No account · free · takes one minute

Who is sending as you.

Gmail, Yahoo and Microsoft already mail you a report every day listing every address that sent mail claiming to be your domain. Almost nobody reads them, because they arrive as gzipped XML. Give us an address to send them to and we will read them for you.

What you will actually see

Four outcomes, from two bits, and only one of them is ever your problem.

Authenticated as you
SPF and DKIM both aligned. Mail you sent, arriving as you intended.
Forwarded, not forged
SPF failed, DKIM passed. SPF breaks by design when a message is forwarded — the forwarder becomes the sending host. DKIM signs the message and survives. This is a mailing list or an auto-forward, and it is the single largest source of red rows in every other tool.
Sent by you, but nothing signed it
SPF aligned, DKIM did not. Usually a platform where DKIM was never finished.
Nothing proves this came from you
Neither aligned. A sender you forgot, or someone using your domain — the address and the volume tell you which. This is the only row that has ever needed anybody to do anything.

The honest parts

The link is the key. There is no account, so whoever has your results URL can read your results. That is the same trade the one-time message check makes. A report contains sending addresses and message counts — never message content, subjects or recipients — so the thing at risk is a list of your senders, not your mail. If that is not a trade you want, this is not for you and the trade is stated here rather than buried.

Reports take a day to start. Receivers batch them every 24 hours, so the page will be empty until tomorrow. It says so rather than showing you a zero and letting you conclude something is broken.

We keep 60 days. Long enough to see a weekly pattern, short enough that we are not sitting on a year of anyone's sending history.

You can point more than one tool at it. The rua tag takes a comma-separated list. Nothing here asks you to stop using whatever you already have, and if you are testing us against it, that is the correct way to do it.

Not sure whether you publish DMARC at all? Check the domain first — it reads the record live and tells you what the policy currently says.