Find every sender on your domain.
Get to p=reject without losing one.
Type a domain. The scan reads its public DNS and tells you what the records say about who can send as it — including the senders nobody has inventoried yet.
No account, no email, nothing stored. Public records only.
What the scan checks
- SPF, and its 10-lookup ceiling — the failure that only shows up on some sends, after an ESP is added.
- DKIM across 18 standard selectors — including revoked keys that still count as “configured” in most dashboards.
- DMARC policy and percentage — whether
p=rejectis real or declared and not delivered. - Aggregate reporting — whether anyone can actually see which senders would fail.
- Transport and BIMI — TLS-RPT, MTA-STS mode, and whether the policy is strict enough for a logo.
Sender inventory and enforcement fix
CAD 1,250 — or CAD 450 if you apply the records yourself
Delivered in two business days, as six files:
- Sender inventory — every sending source, with the DNS evidence that proves it exists.
- Verdict sheet — eight checks, pass or fail, one line of consequence each.
- DNS change set — exact type, name, value and TTL for your provider, plus the rollback values.
- Dated enforcement plan —
p=nonewithrua, then quarantine at 25%, then 100%, then reject. - Fourteen-day report read — the count of messages that would have been rejected had the policy already been strict.
- Day-30 attestation — one page you can hand to a security questionnaire, an insurer or a PSP review.
There is no call, and no discovery process. The report is the conversation. Full refund if the change set is not delivered within two business days of intake. Not included: mailbox or ESP administration, a deliverability guarantee, content review, or a monitoring subscription.
Live examples
Real domains, scanned a moment ago — not clients, not mockups:
shopify.com knix.com well.ca artificia.cc
A correct configuration fails nothing. Most do not, and the reason is usually a policy that was set once and never tightened.