SentraDMARC

SentraDMARC documentation

SentraDMARC reads the DMARC and TLS reports that mail receivers send about your domain, shows you who is sending as you, and hosts the DNS records behind DMARC, SPF, DKIM, BIMI, MTA-STS and TLS-RPT so you can change them from the dashboard instead of at your registrar.

What it does, and what it does not

  • It shows you who sends as your domain. Receivers such as Google, Microsoft and Yahoo send a daily aggregate report. We group each report's sources into named senders and show which pass SPF, DKIM and DMARC. See Reading your senders.
  • It hosts your records. You add a CNAME once (one TXT for SPF); after that, changes you make in the dashboard are published to our Route 53 zone. See How hosting works.
  • It helps you enforce, one step at a time. Your DMARC policy starts at p=none, which blocks nothing. You raise it rung by rung when the reports show your own senders pass. Nothing is ever blocked unless you choose a stricter policy. See The enforcement ladder.
  • It tells you when something changes. Alerts go to the people who can act on them, by email and in the app. See Alerts.

SentraDMARC does not send or filter your mail and does not sit in your mail flow. Receivers decide what to do with a message; your DMARC policy is what they read. DMARC protects the exact domain in the From address. It does not stop lookalike domains, display-name tricks, or receivers that ignore DMARC.

Where to start

  1. Add your domain: two CNAMEs on Starter, four on Business, then Activate.
  2. Wait for the first reports, usually within a day of mail being sent.
  3. On Business and above, move your SPF and connect DKIM.
  4. Mark your senders on the DMARC page, fix the ones that fail, and climb the ladder.

Security

How we run the service, and how to report a vulnerability, is on the security page. Our contact for security reports is also published at /.well-known/security.txt.