Sender identification
IP addresses become named services and networks, with reverse DNS, network owner and country. Each one is classified so you know what to do with it.
CompliantMisconfiguredForwardedUnknownThreat
DMARC report monitoring
DMARC monitoring that shows who is sending email as you
DMARC Lens collects the DMARC reports mail providers already send about your domains and turns them into a list of named senders, a threat level per domain, and a clear next step towards p=reject. Built for groups that run many domains across several companies.
1 DNS recordto start receiving reports
Every sendernamed, not just an IP address
By companyand by domain, in one account
7 free toolsfor SPF, DKIM, DMARC, ARC, MTA-STS, TLS-RPT and BIMI
What a DMARC analyzer does, and why you need one
When you publish a DMARC record, Google, Microsoft, Yahoo and hundreds of other receivers send you a daily XML report: every IP address that sent mail claiming to be from your domain, how many messages, and whether SPF and DKIM passed. Nobody reads XML. DMARC Lens does, and tells you which of those sources are yours, which are forwarders, and which are someone pretending to be you.
Stop spoofing of your brands
Find the senders that fail authentication and the volume they push, then move your policy from monitoring to quarantine to reject with confidence that your own mail will keep flowing.
Keep your mail deliverable
Google and Yahoo require DMARC for bulk senders. A broken SPF include or an expired DKIM key shows up here before your customers stop receiving your invoices.
One view for the whole group
Each domain belongs to an operating company. Boards see the group, company administrators see their own, and nobody has to merge spreadsheets.
How it works
Nothing changes in your mail flow. DMARC Lens never sees the content of your email, only the reports receivers send about it.
Add your domains
Register each domain under its company and prove you own it with a TXT record. Existing DMARC records are read and kept.
Point reports at DMARC Lens
Add one rua= address to your DMARC record. Reports start arriving within a day; aggregate and failure reports are both understood.
Read named senders, not XML
Every source is resolved, classified and grouped. You approve your own senders and flag threats; the threat level and advice update with each report.
Tighten the policy, get alerted
Follow the per-domain advice to p=reject. Alerts and a weekly digest tell you when something new appears or breaks.
Features
Everything a DMARC monitoring service should do, with the detail that makes the difference on a real estate of domains.
Threat level per domain
Seven days of reports become one word, so a group with eighty domains knows where to look first.
Lowfew unknown senders
Elevatedspoofing seen, all blocked
Highspoofed mail delivered
Criticalat volume, or over 5% of mail
Companies and domains
Reports, pass rates and threat levels roll up by operating company. People see all companies or only theirs. Subdomain traffic counts towards its parent.
DNS health and change history
DMARC, SPF and DKIM are checked through public resolvers, so you see what receivers see. MTA-STS, TLS-RPT and BIMI are checked too. Every change is logged and nameserver disagreements are spotted.
Alerts and weekly digest
New unknown sender, pass-rate drop, DNS record changed, reports stopped, threat level raised, flattened SPF record out of date. In the app and by email.
Failure reports and ARC
Per-message failure (RUF) reports are stored without content. Mail that failed DMARC but was accepted on the strength of an ARC chain is counted separately, so forwarded mail stops looking like an attack.
Policy advice
For each domain, a judgement on whether it is ready for quarantine or reject, based on days of data, pass rate and the senders you have approved.
API and MCP server
Read-only API keys and a Model Context Protocol server with OAuth, so your own scripts or an AI assistant can ask about your domains.
Sign-in your way
Microsoft 365, Google, or an emailed link, chosen per organisation. Every organisation's data is isolated from every other.
Email authentication tools
Included with every account. They read public DNS only and store nothing.
- Check a domainTraffic-light check of DMARC, SPF and DKIM for any domain, registered or not.
- DMARC record builderA wizard that edits your existing record or builds a new one following best practice.
- SPF flattener with drift alertsResolves includes to IP networks, counts DNS lookups against the limit of ten, keeps volatile providers as includes, splits long records, then watches the source and alerts you when providers move.
- ARC chain checkerPaste a message's headers to read its Authenticated Received Chain hop by hop and verify the seals.
- DKIM key generatorCreates a key pair in your browser; the private key never leaves it.
- MTA-STS and TLS reporting wizardsRequire encrypted delivery to your domain and learn when others cannot deliver over TLS.
- BIMI wizardChecks that DMARC is ready and builds the record that puts your logo next to your mail.
Pricing
Simple plans, priced to be an easy decision. Yearly billing costs less, and the first year of a yearly subscription is half price. Prices are in euros before tax.
Basic
€3 / month
€24 a year billed yearly
First year €12- 1 domain
- 1 person
- 20,000 messages a month
- All tools
For one domain you care about.
SMB
€9 / month
€84 a year billed yearly
First year €42- 5 domains
- 2 people
- 100,000 messages a month
- All tools, API and MCP
For a company with a few brands.
Unlimited
€39 / month
€348 a year billed yearly
First year €174- Unlimited domains
- Unlimited people
- Unlimited messages
- All tools, API and MCP
For a group with many companies, or a consultancy looking after clients.
Limits only stop you adding more; nothing you have is removed and no report is ever dropped. Monthly billing is available at €3, €9 and €39.
Frequently asked questions
What is a DMARC aggregate report?
Mail providers such as Google, Microsoft and Yahoo send the owner of a domain a daily XML report listing every IP address that sent mail claiming to be from that domain, how many messages, and whether SPF and DKIM passed. DMARC Lens collects these reports, parses them and turns thousands of rows into a list of named senders.
Do I need to change my mail servers?
No. You add one DNS record, or one address to your existing DMARC record, so reports are sent to DMARC Lens. Mail flow is untouched and DMARC Lens never sees the content of your email.
Can one account cover several companies and brands?
Yes. DMARC Lens was built for a group with several operating companies. Each domain belongs to a company, people see all companies or only some, and reports and threat levels roll up by company and by domain.
What does the SPF flattener do?
An SPF record may cost at most ten DNS lookups; records that include several providers go over and fail. The flattener resolves every include to its IP networks, lets you keep volatile providers as includes, splits long records, and then watches the source record and alerts you when the providers' addresses drift.
What is ARC and why does DMARC Lens check it?
Authenticated Received Chain (RFC 8617) lets mailing lists and forwarders vouch for a message after they have changed it, which otherwise breaks SPF and DKIM. DMARC Lens shows how much of your failing mail was accepted on the strength of an ARC chain, and its ARC checker reads and verifies the chain on any message you paste.
How much does DMARC Lens cost?
Basic is €3 a month for one domain, SMB is €9 a month for five domains, and Unlimited is €39 a month with no limits. Yearly billing costs less, and the first year of a yearly subscription is half price. Prices are before tax.
Where is my data stored?
In the European Union. Reports are stored per organisation and no organisation can see another's. Failure reports keep a message's headers, never its body or its recipient.
Onboarding by invitation
DMARC Lens is bringing its first organisations on board one at a time. Self-service sign-up follows soon.