Hosted DMARC and SPF.Enter once.Never change again.
Your domain points once to a zone maintained by Conbool. Policy, permitted senders and report address are managed there from then on.
Why DNS records for email go stale
SPF and DMARC change with every new sending service. DNS is often owned by another team or a service provider.
Every change is a ticket
New senders, a stricter policy, a different report address: every adjustment requires a DNS change.
SPF hits the lookup limit
SPF permits ten DNS lookups. With several sending services the limit is quickly exceeded, and the check fails.
Records disappear unnoticed
A provider change or a zone clean-up removes a record. It is noticed only when delivery suffers.
Many domains, inconsistent state
Every domain carries a different version. An overview of target and actual state is missing.
How delegation works
Two records, set once.
1. DMARC via CNAME
The _dmarc record of your domain points as a CNAME to the zone maintained by Conbool. The policy is managed there.
2. SPF via include
Your SPF record receives an include for Conbool. The permitted senders are collected behind this single reference.
3. Conbool maintains, you keep the zone
The zone stays with you. The delegation can be replaced by your own records at any time.
What DMARC Manager takes over permanently
Available as an add-on to every suite, billed per domain.
Policy without DNS changes
Every level from p=none to p=reject is set at the delegation target.
Senders in one place
Permitted sending sources are managed together. Your SPF record uses a single lookup for them.
Report address stays correct
The tenant report address is part of the maintained record. The analysis never runs empty.
Daily reconciliation
Records that were set are rechecked in DNS every day. A deviation is shown at the domain and in the audit log.
Setup at the provider
If the DNS provider supports Domain Connect, the records are set there after one confirmation.
Traceable changes
Every policy level is recorded with time and reason in the history of the domain.
Delegation and maintenance by hand
What changes with delegation.
Conbool DMARC Manager | Maintenance by hand | |
|---|---|---|
| Changes in DNS | Two records, once | With every adjustment |
| SPF lookup limit | Senders collected behind one include | Grows with every sending service |
| Stricter policy | Set at the delegation target | DNS change per level |
| Lost records | Daily reconciliation, deviation visible | Noticed when delivery suffers |
| Control of the zone | Stays with the customer, delegation removable at any time | Stays with the customer |
| Many domains | Consistent state, one overview | A separate state per domain |
As of October 2026. The right-hand column describes the usual approach without Conbool, not a specific vendor.
Hosted DMARC and SPF FAQ
What does hosted DMARC mean?
Why an include for SPF instead of a CNAME?
Does Conbool control our DNS with this?
Does this work with every DNS provider?
What does the daily reconciliation check?
How is it licensed?
Related solutions
DMARC E-Mail-Authentifizierung
SPF, DKIM und DMARC korrekt ausrichten — Schritt für Schritt zu p=reject.
DMARC Record erstellen
Den DMARC-TXT-Record richtig aufbauen — alle Tags und der sichere Weg zu p=reject.
DMARC-Monitoring
Berichte auswerten und sehen, wer im Namen der Domäne sendet.
DMARC p=reject einführen
In Stufen von p=none zu p=reject, ohne echte Post zu verlieren.
EasyDMARC-Alternative
DMARC-Auswertung aus der EU, ohne US-Cloud und mit Aktivschutz.
dmarcian vs. EasyDMARC
Die gängigen DMARC-Tools im Vergleich — und wo Conbool DMARC steht.
Phishing- & Spoofing-Schutz
DMARC stoppt Domain-Spoofing — kombiniert mit aktiver Phishing-Abwehr.
CEO-Fraud-Schutz
Gefälschte Absenderdomains bei BEC und CEO-Fraud zuverlässig blocken.
DANE und TLSA
DNSSEC-verankerte Transportverschlüsselung als Ergänzung zur DMARC-Authentifizierung.
MTA-STS
Erzwungene TLS-Verschlüsselung für den Transport, ergänzend zu SPF, DKIM und DMARC.
TLS-RPT
Reporting über fehlgeschlagene TLS-Verbindungen, ergänzend zu MTA-STS und DANE.
Conbool MailGuard
Aktiver Inbound-Schutz, der DMARC-Erkenntnisse direkt durchsetzt.
Delegate once, correct permanently.
DMARC Manager is available as an add-on to every suite and is billed per domain.