first sender list is ready once reports arrive.