DMARC report analysis
Finally know who is sending email in your name.
Your domains receive DMARC reports every day that no one can read by eye. Clarsend reads them for you, identifies every sender — your marketing tools, your internal scripts, or someone impersonating you — and alerts you when something changes.
No credit card · one domain monitored end to end · interface in English and French
Your IMAP mailbox
- Providers drop one XML report a day
- You connect the mailbox, nothing to install
Clarsend
- Decompresses and parses the XML
- Enriches every source IP
- Identifies the sending provider
- Evaluates SPF and DKIM alignment
Dashboard
- Failure rates and history per domain
- An alert when a threshold is crossed
The problem
This is what you get today.
A DMARC aggregate report is a compressed XML file, sent once a day by every large mailbox provider that receives mail from your domain. Reading them by hand stops working at the second domain — and it is the only way to know who really sends in your name.
Understand what an aggregate report contains — everything else follows from it.
<record>
<row>
<source_ip>203.0.113.47</source_ip>
<count>1284</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
</record>One excerpt, out of thousands of lines. Who is 203.0.113.47, and why are 1,284 messages failing?
How it works
Connect an IMAP mailbox
The one already receiving your reports. Or upload a file by hand for a one-off check, with nothing to connect.
Clarsend parses and enriches
Every source IP is located and matched to its sending provider, out of 23 recognised natively, with a confidence level.
You look, or you get told
A glance per domain whenever you want, and an alert when a failure threshold is crossed or a domain goes silent.
What you get to see
Per-domain dashboard
Volumes, failure rates and history, domain by domain — the trend matters more than yesterday’s report.
Configurable alerts
Failure threshold crossed, domain silent for N days. Thresholds and cooldown are yours to set.
Sender identification
Every IP matched to its provider, with a confidence level: you can tell your billing tool from a stranger.
DNS health
SPF, DKIM and DMARC checked and explained — not just « invalid », but what is wrong.
Trust
You hand us IMAP credentials. We treat them accordingly.
- One database per organisation — isolation is not a filter in a query.
- Secrets encrypted at rest: IMAP, TOTP, SMTP, channel configuration.
- TOTP two-factor authentication with recovery codes and revocable sessions.
- Audit log of logins and sensitive changes, with IP and device.
- Real GDPR deletion: 30-day grace period, then an actual purge — not a deactivation.
- Timestamped acceptance of contractual documents, with a copy of the accepted text emailed to you.
Where to start
Set up SPF, DKIM and DMARC
The exact records for your provider, in the order that does not break anything.
Someone is spoofing my domain
Confirm the diagnosis in minutes, and what actually stops it.
Choose your policy
From p=none to reject without blocking your own mail on the way.
One domain monitored, free, starting today.
Connect a mailbox, let the first reports arrive, and see who is already sending in your name.