Features
What each part does, and on which plan
Six parts, all of them on the Starter plan, which covers 1 domain. Pro covers 5 domains for 5.90 EUR a month.
Every row says what a feature is for and which plan has it. A row that names a plan is on that plan and on every plan above it.
Aggregate reports
What mailbox providers report about your mail
Once your DMARC record names your reporting address, Gmail, Outlook and other mailbox providers report on the mail that used your domain, usually once a day each.
A reporting address per domain
Every planEach domain gets its own address at
rep.mailmoni.com. Reports go there, not to a mailbox someone has to read.Each report, read
Every planEvery report is parsed into its records: which server sent the mail, how many messages, and whether SPF, DKIM and DMARC passed. The raw XML is one click further.
Pass rate and trend
Every planThe domain page states how much of your mail passed DMARC and charts it over time, so you see when a change started.
Subdomains
Every planSubdomains that appear in reports show up by themselves. They need no verification and do not count toward your plan's domains.
Forensic reports
Every planWhen a mailbox provider sends a report on a single failed message, we remove the part of each email address before the @, the subject and the body before we store it. You can choose to store these reports in full, or not at all.
History
Every planStarter keeps 30 days of reports. Enterprise keeps 37 months.
See the raw report
What Mailmoni writes
Mailchimp sends this mail under its own domains: DKIM by mcsv.net and SPF for mail74.suw13.rsgsv.net. Neither aligns with example.com, so every message fails DMARC. Turn on custom DKIM and a custom bounce domain for example.com in Mailchimp.
<record>
<row>
<source_ip>198.2.180.74</source_ip>
<count>214</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>example.com</header_from>
</identifiers>
<auth_results>
<dkim>
<domain>mcsv.net</domain>
<result>pass</result>
</dkim>
<spf>
<domain>mail74.suw13.rsgsv.net</domain>
<result>pass</result>
</spf>
</auth_results>
</record>
One record from one aggregate report, and the sentence Mailmoni writes about it. The product writes that sentence. Nobody wrote it for this page.
TLS reports
Whether mail sent to you arrives encrypted
DMARC reports cover the mail you send. TLS reports (TLS-RPT) cover the mail sent to you: whether other mail servers could reach yours over an encrypted connection.
TLS reports beside DMARC reports
Every planThey arrive at the same reporting address and sit beside your DMARC reports. Each failure is named in a sentence, with the number of connections it affected.
MTA-STS check
Every planWe read your MTA-STS record and fetch the policy file that goes with it, so you know whether you ask other servers to insist on encryption.
An alert when connections fail
Every planWhen enough connections to your mail servers fail, you get an alert, so a problem such as an expired certificate does not go unnoticed.
DNS checks
Your records, checked, with the fix written out
We check seven records for every domain: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI. Each finding says what is wrong and what to change.
When the checks run
Every planChecked from once a day on Starter to every 15 minutes on Enterprise, and whenever you press Check now. A new report also starts a check, at most once an hour.
The corrected record
Every planWhen the fix is mechanical, such as a missing reporting address or +all in SPF, we show the corrected record, ready to copy.
SPF lookup count
Every planSPF allows ten DNS lookups, and we count yours through every include. When an include serves a service no report has shown for 30 days, we say how many lookups removing it saves.
DKIM selectors
Every planWhen a report shows a DKIM signature for your domain that passed, we remember its selector and look up its key. If the key disappears from DNS while the selector is still in use, you hear about it.
DNS history
Every planEach change to these records is kept, with what was added and what was removed. Starter shows the last 30 days. Enterprise shows 37 months.
Publish with Cloudflare
Every planConnect a Cloudflare token that can edit your zone's DNS, and the Publish record button writes the record for you. We store the token encrypted.
Sources
Every service that sends as you, by name
A report lists IP addresses. We group them into the services they belong to, such as Microsoft 365, Mailchimp or your own server.
Named sources
Every planWe match an address to a sending service by its address range, its DKIM domain, its host name or its network. Addresses we cannot name are grouped by host name or network.
An explanation for each source
Every planEach source gets a sentence on why its mail passes or fails DMARC, and the change that fixes it, in that service or in your DNS.
Alignment, shown on its own
Every planDMARC passes when SPF or DKIM passes for your own domain, which is called alignment. We show it apart from the plain SPF and DKIM results, which can pass for another company's domain.
Setup guides
Every planStep-by-step guides for sending services such as Google Workspace, Microsoft 365 and Mailchimp, linked from the sources they apply to.
Your own names
Every planRename a source, for example to “Office printer”, when the name we give it means less to you.
Readiness
Every planA stated rule for moving to a stricter policy, with your progress toward it. Its main condition: every source with at least 50 messages or 1 percent of your mail passes DMARC at 98 percent or better over 14 days.
Your own readiness thresholds
ProChange the rule's numbers for a domain, such as the pass rate and the number of days.
Alerts
Hear about a change without signing in
Admins get alerts by email from the start. Every member chooses for themselves whether to get them.
Alerts by email
Every planA new source, a drop in the pass rate, a DNS record changed or broken, a DKIM key gone, reports stopped, TLS failures, readiness reached and a policy change. Forensic reports too, if you turn that alert on. You can turn each one off. On Starter, alerts cover DNS records, DKIM keys and reports that stop, and each member gets at most one alert email a week.
A quiet first week
Every planIn a domain's first week of reports every source is new, so we send no alerts about new sources, drops in the pass rate, TLS failures or forensic reports that week.
Summaries by email
ProEvery Monday morning in your own timezone: each domain's week in a few sentences, and one next step. From the Teams plan up, each member can choose a daily or monthly summary instead.
Chat tools and webhooks
TeamsAlerts go to Slack, Microsoft Teams, Discord, Google Chat, Mattermost or Telegram, or to your own system through a webhook, as well as by email.
Summaries in chat
TeamsA shorter summary in a chat channel, with a link to the dashboard.
Early warnings
TeamsAlerts about a new source or a drop in the pass rate come at half the usual thresholds, so you hear sooner.
Your own thresholds
TeamsChange when an alert fires, such as how far the pass rate must drop, and choose the channels each alert goes to.
Alerts in PagerDuty
EnterpriseAn alert opens an incident in PagerDuty, and the incident resolves when the alert ends.
Summaries for people outside your organization
EnterpriseSend the summary to up to 10 addresses outside your organization, such as a client or an auditor. Each address confirms before we send anything, and every summary has a one-click unsubscribe.
Your data
Your reports, and the ways to take them with you
Every aggregate and TLS report downloads as the file the mailbox provider sent, on every plan, as far back as your history goes.
Raw reports
Every planDownload any aggregate or TLS report as it arrived, as XML or JSON, or the whole email with its headers.
Exports
Every planA date range as a zip of report files, or its records as CSV or NDJSON. We email you a link, which works for 7 days.
Download everything
Every planOne zip with every report we hold for the organization, every record and its settings.
Delete everything
Every planDeleting the organization removes every member's access and refuses report mail at once. We delete its reports, records and settings 30 days later.
Members
Every planAdmins change settings, and viewers read. Starter has 1 member. Enterprise has no member limit.
Two-step sign-in
Every planSign in with a passkey, or add an authenticator app as a second step, with recovery codes for when you lose the device.
API
ProJSON over HTTPS, described by an OpenAPI document: domains, sources, records, reports with their raw files, DNS checks and alerts. Pro can read through the API. From the Teams plan up, the API can also start an export.
Webhooks
TeamsSigned events sent to your own URL, with retries and a delivery log.
Prometheus metrics
TeamsMessage counts and DNS check results in the Prometheus format, for your own graphs.
MCP server
TeamsAn assistant that speaks MCP can read the same data as the API, so you can ask it about your domains.
Report relay
TeamsEach aggregate and TLS report forwarded to a second address after it arrives, so another tool or an archive keeps its own copy. Forensic reports are never forwarded.
Share link
ProA read-only view of one domain for anyone with the link, such as a client or a colleague without an account.
What we do not build
Each of these was weighed and left out, with the reason beside it. Accounts per client for agencies are the one we may still build.
Single sign-on (SSO, SAML)
It serves companies with an identity team. You sign in with a password and a second step, or with a passkey.
Roles beyond admin and viewer
Two roles cover a small team: admins change things, viewers read.
SIEM integrations
The API, webhooks and metrics endpoint feed your own tools instead.
Threat intelligence
We show what mailbox providers report about your domain, and nothing gathered from elsewhere.
Phishing link scanning
That is a mail security product. Aggregate reports hold counts and results, not messages or their links.
A chat assistant inside the product
Every explanation is a written sentence, the same for everyone. The MCP server lets the assistant you already use read your data.
BIMI certificates and trademark services
The DNS check reads your BIMI record and its certificate. Buying a certificate is between you and the company that issues it.
Hosted or flattened SPF
It puts your SPF record on our servers, so your mail would depend on ours. The SPF check counts your lookups and shows which include to remove instead.
Browser reports (CSP, NEL)
They are about websites, not email.
FedRAMP
It is an authorization for selling to the United States government. The service runs in the EU, for businesses.
Private instances
Every customer uses the same service. A separate copy for each would need its own operation and its own price.
Custom service level agreements
Every plan has the same terms for everyone. On a paid plan you get an answer within one business day.
Accounts per client, for agencies
Not yet, and not ruled out. Today one organization holds many domains, and a share link shows a client one domain, read-only.
Starter covers 1 domain and does not expire
Everything on this page is on every plan, except the rows that name a plan.
Sign-up is not open yet.