DMARC monitoring

DMARC monitoring shows you every source sending email as your domain — your own mail, your SaaS tools, and anyone spoofing you — and whether each one passes SPF and DKIM alignment. You publish one DNS record; we collect the reports mailbox providers send back and turn the XML into something readable.

Adding a domain

You can do this two ways. Both produce the same result.

From the dashboard — go to DMARC monitoring, choose Add domain, enter the domain, and copy the DNS record it shows you.

From your own code — one API call returns the record to publish:

curl -X POST https://api.tryverifyemail.com/v1/dmarc/domains \
  -H "Authorization: Bearer sk_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

The response carries a dns_records array with the exact TXT record — host, type and value — so there is no second call to fetch it. See the DMARC monitoring API for the full endpoint set.

Publishing the DNS record

Add the TXT record exactly as given, at the host shown (usually _dmarc.yourdomain.com).

Two cases, and we detect which one applies before generating anything:

• No DMARC record yet — you get a monitoring-only starter (p=none). It asks providers to report, not to act, so adding it cannot affect your mail delivery.
• You already have a DMARC record — you get your existing record with our reporting address merged into its rua= list, and every policy tag you set (p, pct, sp, adkim, aspf) left exactly as it was.

Checking it worked

Re-check from the dashboard, or POST /v1/dmarc/domains/{id}/verify. A domain moves through three states:

State	Meaning
pending	Our reporting address isn’t visible in your DNS yet. Check the record, and allow for DNS propagation.
waiting	DNS is correct. No reports have arrived yet — normal for the first day or two.
receiving	Reports are flowing. Monitoring is live.

Reports are not instant

Mailbox providers send DMARC aggregate reports on their own schedule, typically once every 24 hours. A domain sitting at waiting for a day is expected, not a misconfiguration.

Moving to enforcement

Monitoring is the first step. Once the reports show your legitimate senders passing alignment, you can tighten your policy from p=none to p=quarantine and then p=reject — which is what actually stops spoofed mail being delivered. The dashboard flags when your alignment looks healthy enough to move, and warns which senders would start failing if you did.