Frequently asked questions

DMARCPulse is a web-based service for monitoring and analyzing DMARC aggregate reports. It shows you who is sending emails on your behalf and gives you specific recommendations to improve your email authentication.

For anyone who uses their own domain for email — from solo entrepreneurs to large enterprises. Especially useful for IT admins, agencies and companies managing multiple domains.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM. It protects your domain from email spoofing and phishing.

Yes. DMARCPulse has been tested with over 80 million emails and hundreds of domains within a single tenant. The platform stays performant even with large volumes of data. It is built for agencies and enterprises managing many domains and high email volumes in one account.

You have four options. (1) Microsoft 365 — connect via OAuth or, for organisations with stricter consent policies, via App-Only with an Azure AD app registration. (2) Google Gmail — connect via OAuth in two clicks. (3) IMAP — any standard IMAP server (your own, GMX, IONOS, ...) with TLS-encrypted credentials. (4) Hosted Mailbox — receive reports at <alias>@in.dmarcpulse.io without operating your own mailbox at all. Pick whichever fits your setup; you can mix paths across domains.

You only need to publish (or update) a DMARC record so reports get sent somewhere. DMARCPulse generates copy-ready DNS values for SPF, DMARC, BIMI, MTA-STS and TLS-RPT, and supports Domain Connect for one-click DNS setup at supported providers (IONOS, GoDaddy, and others) — no manual DNS editing required.

Yes. DMARCPulse supports direct OAuth integration with Microsoft 365 and Google Gmail — click "Connect", authorize access, and reports are fetched automatically. For Microsoft 365 we also support an App-Only flow (no per-user consent), useful in tightly governed tenants. Microsoft 365 shared mailboxes work too. No IMAP credentials, app passwords or server configuration needed.

Any standard IMAP server with TLS — Gmail, Microsoft 365, self-hosted mail servers, GMX, IONOS, and others. IMAP is one of four ingest options, alongside Microsoft 365 OAuth/App-Only, Google Gmail OAuth, and the Hosted Mailbox. If you don't want to manage a mailbox at all, the Hosted Mailbox is usually the easiest path.

Yes. With shared IMAP accounts you set up the credentials once and assign them to multiple domains. Even simpler: with the Hosted Mailbox you point all your domains' rua= records at one alias ([email protected]); DMARCPulse routes each incoming report to the right domain automatically based on the report itself.

No. ruf reports per RFC 6591 — also called failure or forensic reports — contain personal data from the failed email: recipient addresses, subject lines, and often excerpts of original headers or message content. For exactly that reason most major mail providers (Google, Microsoft, Yahoo, Apple) stopped sending ruf reports years ago, and the in-progress DMARCbis draft (IETF) removes them from the core specification. If a ruf report does arrive at DMARCPulse anyway, we discard it without storing anything, on data-protection grounds. The recommendation engine actively suggests removing the ruf= tag from your DMARC record.

A DMARC-report inbox we run for you at <alias>@in.dmarcpulse.io. Point your rua= record at it and reports flow straight to your DMARCPulse tenant — no IMAP, no OAuth, no mailbox of your own to maintain. We filter DMARC and TLS-RPT attachments and ingest them directly.

Each tenant gets one alias of their choice (letters, digits, hyphens). It must be unique across DMARCPulse, and a small list of reserved names (admin, support, postmaster, ...) is excluded. You can change it later, but anyone still pointing at the old alias will stop sending reports — so pick something stable.

No, intentionally not. ruf reports contain personal data of third parties (recipients, subject lines, header fragments) and we don't want to process them without a data-processing agreement and a clear legal basis. Any ruf message that does arrive is discarded without being stored. See the question above for the full reasoning.

Nothing extra — it's included on every plan that supports it. There's no per-report fee and no volume cap.

Yes — the Base plan includes a 14-day free trial. No credit card required: register, connect a domain and you're monitoring within minutes. Pro and Business are full-featured plans without a trial; if you want to evaluate them, start on Base and upgrade once you're sure.

Yes, upgrades and downgrades are possible at any time. Upgrades take effect immediately. Downgrades take effect at the end of the current billing period.

Your data is stored in the US. The application runs on Fly.io, protected by Cloudflare. All connections are TLS-encrypted.