MX/01DMARC monitoring for MSPs
Stop client emails
from landing in spam.
Most MSPs don't know their clients' emails are failing authentication checks - until the calls start coming in.
For MSP owners and technical directors managing 50-500 client domains.
You're sending emails into a black hole.
Right now, there could be client domains on your watch failing authentication - invoices vanishing into spam, spoofed mail going out under their name - and you'd have no way to know until someone calls.
MXBastion watches every domain you manage - so you catch and fix these problems before anyone notices.
From: mailer-daemon@mx1.google.com To: you@your-company.com Subject: Delivery Status Notification (Failure) --- Below this line is the bounce message --- 550 5.7.1 Unauthenticated email from your-company.com is not accepted due to domain's DMARC policy. DMARC policy: p=none (no enforcement) SPF: FAIL (too many DNS lookups) DKIM: FAIL (signature not found) Alignment: FAIL Action required: Fix your email authentication configuration.
No more 'did you get my email?' calls.
MXBastion monitors authentication on every domain you manage and alerts you the moment something breaks - long before a client notices.
Every client email lands in the inbox
SPF, DKIM, and DMARC all pass. Receiving servers trust the message. Your clients' invoices arrive, their password resets work, and their customers stop asking 'did you send that?'
Continuous monitoring
We check DNS records every 6 hours and process DMARC reports as they arrive. When something drifts, you fix it the same day instead of three weeks later when the client churns.
Proactive issue resolution
When something breaks, you get the exact DNS record to fix it. Paste it at your DNS provider and MXBastion verifies the change within minutes.
From vulnerable to protected in days, not months.
MXBastion walks each client domain to full DMARC enforcement - p=reject - one verified step at a time.
Add Your Domains
Enter your domains and we instantly scan their SPF, DKIM, and DMARC records.
Review Authentication
We collect and analyze your first DMARC aggregate reports to map all legitimate senders.
Tighten Enforcement
Gradually move from p=none to p=reject with guided steps and safety checks at each stage.
Monitor & Protect
Continuous monitoring catches config drift, spoofing attempts, and new sender issues in real time.
DMARC enforcement progression
v=DMARC1; p=noneMonitor only. See what's happening without blocking anything.
v=DMARC1; p=quarantineSuspicious emails go to spam. Legitimate mail still delivers.
v=DMARC1; p=rejectFull protection. Unauthenticated emails are rejected outright.
See your domain health at a glance.
SPF Exceeds 10 Lookup Limit
legacy-app.io has 13 DNS lookups in its SPF record. RFC 7208 limits this to 10.
Domains
+ Add Domainp=reject
Pass
Aligned
Healthy
2 hours agop=quarantine
Pass
Misaligned
Warning
4 hours agop=none
13 lookups
Missing
Critical
1 hour agop=reject
Pass
Aligned
Healthy
30 min agop=quarantine
Pass
Aligned
Healthy
3 hours agop=reject
Pass
Aligned
Healthy
1 hour agoDMARC Aggregate Reports
Alert History
Settings
Notification Channels
Check Frequency
Team
Two plans. Flat monthly price.
Both include SSO and full API access.
For growing MSPs
- Up to 50 domains
- 1M emails/mo
- DMARC, SPF, DKIM monitoring
- Hourly DNS checks
- SSO + API access
For established MSPs
- Up to 150 domains
- 5M emails/mo
- DMARC, SPF, DKIM monitoring
- DNS checks every 15 min
- SSO + API access
Need more than 150 domains? Let's talk.
Stop losing clients to email problems you didn't know existed. Add your domains and see the first scan results in minutes.
every domain scanned continuously · alerts by email, Slack, or webhook
Get startedCommon questions
Most domains reach full DMARC enforcement (p=reject) within 2-4 weeks. The timeline depends on how many third-party senders you have (like marketing platforms, CRMs, or ticketing systems) that need to be authenticated first. MXBastion guides you through each step and gives you the exact DNS records to add.
No. MXBastion works with any DNS provider. You just need to add or update a few DNS TXT records (SPF, DKIM, DMARC) - something you likely already do for your clients. We tell you exactly what records to set and verify they're correct.
MXBastion reads your existing DMARC, SPF, and DKIM records as-is during onboarding. Nothing is overwritten. We analyze your current setup and walk you through improvements step by step.
We currently support alerts via email, Slack, and webhooks - which means you can connect to virtually any PSA or RMM that accepts inbound webhooks or email-based ticket creation. Native integrations with ConnectWise and HaloPSA are on the roadmap.
You can bulk-import domains via CSV or the API. MXBastion instantly scans all records and starts collecting DMARC reports. Most MSPs have their full domain portfolio loaded and initial reports flowing within an hour.
Yes. All plans include full API access. You can automate domain management, pull authentication data, and integrate MXBastion into your existing tooling and workflows.
All plans include email support with a target response time under 4 hours during business hours. We also have documentation and guides for common DMARC scenarios. If you're on the Pro plan, you get priority support.