What is DMARC and why does my domain need it?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS protocol that tells inbox providers what to do when an email fails SPF or DKIM checks. Without DMARC, anyone can send emails pretending to be your domain, leading to phishing attacks and deliverability problems. As of 2024, Google and Yahoo require DMARC for bulk email senders.

What is the difference between SPF, DKIM, and DMARC?

SPF (Sender Policy Framework) lists which mail servers can send email for your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature proving the email was not tampered with in transit. DMARC ties them together with a policy telling receivers how to handle messages that fail SPF or DKIM checks, and sends you reports about authentication results.

How does Inbox Insignia monitor email authentication?

Inbox Insignia runs scheduled DNS scans to verify SPF, DKIM, and DMARC configurations, with weekly posture checks on Starter and daily posture checks on Growth and above. Growth includes hourly drift detection, while Agency and above include 15-minute drift detection. It produces a 0-100 compliance score, detects unauthorized changes, identifies unknown senders using your domain, and alerts you through plan-supported channels with step-by-step fix instructions.

Do you offer a free trial?

Yes. Starter and Growth include a 14-day free trial with no credit card required. Starter starts at $39/month for up to 3 domains, Growth starts at $129/month for up to 25 domains with DMARC report analysis and hourly drift detection, and larger Agency Plus, Enterprise, and Enterprise Plus tiers remain visible on the pricing page with sales-assisted checkout.

What is a compliance score?

The Inbox Insignia compliance score is a transparent 0-100 rating that measures how well your domain's email authentication is configured. It checks SPF, DKIM, and DMARC records against industry best practices and deducts points for errors (misconfigured records) and warnings (suboptimal settings). A score of 80+ means your domain passes compliance checks.

What is email authentication drift detection?

Drift detection monitors your DNS authentication records for unexpected changes. If someone modifies your SPF, DKIM, or DMARC records — whether accidentally or maliciously — Inbox Insignia detects the change and alerts you immediately. This prevents email deliverability issues and security gaps before they affect your users.

Continuous monitoring for email trust

Continuous SPF, DKIM, and DMARC monitoring for every domain you send from

Inbox Insignia helps IT, security, and email operations teams detect DNS drift, verify sender coverage, and fix authentication issues before they become delivery problems or spoofing risk.

Start free trial Try the free domain scanner

No credit card required • Scan your first domain in minutes • Guided remediation included

Built for teams responsible for email trust

Continuous monitoringDrift detectionSender visibilityGuided remediation

See the workflow, not just the marketing

A live posture view built for teams that have to act on changes.

This sample workspace shows how Inbox Insignia brings protection status, active issues, and recent changes into one view so teams can catch drift early and act with confidence.

Sample workspace

acmehealth.com

98 / 100

Protected

SPF, DKIM, and DMARC are aligned across approved senders with no open action-required issues.

notices.acmehealth.com

91 / 100

Needs attention

Unexpected SPF drift was detected recently, with the highest-priority fix already surfaced for review.

mail.finservelabs.io

96 / 100

Improving

Core records are valid, sender visibility is active, and the next recommended action is already queued.

Spot issues quickly

See domain posture, open issues, and recent changes in one operator view.

Fix what matters first

Recommended actions explain the issue, the risk, and the record or workflow that needs attention.

Verify the fix worked

Rescan after updates and confirm posture improvement with a clear before-and-after workflow.

How scoring works

The protection score is a 0-100 breakdown that explains what is reducing posture first. It reflects configuration and coverage, not plan entitlements.

SPF

25 points

Measures whether sender authorization exists and stays healthy.

DKIM

25 points

Measures whether message signing is present and valid.

DMARC

30 points

Measures policy, alignment, and enforcement strength.

Monitoring and coverage

20 points

Measures sender visibility, monitoring coverage, and follow-through.

Scores explain why a domain is protected, improving, or needs attention so teams know what to fix first.

What it is

Email authentication is not a one-time DNS project

SPF, DKIM, and DMARC records change over time. New senders get added. DNS settings drift. Ownership gets fragmented. Inbox Insignia turns email authentication into an ongoing operational workflow so teams can monitor posture continuously, catch changes early, and fix issues with confidence.

Continuous monitoring

Keep watching posture after setup instead of relying on one-off checks.

DNS drift detection

Catch record changes, regressions, and ownership gaps before they snowball.

Guided remediation

See what changed, why it matters, and what to fix next without guesswork.

Who it is for

Built for teams that own email trust

Whether you manage one domain or hundreds, Inbox Insignia helps you keep authentication healthy, explainable, and easier to operate.

IT and infrastructure teams

Monitor authentication posture, catch DNS changes early, and keep records aligned across internal systems and external sending platforms.

Security and compliance teams

Reduce spoofing risk, improve visibility into authentication posture, and maintain cleaner evidence around changes and remediation.

MSPs and agencies

Standardize monitoring across client domains, detect drift faster, and turn email authentication work into a repeatable operational service.

How it works

From first scan to ongoing protection

Step 01

Add and verify your domain

Start with a baseline scan and confirm domain ownership.

Step 02

See what exists, what changed, and what needs attention

Review SPF, DKIM, and DMARC posture, recent changes, sender coverage, and recommended fixes.

Step 03

Fix issues and keep monitoring

Use guided remediation, rescan after updates, and stay ahead of future DNS drift.

Why Inbox Insignia

Why teams choose Inbox Insignia

Built for continuous monitoring

Most problems appear after setup, when records drift or new senders are added.

Guided remediation, not just raw DNS output

See what changed, why it matters, and what to update next.

Sender-aware visibility

Understand expected authentication coverage across the services that send on your behalf.

Operational workflows for real ownership

Work from alerts, evidence, notes, and monitoring surfaces designed for ongoing responsibility.

Free tools

Start with the free tools

Scan a domain, validate records, or generate common configurations before you ever create an account.

Explore free tools

Domain Health Scanner

Run a fast SPF, DKIM, DMARC, and MX posture check with a clear score and fix guidance.

Try the free domain scanner

Record Checkers

Inspect individual DMARC, SPF, and DKIM records when you need a targeted answer.

Explore the checkers

Record Generators

Generate common email-authentication records before you touch DNS.

Explore the generators

Turn email authentication into an ongoing workflow

Stop relying on one-time checks and scattered DNS knowledge. Monitor posture continuously, catch drift early, and fix issues faster with Inbox Insignia.

Start free trial Try the free domain scanner

Continuous SPF, DKIM, and DMARC monitoring for every domain you send from

Inbox Insignia helps IT, security, and email operations teams detect DNS drift, verify sender coverage, and fix authentication issues before they become delivery problems or spoofing risk.

No credit card required • Scan your first domain in minutes • Guided remediation included