Guide
How to get from your domain’s grade to mail that nobody can forge. You always start from the dashboard.
From start to finish
1
Add your domain
On the dashboard, in the “Monitor another domain” box, type the domain you use for mail. The first check starts at once and reads public DNS records only: it sends no messages and does not connect to your servers.
2
Read the grade
Every domain has a grade from A to F and a sentence that says what is missing. “Open the full report” shows each finding with its explanation.
3
Follow the fix plan
Under the domain you find the steps in the order they have to be done, with the DNS records to publish where they can be worked out. “Write the instructions for my providers” asks an AI model to reword them for whoever runs your mail and your DNS: you get a number of them each month, by plan.
4
Check again
After each change press “Check again now”: the grade updates and the steps you did show as closed. After that the check carries on by itself and writes to you only when something changes.
What is behind the grade
The grade sums up the checks below. A is the best, F the worst. DMARC is to be raised one level at a time (monitoring, quarantine, reject), watching the reports: taking it straight to “reject” risks blocking legitimate mail too.
DMARC
The policy that tells receiving servers what to do with mail that uses your domain without authorisation. Until it is enforced, that mail is delivered.
SPF
The list of servers allowed to send your mail. We verify that it is valid, stays within the limits of the standard and authorises no more than necessary.
DKIM
The signature that makes your mail tamper-proof. We look for the published keys and flag those that are weak, revoked or never switched on.
Lookalike domains
Variants of your domain — one character off, another extension — that someone has already registered, and whether they can receive mail.
Transport
MTA-STS, TLS-RPT, DNSSEC and BIMI: protection for mail in transit and for the integrity of your records.
Lookalike domains
These are names almost identical to yours, already registered by someone else: a different character, a missing or swapped letter, another extension, even together (like “yourdomain.co” for “yourdomain.it”).
We order them by risk: first those with mail servers (they can receive and send), then those with a website, then those that are only registered. Each name has a risk with its reasons and its registration data: registrar, date, abuse contact.
“It’s mine” puts a name you registered yourself among your own and leaves it out of the alerts. “Ignore” takes it off the list. “Watch it” adds a name you fear, even if it is not registered yet: we tell you when it becomes so.
How many you follow depends on your plan; the others stay saved, hidden, the most dangerous first. We do not contact registrars or anyone else: the data is for you to decide whether, and to whom, to report.
Checks and alerts
SPF, DKIM and DMARC are checked again at least once a week. The search for lookalike domains has its own pace, which you choose for each domain among those your plan allows.
We write to you only when something changes: a weakened DMARC policy, a changed SPF or MX record, a new lookalike domain or one that gained mail servers.
To stop the alerts of a domain use “Pause”, or the link at the bottom of every alert e-mail.
Your account
Your plan decides how many domains you follow, how many lookalikes for each, how often we look for them and how many AI plans you can ask for each month. You compare them on the Pricing page.
From the dashboard you can sign out of every device, withdraw your consent to marketing messages and delete the account with its data.
If you lose the phone with the authenticator app, write to us: we do the recovery by hand.