Support Suomeksi
See prices
Menu

For IT teams

Reach p=reject on a rule you can read

Mailmoni checks one rule for every domain and draws your daily pass rate against it. From the Pro plan up, Mailmoni emails you the next policy to try when a domain meets the rule.

See prices See how it works

Starter covers 1 domain and needs no card. Pro covers 5 domains for 5.90 EUR a month.

example.comReadiness

Not ready yet

2 of 3 sources are ready. Turn on custom DKIM and a custom bounce domain for example.com in Mailchimp.

The rule

Over the last 14 days, every source that sends 1 percent of your mail or 50 messages passes DMARC at 98 percent or more. Unidentified sources that pass DMARC send under 1 percent. The DMARC, SPF and DKIM checks show no problem. Reports arrived on at least 7 days.

14 days agoDaily pass rate against the 98 percent thresholdToday
Example data for example.com. The two days under the line are the days Mailchimp sends.

What goes wrong

What stands between p=none and p=reject

  • Services nobody told you about

    A reject policy asks mailbox providers to refuse mail that fails DMARC. Until you know every service that sends as the domain, you cannot tell whose mail that would be.

  • Reports list addresses, not services

    Each mailbox provider sends its own XML file every day. It lists IP addresses and counts, and leaves you to work out who they are.

  • DNS changes nobody mentions

    Someone edits the SPF record or removes a DKIM key, and nobody hears about it until mail starts to fail.

What Mailmoni shows you

Every source, every record, and the raw files

example.comSources

1 source is unidentified, 0.5 percent of your mail.

Source Messages Passes DMARC Status
Microsoft 365Mailbox provider9,402100 %Fine
MailchimpMarketing platform2700 %Needs attention
ProcountorBusiness tool218100 %Fine
203.0.113.7Single address460 %Unknown

What Mailmoni writes

MailchimpNeeds attention

Turn on custom DKIM and a custom bounce domain for example.com in Mailchimp.

Example data for example.com.

  • Sources, with alignment shown on its own

    Addresses are grouped into services by address range, DKIM domain, host name or network. Alignment is shown apart from the plain SPF and DKIM results, which can pass for another company's domain.

    More about sources

  • Seven DNS checks, with history

    SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI, checked from once a day on Starter to every 15 minutes on Enterprise, and whenever you press Check now. When the fix is mechanical, such as a missing reporting address or +all in SPF, the corrected record comes with it. Every change is kept.

    More about DNS checks

  • The raw reports, and an API from Pro up

    Every aggregate and TLS report downloads as the file the mailbox provider sent. Their records export as CSV or NDJSON. The Pro plan adds a read-only API. The Teams plan adds signed webhooks, Prometheus metrics and an MCP server.

    More about your data

What you do

From p=none to p=reject, one step at a time

  1. Publish p=none with your reporting address

    A domain has only one DMARC record. If yours already has one, the Records page shows it changed to add your reporting address, once our DNS check has read it. Publish the TLS-RPT record beside it, and TLS reports arrive with your DMARC reports.

    Publishing the records

  2. Give it a week or two

    The first report usually arrives within 24 to 48 hours. A full picture takes one to two weeks. Each mailbox provider reports only on the mail it received, so a service that sends once a week shows up once a week.

    When reports arrive

  3. Fix the sources, then step up

    Fix each source that fails, and rename each address Mailmoni cannot identify. When the rule is met, Mailmoni names the next step, and you publish it.

    1. p=none
    2. p=quarantine; pct=25
    3. p=quarantine
    4. p=reject

    After the first report

    The DMARC policy, step by step

Which plan fits

Teams, for the API, webhooks and metrics

Starter covers 1 domain with the default rule. It keeps 30 days of history.

Pro lets you set the rule's numbers for each domain, keeps 13 months of history and adds a read-only API.

Teams adds the full API, webhooks, Prometheus metrics and the MCP server.

Compare the plans

Teams

99 EUR a year

8.25 EUR a month when paid yearly. 9.90 EUR a month when paid monthly.

  • It includes 10 domains. Each extra domain costs 1 EUR a month.
  • It keeps 25 months of history.
  • It has 15 members.

Everything in Pro, and:

  • Alerts also go to Slack, Microsoft Teams, Discord, Google Chat, Mattermost, Telegram or a webhook.
  • A summary by email every day, week or month, as each member chooses.
  • The full API, with webhooks, Prometheus metrics and an MCP server.
  • It checks DNS every hour.

Questions IT teams ask

Can we change the readiness rule?

From the Pro plan up, for each domain: a pass rate from 90 to 100 percent, a window from 7 to 30 days, and how much mail makes a source count. Starter uses the default rule.

Do you need access to our DNS?

No. You publish the records yourself. If the domain's DNS is at Cloudflare, you can connect a token that can edit the zone, and the Publish record button writes them for you. We store the token encrypted.

Where are my reports kept?

On a server in Helsinki, Finland, at Hetzner. Backups go to a storage bucket in the EU. On every plan you can download each aggregate and TLS report in your history as the file the mailbox provider sent.

Start at p=none and read the reports

Starter covers 1 domain and does not expire. Sign-up is not open yet.

See prices