Compliance and mailbox-provider requirements
What the large mailbox providers require of senders, what the security standards say, and how SentraDMARC helps you show it.
Mailbox-provider requirements
- Google and Yahoo (from February 2024) require senders of roughly 5,000 or more messages a day to their users to authenticate with SPF and DKIM, publish a DMARC record (at least
p=none), align the From domain with SPF or DKIM, support one-click unsubscribe (RFC 8058) for marketing mail, and keep spam complaints low. Every sender needs SPF or DKIM. - Microsoft (from May 2025) applies similar requirements to high-volume senders to its consumer domains: Outlook.com, Hotmail.com and Live.com.
PCI DSS v4.0
Requirement 5.4.1, in force since 31 March 2025, asks for processes and automated mechanisms to detect and protect personnel against phishing attacks. Its guidance gives anti-spoofing controls such as DMARC, SPF and DKIM as examples of such mechanisms. It does not mandate DMARC by name; a DMARC policy at enforcement is one of the ways to meet it, alongside other controls.
What SentraDMARC gives you
- Evidence of what your mail did. DMARC reports are stored for your plan's history window and exportable as CSV or as the original XML. See Exports.
- A record of every policy change, including overrides, in the DMARC page's policy history.
- Alerts when something breaks. If DMARC reports stop arriving for a week, a hosted record stops pointing at us, a held SPF update needs review, an MTA-STS certificate nears expiry, or a sender starts failing after a policy change, the owner and admins are emailed, at most once a day per domain. Each type can be muted per person in Settings → Notifications, except the billing alerts to the owner. See Alerts.
- Client reports on the Agency plan; see For agencies.
Our own security
How we run the service, what is in place and what is not yet, is on the security page. Report a vulnerability through the contact in security.txt.