Inspect the policy
Identify explicit or inherited DMARC, SPF dependencies and signing keys. Record the domain, owner and expected systems.
Inspect DMARCKnow your senders.
Decide with evidence.
A DNS check shows today’s policy. DMARC reports show how receivers observed mail using your domain. Bring those signals into a sender inventory, investigate failures and plan enforcement without guessing.
Monitoring onboarding is by request. The free DNS and XML tools work now; this page does not create an account, activate report collection or publish DNS.
Artificial report preview — not live customer traffic
One report. Three sources. Clear questions.
Reserved example domains and documentation IPs. The numbers below come from the downloadable example XML, not an operating monitoring account.
1,000Reported messages
97%Reported aligned pass
30Messages to investigate
3Distinct source IPs
| Source | Messages | Aligned authentication | Next question |
|---|---|---|---|
192.0.2.10 | 820 | SPF and DKIM pass | Is this an approved sender in your inventory? |
198.51.100.20 | 150 | DKIM pass; SPF fail | Is forwarding or a different return-path expected? |
203.0.113.30 | 30 | Both aligned mechanisms fail | Misconfiguration, indirect mail or unauthorized use? |
A workflow, not another score
From DNS to a controlled rollout.
Set the baseline before acting. A reported failure is a reason to investigate, not an automatic instruction to block a sender.
Prepare report receipt
Use a reporting mailbox you control, arrange retention and external authorization, then publish rua. Do not invent a Maail destination before onboarding.
Draft a recordReview sender evidence
Compare source volumes and alignment outcomes with CRM, newsletter, billing and support systems. Separate configuration errors from suspected abuse.
Read an XML reportChange with approval
Resolve legitimate senders, test real messages and keep a rollback record. Never assume a low pct protects you: current DMARC ignores that legacy tag.
Follow the rollout guideConnect mail operations
Maail’s inbound-mail product is the integration path for report-driven workflows. Discuss signed events, retries and purpose-limited state for your environment.
Explore mail automationReview changes over time
New services and forwarding paths change authentication. Agree the review cadence, responsible owners and criteria for policy changes during onboarding.
Plan the operating modelProduct scope, plainly stated
The right service for your stage.
Public diagnostics
DNS inspector, SPF dependency analysis, DKIM lookup, header parser, DMARC generator and one-report XML analysis. Free, no account required.
Open the toolboxMonitoring onboarding
Discuss your domains, reporting volume, sender inventory, report collection and integration requirements. Access, retention, processing location and commercial terms are confirmed before activation.
Request a scoped proposalPortfolio management
Multi-client workspaces, per-domain ownership, change approval, historical trends and alert rules are the next product layer. Hosted SPF flattening and automatic DNS changes are not available here.
Discuss MSP requirementsPrivacy with an operating model
Report data is operational data.
Aggregate XML can contain source IPs, reporting contacts and identifiers. It is not the same as a stateless address lookup. Decide who can view it and how long it should remain.
Confirm before activating monitoring
- Domain ownership and approved report destinations.
- Processing location, access controls and any external enrichment.
- Retention, deletion and duplicate-report handling.
- Sender ownership, alert recipients and change approval.
- Report coverage and missing-report detection, without claiming full traffic visibility.
Maail is operated by XOR Ventures GmbH in Germany. Do not assume public DNS resolver queries stay in the EU; their external processing is disclosed separately.
Read data boundariesBefore you start
Monitoring, without myths.
Does DMARC monitoring block attacks?
Monitoring creates visibility. Enforcement is a policy request evaluated by receiving services; it does not stop lookalike domains, display-name impersonation or compromised accounts. Receiver overrides and indirect mail flows still matter.
When will reports arrive?
Many receivers report daily, but timing and participation vary. A valid rua record is not proof of collection, and no report does not mean no abuse. Verify the mailbox and authorization and observe several reporting cycles.
Can I start with the free tools?
Yes. Inspect your DNS, draft a monitoring record and analyze XML reports from a mailbox you control. Automatic scheduled collection, history and alerting are not activated by running a public lookup.
Is there a fixed price or free monitoring trial?
The public tools are free. Continuous-monitoring access and commercial terms are agreed during onboarding; this page does not advertise an unimplemented checkout, trial or SLA.
Start with your sender landscape.
Tell us how many domains you manage, which systems send mail and where report events should go. We will discuss a concrete monitoring scope.