DMARC monitoring and enforcement up to p=reject. Only you send in your name.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record under _dmarc of your domain. DMARC protects your domain against spoofing, meaning forged senders. It tells receiving mail systems how to treat mail whose sender is not confirmed by SPF or DKIM, and where to send their reports.

p=none only observes, nothing is rejected. p=quarantine sends unverified mail to the recipient's spam folder. p=reject refuses it. Only p=reject effectively protects your domain against forgery.

Aggregate reports (rua) are daily XML reports that mail providers send to the address in your DMARC record. They show per sending source how many messages passed SPF and DKIM. Conbool ingests them instead of delivering them to a mailbox.

Forensic reports (ruf) contain the headers of individual failed messages. Not every provider sends them. Where they arrive, Conbool analyses them including header data, data-minimised and only inside your tenant.

Each level needs at least 14 observed days, 100 mails and 98% on every single day. From p=none to p=reject there are two steps, so at least about four weeks. Domains with many sending services often need longer.

When all three conditions are met at the same time. The weakest day counts, not the average: thirteen good days and one day at 50% average 96%, yet on that one day half of the mail would have been lost. Levels are never skipped.

With automation switched on, DMARC Manager steps the policy back one level as soon as a day drops below 90%. The threshold is deliberately lower than for raising, so a domain does not flip between two levels every day.

A verified email domain in the tenant and a DMARC record that names the tenant's report address. The wizard shows the record, sets it at the DNS provider via Domain Connect where possible and checks it live in DNS.

Yes. Reports come from the receiving mail systems, regardless of where your mailboxes are. Conbool DMARC therefore works with Microsoft 365, Google Workspace, Exchange and any other mail system, and with every DNS provider.

Yes. A DMARC record may carry several report addresses. During setup your existing address is kept and Conbool is added. You can compare both analyses before you switch.

By the server address and its name in DNS. A catalogue of more than 100 known sending services, such as Microsoft 365, Google, Mailchimp or Brevo, assigns sources automatically. Unknown servers with notable volume are flagged as a warning.

SPF allows at most ten DNS lookups. With several sending services the limit is quickly exceeded and SPF fails. Conbool reports this as a critical recommendation. DMARC Manager keeps all permitted senders behind a single include.

Conbool queries your DMARC record every 30 minutes. If it gets weaker, for example from p=reject to p=none, deleted, with a lower pct or with exempted subdomains, a critical finding is created and an email goes to the configured recipients.

Yes. Unused domains are popular for forgery precisely because nobody watches them. For them: SPF without permitted senders and DMARC with p=reject. Conbool flags domains without mail traffic so you can secure or remove them.

Retention can be set per tenant between 30 and 365 days, the default is 90 days. After that, entries are deleted automatically.

Reading requires the permission dmarcreports.view, granted to Owner, Security Admin, Mail Admin and Auditor. Configuration changes require dmarcreports.manage.

DMARC Reports analyses and recommends. DMARC Manager acts: it raises the policy in levels, steps back automatically when delivery drops, maintains DMARC and SPF via delegation and compares target and actual daily.

DMARC Reports is included in every Conbool suite at no extra charge, with no billing by report volume. DMARC Manager is an add-on to every suite and is billed per domain, not per mailbox.

Yes. The Conbool DMARC check tests DMARC, SPF, DKIM, MTA-STS and TLS-RPT without sign-up and gives a grade from A to E. Nothing is stored.