Stop impersonation. Reach p=reject step by step, with real mail watched at every stage.
ClearDMARC turns thousands of cryptic DMARC reports into a clear path to enforcement. See every source, fix alignment and lock out spoofers with confidence. Every record we publish is already DMARCbis-compliant.
Enter a valid domain, like yourcompany.com.
Lookup failed. We couldn’t check {{ failDomain }}. Try again.
Too many requests. Try again in a minute.
We couldn’t check {{ dnsDomain }} right now. Try again in a minute.
No credit card · 5-minute DNS setup · No mail-flow changes
Example
xmpl.exampleEnforced · p=reject
97.4%
compliant
312,480emails / 30 days
4,210spoof attempts blocked
Sending sources
GGoogle WorkspacePASS · aligned
SSendGridPASS · aligned
?Unknown · 203.0.113.xREJECTED
Built for the teams most targeted by impersonationBanking and financeHealthcareGovernmentSaaS and techMSPsE-commerce
DMARCbis · RFC 9989Standards-Track
DMARC just became an official internet standard. Your records need to change.
In 2025 the IETF advanced DMARC from an experimental spec (RFC 7489) to Standards-Track: DMARCbis. It adds new tags and closes long-standing gaps. ClearDMARC already generates, hosts and upgrades your record for every one of them, automatically.
New tagnp=Non-existent subdomain policy
Reject mail claiming to come from subdomains that don’t even exist. Cheap, safe anti-spoofing that we set to reject by default.
Replaces pctt=yTest mode
A clean, explicit dry run: receivers apply the next-lower policy while you validate. The old pct percentage rollout is gone.
AdvancedpsdPublic suffix and DNS tree walk
Declares your organizational domain boundary so receivers’ new tree-walk algorithm finds the right policy every time.
Your domain is a phishing weapon until you say otherwise.
Without an enforced DMARC policy, anyone can send email as you: to your customers, your staff and your suppliers. Most teams know they need DMARC. The hard part is getting to p=reject without accidentally blocking legitimate mail along the way.
DMARC reports are raw XML, sent by hundreds of mailbox providers, in volumes no human can read. So most domains stall at p=none, collecting data they never act on.
Without enforcement
Spoofed invoices, fake HR notices and brand impersonation land straight in the inbox, looking just like the real thing.
How it works
From blind spot to enforcement in four steps.
No DMARC expertise required. ClearDMARC guides every move and validates it for you.
01
Connect your domain
Add one DNS record. We start receiving DMARC reports within minutes, with zero impact on mail flow.
02
See every sender
We parse the raw reports into a plain-English list of who sends as you: legitimate services and impostors alike.
03
Fix alignment
Guided SPF and DKIM fixes for each source, with copy-paste DNS records and instant validation.
04
Reach enforcement
Move from p=none → quarantine → reject with a safety checklist at every stage. Spoofing blocked, deliverability protected.
DomainScore
Your whole email posture, in one number.
ClearDMARC grades every domain from 0 to 100 across four weighted factors. You know exactly where you stand and what to fix next to reach an A.
{{ scoreValue }}
out of 100
{{ gradeLabel }}
{{ scoreDomain }}
{{ statusLabel }}
{{ scoreNote }}
{{ b.label }}{{ b.score }}
One score, every domain
Roll up your whole portfolio (primary domains, subdomains, parked names) and spot the weakest link instantly.
A clear path to an A
Each factor shows exactly how many points are on the table and what action recovers them.
Tracked over time
Watch the score climb as you fix alignment and advance enforcement. It’s proof of progress for every stakeholder.
The platform
Everything you need to own your email identity.
Aggregate report parsing
Thousands of RUA XML reports collapsed into one readable timeline of pass, fail and forensic detail.
Sender intelligence
Every IP and service auto-classified: known ESP, your infrastructure or an unauthorised impostor.
Guided enforcement
A safe, staged path to p=reject with a readiness score and a checklist before every policy change.
SPF and DKIM management
Flatten SPF under the 10-lookup limit, and surface every DKIM selector’s key age and signing volume.
Real-time threat alerts
Get notified the moment a new unauthorised source starts sending as your domain, by email or Slack.
BIMI and brand logo
Coming soon
Once you hit enforcement, publish your verified logo so it appears beside every email you send.
One clear view
The whole story of your email, in one portal.
Every report, sender and record in one place, explained in plain English.
Overview
Reports at a glance.
Every report from Gmail, Outlook and the rest, added up into five numbers. See how much of your mail passed DMARC, and how much came from someone posing as you.
Mail flow
XMPL Enterprises, last 30 days
Example
Total emails248KAcross 4 domains
Compliant94.1%233.4K emails
Forwarded1.3%3.2K emails
Non-compliant3.2%7.9K emails
Threat1.4%3.5K emails
DMARC results
248Kemails
CompliantPassed DMARC
94.1%233.4K
ForwardedRelayed, or via a provider
1.3%3.2K
Non-compliantYour mail, failing checks
3.2%7.9K
ThreatSomeone posing as you
1.4%3.5K
Reports
Every day, every result.
Mail by day shows what each day brought, by DMARC result. The smaller results get a chart of their own, so a spike in threat mail stands out on a busy day.
Mail by day
248,012 emails in 30 days, by DMARC result
Example
CompliantForwardedNon-compliantThreat
12K8K4K0
The three smaller results, on a larger scale
1.4K0
Oct 6 · 680 threat
Sep 14Sep 21Sep 28Oct 5Oct 12
Sources
Who sends as you.
Every service and server that sends mail as your domain, ranked by volume. See which ones pass DMARC and which still need SPF or DKIM set up.
Top sending sources
Who sends the most mail as xmpl.example
Example
SourceEmailsCounted for DMARC
G
Google Workspace63.8% of all mail
158.2K99.6%
M
Mailchimp16.8% of all mail
41.7K98.4%
S
SendGrid13.3% of all mail
32.9K86.1%
Z
Zendesk3.4% of all mail
8.4K97.0%
203.0.113.48Threat1.4% of all mail
3.5K0.0%
ClearSPF
One SPF record, far fewer lookups.
SPF stops working after 10 DNS lookups, and every service you add costs some. ClearSPF looks your senders up for you and serves one record. We keep it current as your senders change.
What receivers count when they check SPF for xmpl.example
Example
If you listed these 9 senders yourself
14of 10
4 over the limit. SPF would fail for every email you send.
We look them up for you
With ClearSPFLive now
1of 10
One lookup to ClearSPF. We answer with the addresses of all 9 senders.
Lookups each sender needs
Google Workspace 4Microsoft 2Salesforce 2111111
The line marks the limit of 1014 → 1
ClearDMARC and ClearDKIM
Getting to reject.
Move from none to quarantine to reject one step at a time, and see what each step would have done to last month’s mail before you switch. ClearDKIM shows every signing key and how old it is.
98.6% delivered as normal1.4% blocked, all of it threat mail
DKIM keys
SelectorTypeKey age
google._domainkeyTXT2 yr 1 moValid
s1._domainkeyCNAME8 moValid
k1._domainkeyCNAME1 yr 4 moValid
The journey
A guided path, not a guessing game.
Stage 1
p=none
Monitoring only. Collect data and map every source. No mail is ever affected.
Stage 2
p=quarantine
Suspicious mail goes to spam.
Stage 3
p=reject
Full enforcement. Spoofed mail is refused outright. You own your domain.
Prefer a dry run first? Flip on DMARCbis test mode (t=y) at any stage. Receivers apply the next-lower policy while you validate. No more guessing with the old pct percentage.
Designed to take you from monitoring to p=reject, typically in weeks, not years.
The ClearAuth suite
Three managed services. One clean email identity.
Email authentication has three layers. ClearAuth runs each one as a managed service. Use them alone, or together for end-to-end protection.
AuthoriseSignEnforce
ClearSPF
Sender authorisation
Managed SPF under the 10-lookup limit. Confirms every server is authorised, and tells you in the app if the record ever goes over the 10-lookup limit.
Run the full suite and ClearDMARC manages your SPF and DKIM records automatically. There is nothing to maintain by hand.
ClearSPF
One SPF record, kept under the 10-lookup limit.
SPF silently fails once you exceed ten DNS lookups, and every new ESP pushes you closer. ClearSPF flattens all your authorised senders into a single hosted record and keeps it under the limit as your stack changes. It tells you in the app if the record ever goes over the 10-lookup limit. You publish one record and never touch SPF by hand again.
SPF source intelligenceSee the email volume behind every authorised sender. Drop unused includes and catch unexpected senders before they cost you a lookup.
Automatic flatteningIncludes are resolved and compressed server-side to keep the record under the 10-lookup limit.
Follows provider changesWhen a provider changes its sending IPs, your hosted record updates automatically within 4 hours. If the record ever goes over the 10-lookup limit, we tell you in the app.
Low mail-flow riskYou can put your old record back any time.
One-time setup · 3 steps
1Activate ClearSPF in the console
2Replace your SPF record with one TXT record
TXT
Hostyourdomain.com
Valuev=spf1 include:<your ClearSPF host> ~all
Your ClearSPF host is shown in your ClearDMARC dashboard. We verify the record and host it from there
Delegate once · one NS record
1Activate ClearDKIM in the console
2Delegate the _domainkey subdomain (one NS record)
NS
Host_domainkey.yourdomain.com
NS<your ClearDKIM nameserver>
Your nameserver is shown in your ClearDMARC dashboard. Every selector is hosted, with its key age and volume surfaced
ClearDKIM
DKIM that shows you every selector, across every provider.
Weak, stale or unknown DKIM selectors quietly break authentication and tank deliverability. ClearDKIM hosts every selector through one NS delegation and surfaces each one’s key age and signing volume. You always know what’s signing your mail.
Selector source intelligenceSee the key age and email volume behind every selector. Spot stale or rogue keys instantly.
One NS delegationHand over the _domainkey subdomain once. ClearDKIM hosts selectors for Google, Microsoft 365, SendGrid and more.
Continuously monitoredWe alert you the moment a signature starts failing, long before it hurts your inbox placement.
Allstandard aggregate report formats parsed
<10SPF lookups, kept under the limit
24/7continuous report monitoring
5 minDNS setup, zero mail-flow change
From early access
What early teams are telling us.
Feedback from design partners in our early-access programme, shared anonymously.
"We’d stalled at p=none for ages. ClearDMARC finally showed us every sender — and a path to reject we actually trust."
B
Head of IT Security
Regional bank · early access
"The sender list alone paid for itself. We found three shadow-IT services nobody knew were emailing our customers."
H
Security lead
Healthcare provider · early access
"We manage client domains across many tenants — the multi-tenant view is the only way we could do DMARC at this scale."