Questions people ask
On every plan
Short answers to the questions people ask most, before and after they sign up. Where a page has the detail, the answer links it. If your question is not here, ask support.
Product
What does Mailmoni do?
It reads the reports that mailbox providers such as Google and Microsoft send about mail from your domain. It names each service that sends email as your domain, and says in a sentence whether that mail passes DMARC, and why. It also reads TLS reports, checks your domain's DNS records and emails you when something changes. How it works shows each step.
Does it stop spam or phishing that comes into our inbox?
No. Mailmoni watches the mail sent in your domain's name, not the mail you receive, and it filters no inbox. It helps you reach p=reject. With that policy, mailbox providers refuse mail that uses your domain without your permission, which protects the people you send email to.
Do we have to change how we send email?
No. You publish one DMARC record with p=none and your reporting address, or add the address to the record you already have. p=none blocks nothing, so mail is delivered as before. You tighten the policy later, once you know who sends as you.
We already use another DMARC service. Can we run both?
Yes. A DMARC record can send reports to more than one address. When your domain already has a record, the record we suggest keeps every address in it and adds yours beside them. Both services then get the same reports.
How soon will we see something?
Google and Microsoft send one report a day. The first usually arrives 24 to 48 hours after you publish the record, and we email every admin when it does. If nothing has come after 72 hours, see what to check.
Do reports arrive before the domain is verified?
Yes. We accept reports as soon as your DMARC record points at your reporting address. That record also proves the domain is yours, so the domain is usually verified before the first report lands. Verification turns on the scheduled DNS checks, the alerts and the summaries.
Which DNS records do you check, and how often?
DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT and BIMI. Starter checks them every 24 hours, Pro every 6 hours, Teams every hour and Enterprise every 15 minutes. A report that arrives also starts a check, at most every hour. Check now on the domain's DNS tab checks at once, and works again after 1 minute.
Can you set up DMARC for us, or fix what the reports show?
We can publish the records for you if your DNS is at Cloudflare. You give us an API token with Zone / DNS / Edit for that zone, under Settings › Cloudflare. The Records tab then writes the DMARC and TLS-RPT records. We keep the token encrypted, and disconnecting deletes it. With any other DNS host, you, your IT contact or the agency that built your site copies the name and value we show.
We do not sign in to your sending services. For each source that fails, its Explanation says what to change in that service, and the guide under Playbooks shows the steps.
Our DNS is at a Finnish web host or a registrar. Where do we add the record?
At the company that runs your domain's DNS. That is usually your web host or email provider, such as Zoner, Louhi, Elisa or Telia, or the company you bought the domain from. Open its DNS or zone settings and add a TXT record with the name and value we show. If the form adds your domain to the name by itself, enter only the part before your domain, such as _dmarc. It works the same at every DNS host, and we recognize mail sent through Zoner, Louhi, Elisa and Telia by name.
Do subdomains count as domains?
No. A subdomain such as news.example.com is added under its domain when it appears in a report. It needs no verification and does not count toward your plan. Subdomains are added this way up to 100 per domain, and a report for a new one beyond that is refused.
Which sending services do you recognize?
We know 67 by name today, from Google Workspace and Microsoft 365 to Mailchimp, Visma Netvisor and Procountor. We recognize them by their published SPF ranges, their DKIM signatures, reverse DNS and their networks. Mail we cannot match to a service is grouped by its reverse DNS name or its network, and you can name it yourself.
Can I name a source myself?
Yes, if you are an admin. The name you give is shown in place of the one we work out, on that domain and its subdomains. A named source is kept until you remove the name or delete its domain.
What does it mean when a domain is ready?
It means the domain meets a stated rule for moving to a stricter policy. The rule looks at the last 14 days, and at least 7 days of them must have reports. It counts each source with a message count of 50 or more, or with 1 percent or more of your mail. Each of those passes DMARC at 98 percent or better. Sources we cannot identify, other than plain spoofing, send less than 1 percent of your mail. Your DMARC, SPF and DKIM checks show no error. From Pro up, an admin can change these thresholds on the Readiness page.
Do you store forensic reports?
Yes, with the part of each address before the @, display names, the subject and the message body removed, and the original deleted. An admin can store them in full instead, or not at all, under Settings › Organization. Most mailbox providers do not send them, Google and Microsoft among them.
Can colleagues, or our IT contractor, see the same domains?
Yes, as members of your organization. Starter has 1 member, Pro 3 members, Teams 15 members, and Enterprise has no limit. On Starter, a second person such as your IT contractor or accountant needs a plan from Pro up. A viewer reads every screen, and an admin also changes things. From Pro up, a read-only share link shows a domain's overview, sources and DNS to someone without an account.
Where can alerts go?
Email, on every plan. From Teams up, also Slack, Microsoft Teams, Discord, Google Chat, Mattermost, Telegram and webhooks. Enterprise adds PagerDuty.
Is there an API?
Yes, from Pro up: a read-only API with 60 requests an hour per token and 3 tokens on Pro. Teams allows 600 requests an hour and 25 tokens, and Enterprise 3,000 requests an hour and 100 tokens. From Teams up, the API can also start exports. Webhooks start at Teams. Prometheus metrics start at Teams, and the MCP server for assistants at Teams. The API pages have the details.
Which languages does Mailmoni speak?
English and Finnish. Each person chooses the language of their pages and emails under Settings › Profile. Chat channels, summaries to people outside the organization and share links use the organization's default language.
What happens to our data if Mailmoni stops?
We tell you by email at least 90 days before, as the terms promise, so you can export your data. You can download every raw report and export your data at any time, without asking us. From Teams up, the relay also sends a copy of each aggregate and TLS report to an address you choose.
Plans and billing
Is Starter a trial?
No. Starter does not expire, and it never asks for a card. It has 1 domain and 30 days of history.
What do the plans cost?
Starter costs nothing. Pro costs 5.90 EUR a month or 59 EUR a year, and Teams 9.90 EUR or 99 EUR. Enterprise starts at 19.90 EUR a month or 199 EUR a year. Prices exclude VAT. The pricing page lists what each plan includes.
What counts as a domain, and what does another one cost?
Each domain you add, such as example.com, counts once, and its subdomains do not count. Starter has 1 domain. Pro includes 5 domains, Teams 10 domains and Enterprise 25 domains. On a paid plan, each further domain costs 1 EUR a month, or 10 EUR a year on a yearly plan.
Is there a trial of the paid plans?
No. A paid plan is billed from the day it starts. Starter costs nothing and does not expire, so you can start there.
How do I cancel?
An admin cancels under Settings › Plan and billing, in Change or cancel. A paid plan stays until the end of the period you paid for, and you can undo the cancellation until then. After that, the step down begins. While a payment is failing, pay it first. Cancel a paid plan has each step.
What happens when we move to a lower plan?
What the lower plan does not include stops that day. For 14 days, every domain and member stays, with the history of the plan you left. Then the lower plan's limits apply. Domains above them are archived and stop taking reports, members above them lose access, and older history is deleted. An admin can choose which domain and which member to keep. Without a choice, we keep the oldest verified domain and the longest-standing admin. We email the admins 3 days before the grace period ends.
Do you refund?
Not for the unused part of a period when you cancel. Deleting your organization also ends a paid plan at once, with no refund. If we charged you by mistake, or a fault on our side kept Mailmoni from working during a period you paid for, we refund that period in full. The payment terms say how soon to write to us.
Is there a limit on messages?
No. No plan caps the number of messages in your reports.
How fast does support answer?
Within one business day on a paid plan, and as soon as we can on Starter. We answer by email, in English or Finnish.
Who answers support when the person behind Mailmoni is away?
One person builds Mailmoni and answers the support mail. The response times are the ones above, which the support page promises. Reports, DNS checks and alerts run on their own, and do not wait for anyone to read mail.
Buying a plan
Can I sign up now?
Accounts are made on request. Write to support and ask for one, and we answer by email. There is no waiting list to join. Once sign-up is open, every page offers Start free, and Starter needs no card.
How do I move to a paid plan, and how do I pay?
An admin buys one under Settings › Plan and billing. Choose the plan and monthly or yearly payments, give the billing details, check the bill with VAT, and pay by card on Mollie's page. Your domains, members and reports stay, and there is no second sign-up. Buy a paid plan has each step.
What will a plan cost with VAT, and where are the invoices?
Prices exclude VAT. We add Finnish VAT when your business is in Finland. A business in another EU country can buy only with a VAT number that VIES confirms, and then pays no VAT. Outside the EU there is no VAT. The checkout shows the bill with VAT before you pay. Each payment's invoice goes by email to the billing email, and admins find every invoice under Settings › Plan and billing. Invoices, credit notes and VAT has the detail.
Is there a discount for associations, non-profits or schools?
No. Every organization pays the same prices. Starter costs nothing, has 1 domain and does not expire.
Can we switch from monthly to yearly billing later?
Yes. An admin selects Switch to yearly under Settings › Plan and billing. The switch takes effect at the next renewal, and you can undo it until then. Nothing is charged or refunded when you switch. Monthly or yearly has the detail.
Is there phone support, or only email?
Only email. Write to the support address, or use the form on the support page. We answer in English or Finnish, and there is no phone line.
Privacy and data
Where is our data?
On a server at Hetzner in Helsinki, Finland. Reports arrive by email directly at that server. Backups are encrypted on the server before they leave it, and are stored with Cloudflare in the EU. The security page says how the data is protected.
Do you need access to our email accounts or mailboxes?
No. We never sign in to your mailboxes or your email service. You publish a DNS record, and mailbox providers send their reports to your reporting address, which is ours. The only access you can give us is a Cloudflare token that edits DNS records, if you want us to publish the records for you.
Can you see the content of our emails?
No. Aggregate and TLS reports hold domain names, IP addresses, counts and the results of the checks, never a message. Forensic reports are about single failed messages, and most mailbox providers do not send them. By default we remove the part of each address before the @, display names, the subject and the body, and delete the original. An admin can choose to keep them in full, and then we store each one as the mailbox provider sent it.
Do you sign a data processing agreement?
The terms and the privacy policy describe how we process report data. The privacy policy names the one case where we process data on your behalf: forensic reports, which can contain email addresses. For those reports you are the controller. If your organization needs a separate data processing agreement, write to support.
How long do you keep reports?
Starter keeps 30 days of history, Pro 13 months, Teams 25 months and Enterprise 37 months. Daily totals and sources are kept 30 days longer, so charts do not stop short. DNS change history is kept 13 months on every plan.
Can I download the raw reports?
Yes, on every plan. Each aggregate and TLS report downloads as the file the mailbox provider sent, and as the email it came in. A date range downloads as a zip of report files, or as records in CSV or NDJSON. An export's download link works for 7 days.
Can we take everything with us?
Yes. Under Settings › Data and privacy, an admin downloads one zip with the organization, its domains, every raw report we still hold, every record and the DNS values we have seen. Secrets and channel addresses are left out. Each member can also download their own personal data under Settings › Profile.
How do I delete everything?
An admin opens Settings › Data and privacy, signs in again and types the organization's name. Access, report intake, stored credentials and a paid plan end at once. The data is purged within 30 days. Copies in the encrypted backups normally rotate out within a further 30 days, and the privacy policy says how long each kind of backup is kept. Invoices and billing records are kept as Finnish bookkeeping law requires. Treat deletion as final, and download anything you want to keep first.
Who else handles our data?
Hetzner runs the server. Cloudflare carries DNS and the connection between your browser and our server, and stores the encrypted backups. Zoho sends our email and hosts our support mailbox. Payments go through a payment company. The privacy policy names it and every other company that handles your data, with its country.
Do you use analytics or trackers?
No analytics and no advertising trackers. The only third-party script is Cloudflare Turnstile, on the sign-up and password reset forms, which checks that a person is filling them in. The public pages set no cookies.
Is two-step sign-in available?
Yes, for everyone, under Settings › Security: an authenticator app, recovery codes and passkeys. You can also sign in with a passkey alone. An organization cannot require it of its members.
DMARC basics
What is DMARC?
A DNS record that tells mailbox providers what to do with mail that claims to come from your domain but fails both SPF and DKIM for it, and where to send reports about that mail. What is DMARC? explains it from the start.
What do p=none, quarantine and reject do?
p=none delivers mail as if there were no DMARC, and asks for reports. p=quarantine asks mailbox providers to put failing mail in spam. p=reject asks them to refuse it. We suggest going one step at a time: from none to quarantine for part of your mail, then for all of it, then to reject. The DMARC policy guide explains each step.
What does "aligned" mean?
SPF or DKIM is aligned when the domain it passed for is your From domain or, in the default relaxed mode, belongs to the same organizational domain. DMARC passes when at least one of SPF or DKIM passes and is aligned. How SPF, DKIM and DMARC fit together explains the three side by side.
Why does SPF pass but DMARC fail?
Usually because SPF passed for the sending service's own bounce domain, which is not yours, so it does not count for DMARC. Turn on custom DKIM, or a custom bounce domain, in that service. The source's Explanation names the service and the domain SPF passed for.
Do I need DKIM if SPF passes?
Set it up. DMARC passes when either SPF or DKIM passes and is aligned, so mail with SPF alone passes today. It fails once someone forwards it, because forwarding breaks SPF and DKIM survives it. Without DKIM, forwarded mail fails DMARC.
What is a TLS report?
A daily report on whether other mail servers could encrypt their connections to yours. You get them by publishing a TLS-RPT record at _smtp._tls under your domain, pointing at your reporting address. The Records tab builds it.
Troubleshooting
No report has arrived after 72 hours. What do I check?
On the domain's DNS tab, check that _dmarc has exactly one record and that its rua holds your reporting address. A domain that sent no mail to Google or Microsoft on a given day gets no report from them for that day. If the record is right and nothing comes, write to support with the domain name.
The domain does not verify. What now?
Publishing the DMARC record with your reporting address verifies the domain. So does a TXT record at _mailmoni-verify under your domain, with the exact value we show. Many DNS hosts add your domain to the name themselves, so enter only _mailmoni-verify there. We check in the background every 15 minutes for 7 days after you add the domain. After that, press Check now on the domain's Home tab. If your DMARC record sends reports elsewhere, the tab shows the record to publish in its place.
SPF says too many DNS lookups. What do I do?
SPF allows 10 lookups, and we warn from 8 lookups. The DNS tab shows the include tree and what each include costs. Remove includes that no source uses, and use DKIM where the service offers it.
An alert I expected did not come. Why?
Each member gets at most one alert email a week on Starter, one alert email a day on Pro, one alert email an hour on Teams and one alert email an hour on Enterprise. Starter also covers fewer kinds of alert than the paid plans. Some alerts stay quiet for the first 7 days after a domain's first report. A problem that cleared before its email went out is not emailed. Viewers start with alert email off, and can turn it on under Settings › Notifications.
No summary arrived. Why?
Starter has no summaries. From Pro up, a summary needs at least one verified domain. You choose how often it comes under Settings › Notifications, from the cadences your plan includes: daily, on Mondays or on the first day of the month. That page also shows when the next one is due. A summary that fails to send is not resent for that period.
Forwarded mail fails DMARC. Is that a problem?
Usually not. Forwarding breaks SPF, and mailing lists that change the message break DKIM. The source's Explanation says when this is the cause. If your own services pass, there is nothing to fix.
Our webhook endpoint was turned off. Why?
We turn an endpoint off when every delivery to it has failed for 3 days, and we email the admins. Events from while it was off are not sent. Fix the receiver, then turn the endpoint back on under Settings › Developer.
Published 27 October 2026 · Checked 2 November 2026