On this page
SentraDMARC doesn’t just monitor your DNS records; it hosts them. Your SPF stays under the lookup limit through automated flattening, the DKIM records your provider issued are published at the selectors it signs with, and policy changes go live without a second trip to your registrar.
What “hosted” means, protocol by protocol
Each protocol is delegated once:
- Five of the six are delegated with a CNAME into our zone: two for MTA-STS, one per selector for DKIM.
- SPF is one TXT at your apex carrying a single
include:, because a domain apex cannot be a CNAME.
Either way, the contents live in our AWS Route 53 zone and keep being served even if our application is down. Why a CNAME in the docs explains the delegation.
How a change reaches receivers
A policy change you approve is written to Route 53. It reaches receivers as their cached copy expires: the record’s TTL is five minutes.
No registrar login.
Why DKIM stays with your provider
Only the server that signs your mail can hold the private key. So we host the public half and grade it; we never claim to rotate it.
Why reporting and hosting are different jobs
Every tool in this category reports: it collects your aggregate reports and tells you what is failing.
What varies is how much of the upkeep moves off your plate once the report has said what is wrong. Is the fix a form in the product, or a ticket to whoever holds your registrar login?
We are not going to characterise other vendors’ products here. They change, and a comparison table nobody dates is worth nothing to you.
What we can state is what this one does.
What SentraDMARC does
| Capability | How it works here |
|---|---|
| The records themselves | Held in our Route 53 zone. You delegate once and change the contents from the dashboard. |
| SPF flattening | Included on Business and above. An hourly job re-resolves your includes and rewrites the record when they change. If the result suddenly shrinks, it holds the record for your review, with an alert. |
| MTA-STS hosting | Included on Business and above. We run the HTTPS policy endpoint; there is no web server for you to stand up. |
| Policy changes | You approve every one, a step at a time, and each step up is offered only when your reports support it. Nothing moves your DMARC policy on a schedule. |
Hosted DMARC and TLS reporting come with every plan; hosted SPF, DKIM, BIMI and MTA-STS with Business and above.
