How DMARC monitoring works

1. You get a private reporting address

When you sign up we allocate you one address at dmarc.hostilereview.com. It covers every domain on your roster, so there is nothing per-domain to configure.

2. You add it to each domain's DMARC record

One TXT record per domain, at _dmarc.yourclient.com. If a record already exists you append to the rua list rather than replacing it, so any existing destination keeps working.

3. Mailbox providers do the rest

Google, Microsoft, Yahoo and a few hundred others already generate an aggregate report for every domain that asks. They mail it to us, we parse it, and you get a table instead of a gzipped XML attachment.

What a report actually tells you

An aggregate report is a count of messages, grouped by sending IP, with the SPF and DKIM result for each group. That is enough to answer the three questions that matter: which servers send mail as this domain, which of them authenticate correctly, and what would happen to the rest under a stricter policy.

Why p=none is not protection

Most domains publish p=none and stop. That tells receivers to deliver failing mail anyway - it turns on reporting without turning on enforcement. The reports are how you get from none to reject without blocking your own invoices: watch until every legitimate sender passes, then tighten.

What we never do

We do not receive your actual mail, we are not in your delivery path, and an outage here cannot affect your email. Aggregate reports contain counts and IPs, not message content.