Your domain can be used to send phishing today, and unless someone is collecting DMARC reports you will never hear about it. MailGuardHQ collects those reports, tells you in plain language what they mean, and walks you to the point where forged mail is rejected outright.
Thirteen checks across DNS, authentication and hardening. No signup, no agent, nothing to install.
Demo data - not a live lookup
This check is not yet wired to real DNS. It replays a fixture so the live checklist can be reviewed before the check service ships (MGH-32). Findings below describe realistic configurations, not this domain's actual records.
Three DNS records decide whether a receiving mail server believes a message really came from you. Most domains have one or two of them, half configured, and no way of telling whether they work.
SPF lists which servers are allowed to send mail using your domain. If a message arrives from somewhere not on the list, SPF says so. Its catch: it is capped at ten DNS lookups, and once you exceed that cap receivers stop evaluating it entirely - silently.
DKIM adds a cryptographic signature to each message you send. A receiver checks the signature against a key published in your DNS. If the message was altered or forged, the seal does not match. Unlike SPF, it survives message forwarding.
DMARC ties the two together and tells receivers what to do when they fail: nothing
(p=none), send it to spam (p=quarantine), or reject it
(p=reject). It also asks receivers to report back - and that reporting
address is what almost everyone leaves out.
Run the free check above. It reads what your domain publishes right now and tells you which of the thirteen items pass, which need attention, and which genuinely do not apply to you.
Point your DMARC reporting address at us. Mail providers worldwide start sending daily reports on every message that claimed to be from your domain. We parse them and show you the senders, not the XML.
Once the reports show your legitimate mail passing, move the policy to quarantine and then reject. We tell you when the evidence says it is safe - and enforcement is never applied automatically without you approving it.
It is the most common finding we see: a domain publishes
v=DMARC1; p=none; and stops there. It looks configured. It reports to
nobody, enforces nothing, and blocks no forgery. The domain owner believes they are
covered.
Adding a reporting address changes nothing about how your mail is delivered - it cannot break anything - and it is the only way to find out what is being sent in your name.
No signup, no credit card, no agent to install. If the result is clean, you have lost a minute. If it is not, you have found something worth knowing.