Sign in (opens in a new tab)Sign up (opens in a new tab)
21 checks on one domain

Find out your email is broken before your customers do

We check your SPF, DKIM and DMARC every ten minutes. When a record changes, a certificate nears expiry, or one of your sending IPs lands on a blocklist, you hear it from us rather than from a customer whose mail stopped arriving

Start free (opens in a new tab)Features
RUA•Watcher email security dashboard
21
checks run on every domain you add
120
blocklists we track for addresses and domains
10 min
between one check and the next, around the clock
365 days
of report history you can look back through
What gets checked

Everything that decides whether your mail arrives

Twenty one checks across DNS, mail transport and the web side of your domain. The mail and DNS ones repeat every ten minutes, three of the web ones every six hours, and the last three run when you open the page. Each tells you what is wrong and which record to change, not just that something failed

Your mail authenticates, and stays that way

SPF, DKIM and DMARC are read the way a receiver reads them. When alignment breaks after a vendor changes something, you learn which record moved and when

  • MX and the delivery path
  • SPF, DKIM and DMARC alignment
  • Change detection on every record
The MX check for a monitored domain, showing port 25 and port 587 reachable on the mail host, MTA-STS in enforce mode, TLS-RPT enabled and DANE reported as not configured
The SPF check counting three of the ten DNS lookups RFC 7208 permits, with the four domains the include chain visited listed underneath

SPF stops failing quietly

Include chains are expanded and counted against the ten lookup limit in RFC 7208. You see which vendor spends your budget before receivers start answering PermError

  • Full include expansion
  • Lookup budget per source
  • A warning before the limit, not after

The rest of the chain holds too

DNSSEC, DANE, MTA-STS, TLS and BIMI run on the same schedule, so a quiet break in one of them does not sit there until someone thinks to look

  • DNSSEC chain validation
  • DANE and MTA-STS policy
  • TLS on every mail host
The BIMI readiness score at 80%, with DMARC enforcement, the logo URL and logo validation at full marks and the VMC certificate scoring 0 of 20

See what your domain looks like from outside

One domain, no card, the full check set. Within ten minutes you will know whether your authentication holds and whether any of your sending IPs sits on a blocklist

Our pricing plansContact sales

Reaching p=reject without losing real mail

Enforcement is where domains break. You see which sources still fail alignment and how much they send, so you can fix them before the policy starts rejecting mail people wanted

See who sends as you

Every source using your domain appears in the reports, authorized or not, with the volume behind it.

Reports arrive encrypted

Report mail is accepted over TLS, and raw aggregate messages are deleted 90 days after they are parsed.

A silent edit does not stay silent

Records are compared with their previous state on every run, so a change nobody told you about surfaces in minutes.

Every DMARC report your domain receives is parsed and kept, and you can look back 365 days to compare this week against last quarter
GDPR READY
What the reports tell you

DMARC reports you can actually read

Raw XML from every receiver becomes sources, volumes and pass rates, so you can tell a forwarder apart from somebody spoofing you without opening a single attachment

No XML to open

Reports from every receiver land in one table you can sort and filter

Every sender named

Each sending IP mapped to who owns it and how much it sends for you

Alerts worth reading

Two failing runs in a row before we write, so a blip stays a blip

A path to enforcement

See what a stricter policy would have rejected before you publish it

Email security analytics dashboard

FAQ

Clear answers to common questions about DMARC monitoring, SPF protection, and managing your email domain reputation

Receivers send you a report about every message that claimed to be from your domain, and we turn that XML into a list of sources with the volume behind each one. You can see who is sending as you, decide which of them is legitimate, and move to p=reject once the rest are gone. The reports arrive on the receiver schedule, usually daily.

Blocklists are checked once a day and you get a report by email naming every list that was checked and its status, with one link through to that domain page. The removal links live on that page rather than in the message, one per list you are actually on, pointing at that list own removal page where it publishes one. Email is the only channel we send to. A daily report rather than a per-event alert is deliberate here, because listings change slowly and one message per listing would be noise.

Yes. Our SPF auditor expands include chains, resolves mechanisms, and flags when you are approaching or exceeding the lookup limit. You also get optimization suggestions that help prevent SPF authentication failures.

In most cases, no. RUA•Watcher works at the DNS level, so you usually only need to add or update relevant records like DMARC and SPF. Once these records are in place, reports automatically flow into our system for analysis.

MTA STS helps ensure that mail transfer between servers uses TLS encryption. We monitor your policy availability and certificate validity, so you can reduce the risk of man-in-the-middle attacks and prevent silent downgrades in transport security.

Start with one domain

We built RUA•Watcher for our own mail and run it against our own domains every day. The free plan covers one domain and needs no card

Check my domain (opens in a new tab)See pricing