Mail Security Command Center

Monitor authentication posture and protect production DNS changes.

← Product Page

Secure every sending domain before attackers abuse it.

Discover email infrastructure, validate SPF/DKIM/DMARC, assess spoofing risk, and manage DNS updates through controlled approvals and rollback.

Read-only scan by default Provider-aware recommendations No blind DMARC enforcement
91/100

Email Security Score

Low risk. Strong authentication coverage with one policy improvement pending.

Open detailed scan →
Managed Domains243 need attention
SPF Health96%1 lookup issue
DKIM Health100%All active
DMARC Enforcement83%4 monitoring only
Suspicious Sources7Last 30 days
Pending Changes2Approval required

Domain risk overview

Prioritized by authentication and policy risk.

example.comMicrosoft 365
SPFDKIMDMARC p=none
91
legacy-mail.netMixed senders
SPF 9/10DKIMDMARC
74
sancore-demo.comGoogle Workspace
SPFDKIMReject
97

DMARC traffic

30-day authentication trend.

HEALTHY
98.7% aligned1.3% failed

Recommended actions

Changes are advisory until reviewed and approved.

HIGH
legacy-mail.net — SPF is near DNS lookup limit9/10 lookups. Review nested includes before adding new services.
MEDIUM
example.com — DMARC still monitoring onlyAll known senders are currently aligned. Consider moving to quarantine after approval.
LOW
2 domains — TLS-RPT not configuredOptional transport-security visibility can be enabled.

Customers

MSP multi-tenant management for domains, contacts, and reporting.

CustomerDomainsPrimary ProviderSecurity ScoreMonthly Report
Acme Holdings4Microsoft 36592Enabled
Northstar Clinic3Google Workspace96Enabled
Legacy Trading2Mixed74Review

Managed Domains

Authentication posture across all customers.

DomainCustomerProviderScoreSPFDKIMDMARCLast Scan
example.comAcme HoldingsMicrosoft 36591PassPassp=noneToday
sancore-demo.comNorthstar ClinicGoogle Workspace97PassPassp=rejectToday
legacy-mail.netLegacy TradingMixed74ReviewPassp=noneYesterday

Security Scanner

Read-only discovery and posture assessment.

Checks included

Production backend execution plan.

MX & provider detectionSPF syntax & lookupsDKIM selectors & keysDMARC syntax & policyAlignment readinessMTA-STSTLS-RPTBIMI readinessCAA & DNSSECSMTP TLSDangling recordsProvider records

Latest Scan — example.com

Demo data illustrating final result presentation.

91 / 100
PASSMX RoutingMicrosoft 365 detected
PASSSPF1/10 DNS lookups
PASSDKIM2 active selectors
REVIEWDMARCMonitoring only
INFOMTA-STSNot detected
PASSTLSModern transport supported

DNS Record Manager

Validate, stage, approve, apply, verify, and roll back production changes.

TypeNameValueTTLValidation
TXT@v=spf1 include:spf.protection.outlook.com -all3600Valid
TXT_dmarcv=DMARC1; p=none; rua=mailto:dmarc@example.com3600Review
MX@example-com.mail.protection.outlook.com3600Valid

DMARC Policy Builder

Generate policy only after sender coverage and alignment are understood.

Enforcement Readiness

Readiness gates before stronger policy.

98%
Known senders covered14/14
SPF coverage100%
DKIM coverage100%
Alignment98%
Recommended: quarantine after administrator approval and DNS snapshot.

DMARC Aggregate Analytics

Source visibility from processed XML reports.

Total Messages184,22130 days
DMARC Pass98.7%181,826
Failures1.3%2,395
Unknown Sources3Needs review
SourceMessagesSPFDKIMAlignmentClassification
Microsoft 365151,880PassPassPassAuthorized
Mailchimp25,991PassPassPassAuthorized
Unknown 185.x.x.x1,826FailFailFailSuspicious

SPF Analyzer

Resolve includes recursively and detect unsafe policies or lookup pressure.

v=spf1 include:spf.protection.outlook.com -all
DNS Lookups1 / 10
Includes1
Policy-all

Detected Issues

Unsafe patterns are blocked from automatic apply.

PASS
Single SPF recordNo duplicate SPF policies found.
PASS
Lookup count within limit1 DNS lookup currently required.
PASS
Hard fail policyUnauthorized sources fail SPF.

DKIM Manager

Selector discovery, signing health, key validation, and alignment checks.

SelectorProviderStatusAlignmentKey HealthAction
selector1Microsoft 365ActivePassHealthy
selector2Microsoft 365ActivePassHealthy

Provider Connections

Use least-privilege API access for read, validate, and approved write operations.

CloudflareDNS zones and recordsConnected
Azure DNSAzure-hosted DNS zonesAvailable
AWS Route 53Hosted zones and recordsAvailable
GoDaddyDomain DNS recordsAvailable
Microsoft 365Tenant and DKIM validationConnected
Google WorkspaceDomain email provider checksAvailable
Generic DNSRead-only resolver + manual exportEnabled

Change Control

Every write follows validation, approval, snapshot, apply, verify, and rollback readiness.

Validate→Preview→Approve→Snapshot→Apply→Verify
DomainChangeRiskRequested ByStatus
example.comDMARC p=none → p=quarantineMEDIUMAdministratorPending Approval
clinic-example.comAdd TLS-RPT TXTLOWSystem RecommendationDraft

Scheduled Monitoring

Detect DNS drift, policy regression, or provider changes.

Daily DNS posture scan24 domains · 08:00
Active
DMARC failure watchAlert when failures exceed threshold
Active
Certificate / TLS checkWeekly
Active

Alert Channels

Production backend notification targets.

ON
Email alertsSecurity and change notifications.
OPTION
WebhookIntegrate with ticketing or SOC workflows.

Professional Reports

Client-ready and audit-ready security evidence.

Domain Security AssessmentAuthentication, DNS hygiene, transport security, findings, and remediation.
DNS Change EvidenceBefore/after records, approvals, API result, propagation verification, rollback reference.
Monthly DMARC Executive SummaryTraffic, pass/fail trend, authorized sources, spoofing indicators, policy readiness.
Customer Portfolio ReportMulti-domain risk ranking, open findings, and SLA status.

Audit Log

Traceable evidence for every scan and configuration action.

Domain scan completedexample.com · score 91/100 · Admin
DMARC change stagedp=none → p=quarantine · Awaiting approval
DNS snapshot createdZone version #128 · rollback ready
Provider connection testedCloudflare · success · least-privilege access verified

Safety Settings

Production guardrails for DNS write operations.

Branding

Customer-facing report and portal identity.

Details