DMARC record monitoring
DMARC monitoring for the record itself: know when it weakens.
DMARC is the published instruction that tells the world's mail providers to reject fake email sent in your name. DMARC monitoring usually means one of two jobs: reading the reports mail providers send back, or watching the instruction itself. Attack Surface Scan does the second. It re-reads your DMARC policy and the related email spoofing protection on every scheduled check, and alerts the moment any of it is removed, loosened or rewritten, with the before and after side by side.
No card required to start. Plans from $25/month, flat; first report in minutes.
Why DMARC record drift matters
Spoofing protection is only as strong as what is published today. It drifts through ordinary IT work, and nothing in your own email tells you when it does. The cost shows up later, as fake invoices and phishing sent in your name.
Protection quietly switched off
A website migration, a registrar move or a new email vendor rewrites your domain's settings, and DMARC comes back set to monitor only, or not at all. Mail keeps flowing, so nobody notices that fake email in your name is no longer blocked.
Too many email vendors breaks it
Every marketing, billing or support tool that sends as you gets added to your approved sender list. Past a fixed limit, mail providers stop honouring the list at all, while your own email still looks fine from the inside.
Reports going to a dead mailbox
The address that receives DMARC reports points at a vendor you left or an inbox nobody reads. Your visibility has been switched off, and the policy still looks valid.
Inbound mail protection lapses
The setting that makes other companies' mail servers use encryption when delivering to you can drop from enforced to testing, or stop working. It rarely gets a ticket.
How Attack Surface Scan does DMARC monitoring
Every scheduled check re-reads your email protection and compares it with the last check, so a change is an alert with evidence rather than a surprise months later.
Every change, with the before and after
A policy loosened, a sender added, a reporting address changed: each raises a change with the old and new versions side by side. Removed protection is flagged at high importance.
Weak settings called out as findings
Missing protection, a DMARC policy left on monitor only, and a lenient approved sender list each appear as findings with the specific fix, so the gap is on the list even if it never changed.
Inbound mail protection too
For domains that receive email, the protection that keeps delivery to you encrypted is checked as well, and a downgrade from enforced to testing is alerted at high importance.
Alerts where you already look
Urgent changes go out immediately by email, Slack, Teams or webhook; the rest arrive in a weekly digest. Want a check right now? The free DMARC checker runs in your browser.
Every record checked, with its exact fix, is in the email security documentation.
What you can show
Proof the protection held all year
The change history shows your policy stayed enforced, and when it didn't, how quickly it was restored. The compliance views map it to the anti-phishing items in PCI DSS and CIS Controls.
A straight answer for the questionnaire
Insurance applications and vendor questionnaires ask whether your domain is protected against spoofing. A dated report showing an enforced policy answers it.
What this is not: DMARC report analysis
No report processing
Attack Surface Scan does not collect, read or chart the DMARC reports mail providers send you. If you need to see which services send email as your domain and whether they pass, you want a dedicated DMARC report tool. DMARC report tools compared →
The two jobs fit together
A report tool tells you whether your email passes; record monitoring tells you whether the policy you rely on is still published. Many teams run both, sending reports to the report tool while Attack Surface Scan watches the policy. Email authentication explained →
Common questions
What is a DMARC monitoring service?
The term covers two kinds of tool. DMARC report services collect the reports that mail providers send about your domain and show who sends email as you. DMARC record monitoring, which is what Attack Surface Scan does, watches the published policy and related email protection and alerts when they change or weaken. They answer different questions.
Is there free DMARC monitoring?
For a one-off check, yes: the free DMARC checker grades your email protection in your browser. Continuous monitoring is part of Attack Surface Scan's paid plans, from $25/month with a 7-day trial and no card. For report processing, several dedicated tools have free tiers; see the DMARC tools comparison.
Which DMARC tools read aggregate reports?
Dedicated DMARC report platforms do; Attack Surface Scan does not. It monitors the policy itself. The comparison of DMARC monitoring tools covers the report platforms, and Attack Surface Scan sits alongside them.
What changes does the DMARC monitor alert on?
Any change to your DMARC policy or approved sender list (including the reporting address and the policy disappearing), downgrades or removal of inbound mail encryption protection, plus standing findings for missing or monitor-only protection. The full list is in the documentation.
Put your DMARC record under watch.
Verify your domain and your email protection is checked on the first run.
Start your 7-day trialNo card required to start. Cancel any time.