DMARC monitoring
DMARC monitoring: see every service sending as your domain
DMARC monitoring collects the reports mailbox providers send about your domain and turns them into a list of who is sending as you and whether their mail passes. That list tells you what to fix before you enforce a policy, and what changed afterwards.
By Ahmet Karaca · Updated
What DMARC monitoring is
Once your DMARC record has a rua tag, mailbox providers that send reports mail a summary of the traffic they saw from your domain to that address, usually once a day. Each report is a compressed XML file listing sending IP addresses, message counts and SPF and DKIM results. One file is readable by hand, and the free DMARC report analyzer reads one for you. A daily stream from several providers is what monitoring takes over.
Monitoring matters most before enforcement. A p=reject policy blocks mail that fails DMARC, including mail from a legitimate service you forgot about. Reports are how you find those services first.
How to start
- Create an account and add your domain. Patchkit gives it its own report address on
patchkit.email. - Add that address to the
ruatag of your DMARC record. The setup screen shows your current record with the address added and keeps any report addresses you already have. - Publish the record at your DNS host. Patchkit never edits your DNS.
- Wait for the first reports, which providers usually send about once a day.
No DMARC record yet? The DMARC record generator writes one, and a p=none policy changes nothing about how your mail is delivered.
What you see
Each report is parsed into rows, and Patchkit works out who each sender is: first by matching the DKIM signing domain against a catalog of known email services, then from the reverse DNS name of the sending IP. Senders are grouped as authorized, misconfigured, forwarders or unknown, so you can tell which services need a fix and which traffic is not yours.
What you get alerted on
- A DMARC or SPF record is removed or changed.
- SPF goes over its DNS lookup limit.
- A new unknown sender appears.
- A known sender's alignment drops.
- Reports stop arriving.
Alerts appear in your dashboard on every plan, and a weekly summary email recaps the week. Instant alert emails start at Starter.
From p=none to p=reject
The dashboard tracks your current policy and shows when your legitimate mail passes reliably enough to move to the next stage, together with the record for that step. The p=reject setup wizard starts at Pro. The p=reject migration guide explains the rollout whichever tool you use.
What it costs
- Free: 1 domain, 14 days of report history.
- Starter ($9/mo): 3 domains, 90 days of report history.
- Pro ($29/mo): 15 domains, 365 days of report history.
- Agency ($79/mo): 75 domains, 365 days of report history.
The pricing page lists what each plan includes. The free checkers don't need an account and don't count towards a plan.
Frequently asked questions
+Is DMARC monitoring free?
A free account covers 1 domain with 14 days of report history, alerts in your dashboard and a weekly summary email once you confirm your address.
+Does monitoring change how my email is delivered?
No. Monitoring only adds a report address to your DMARC record. Delivery depends on the policy you publish, and Patchkit never edits your DNS.
+Can Patchkit read my email?
No. Aggregate reports describe mail sent using your domain: IP addresses, message counts, domains and authentication results. They contain no message content and no recipient addresses, and Patchkit does not ask for or process DMARC failure reports.
+Can I keep my current report address?
Yes. A DMARC record can list more than one report address, and the setup screen keeps the ones you already have.