DomainCanary

npx add-mcp 'https://domaincanary.com/mcp'

Email providers send a daily report on mail from your domain

Receivers, meaning the mail servers at Gmail, Outlook, and the rest, send them to the address in your DMARC record. We turn them into a list of senders you can read.

What a receiver sends Illustration

<row>  <source_ip>198.51.100.14</source_ip>  <count>340</count>  <policy_evaluated>    <disposition>none</disposition>    <dkim>fail</dkim>    <spf>fail</spf>  </policy_evaluated></row><row>  <source_ip>192.0.2.10</source_ip>  <count>8412</count>  …

What you see

Sender	Messages	DMARC
Microsoft 365 192.0.2.10 · marked as yours	8,412	pass
Newsletter tool marked as yours	1,236	pass
Invoicing tool marked as yours	212	pass

Illustration Example values.

To Gmail and Outlook, mail from a tool you forgot to set up looks the same as forged mail

Turn on protection before you find those tools, and your own invoices and password resets stop arriving. We find them for you first, in your daily reports.

If you turn protection on todayIllustration

Your invoicing app Sends your invoices. Not set up yet.

Blocked Your customer never gets the invoice

A scammer Pretending to be you

Blocked Your customer never sees the fake

To the email provider, the two look the same. Neither one is set up, so both are blocked.

With us, you turn protection on after you set up your tools. We find them first, so the fake gets blocked and your invoices keep arriving.

Half of the top million domains with a valid DMARC record still have protection turned off (p=none). DMARC Census, Oct 2026

We time each step from your reports. You approve it, and we publish it.

1. You mark which senders are yours

   Your reports list the servers that send as your domain. You mark the ones you use. v=DMARC1; p=noneReports coming in every day

2. We propose the next step

   When your last 4 weeks of reports show few enough failing messages from senders you haven't marked, we email you the exact record. v=DMARC1; p=quarantineProposed to you by email

3. You approve it, and we publish it

   You approve from a link in the email. With hosted DMARC, there's no DNS edit on your side. v=DMARC1; p=quarantinePublished through hosted DMARC

4. We watch reports after the step

   We compare each new report with the ones from before the step. Then we propose the next one, up to p=reject. v=DMARC1; p=quarantineWatching reports after the step

If a step starts blocking your own email, we put the previous policy back

We check each daily report during the watch after a step. If we roll back, we email you what we saw.

Rollback comes with hosted DMARC, on the Starter plan and up.

How rollback works

• It needs hosted DMARC, because we can only put back a record we serve.
• We roll back only during the report watch after a step. The usual watch is 3 days. We set it from how fast your domain's own reports arrived after earlier changes. We watch a step into reject for at least 3 days.
• We roll back when a sender you marked as yours has at least 20 messages at one receiver, and 20 points more of them are quarantined or refused than before the step.
• Receivers send reports about once a day. We act on the report that shows the problem.
• If someone edits the record during the watch and we then need to roll back, we keep their edit, pause guided enforcement and email you.
• We can't bring back mail a receiver already refused.
• After the watch ends, if a new sender starts failing, we send you a same-day alert. Your policy stays where it is.

Your invoicing tool Mail refused at one receiver

The day 2 report shows 31% of 212 messages refused. We put p=quarantine back and email you.Illustration

A digest every Monday, and an alert the day a report shows a new sender failing

The digest lists each sender and whether its mail passed. When a report shows a new sender failing, we email you that day.

The digest comes with every plan. Same-day alerts come with the Starter plan and up.

A real Monday digest, for an example domain with example numbers.

Every client's domains in one place, with the worst first

Group each client's domains, share a read-only report with your name on it, and give each technician the groups they manage.

DomainCanary for MSPs

Clients Worst first

Client	Policy	Failing
Harborview Dental Studio harborviewdentalstudio.com p=none	p=none	1,284
Kestrel Hall Legal kestrelhalllegal.com p=quarantine	p=quarantine	212
Quillmoor Logistics quillmoorlogistics.com p=none	p=none	96
Alder Finch Accounting alderfinchaccounting.com p=reject	p=reject	18
Birchway Clinic birchwayclinic.com p=reject	p=reject	0

Failing messages this weekIllustration

Client names and domains are made up for this illustration.

Plans priced by the number of domains

Guided enforcement, hosted DMARC, and rollback come with the Starter plan and up. On the free plan, we watch 1 domain with the Monday digest and sender grading.

Free

For watching one domain

$0

Free for as long as you like

• 1 domain
• The Monday digest
• Every sender graded pass or fail
• Step-by-step proposals you publish yourself
• Report detail kept 90 days

Starter

For one company's domains

$19 /month

or $190 a year

• 3 domains, then $5 each
• Hosted DMARC: we publish each step and put it back if it blocks your email
• Same-day sender alerts
• Report detail kept 12 months Create your account

Business

For companies with several brands

$49 /month

or $490 a year

• 10 domains, then $5 each
• Everything in the Starter plan
• Hosted SPF and hosted MTA-STS
• TLS-RPT failures by mail server
• Cleanup checks on every include and selector
• One digest across all your domains
• Client groups with scoped access
• Report detail kept 24 months

Portfolio

For MSPs and agencies

$79 /month

or $790 a year

• 25 domains, then $4 each
• Everything in the Business plan
• Your company name on client digests
• Report detail kept 24 months
• $3.16 a domain with all 25 in use

Enterprise starts at 100 domains, from $399 a month, with SSO and billing by invoice.

Try every feature of the Business plan free for 30 days, no credit card needed. Pay yearly and 2 months are free.

Before you add the record

Will adding a DMARC record break my email?

No. Your first record uses p=none. With it, you get reports, and receivers handle your mail the same as before.

What if I don't have a DMARC record yet?

We give you one to publish. It starts at p=none, so you get reports while nothing changes. Run the free check to see what your domain publishes today.

What if I already have a DMARC record?

You keep your policy. We read the record you publish and give it back with our reporting address added, so your policy and any reporting addresses you already have stay the same. You publish it in place of the old record, because receivers ignore DMARC when a domain publishes two records.

How long until my domain is fully protected?

Usually a few weeks. We need 14 days of reports before the first step, then we wait for new reports after each step before we propose the next one.

What happens if a step blocks my own email?

With hosted DMARC, we watch reports after each step. The usual watch is 3 days. We set it from how fast your domain's own reports arrived after earlier changes. We watch a step into reject for at least 3 days. We look at each sender you marked as yours with at least 20 messages at one receiver. If 20 points more of its messages are quarantined or refused than before the step, we put the previous policy back and email you. We can't bring back mail a receiver already refused.

Is there a free plan?

Yes. The free plan covers 1 domain with the Monday digest and every sender graded, and it has no end date. Guided enforcement, hosted DMARC, and rollback come with the Starter plan and up.

What do you do with my report data?

We turn it into your digest, alerts, and dashboard. Aggregate reports list sending servers and message counts, not message content. We share it only with the service providers our privacy policy lists, which we need to run the product.

Start by checking your domain

See the DMARC policy your domain publishes today and what a forger can do with it.

The check is free and needs no account.