Ramp your domain to p=reject without breaking mail.
Every mailbox provider that receives mail claiming to be you sends a report about it. Our pipeline reads those reports, shows you every sender using your name, and walks your DMARC policy from monitoring to full reject as the data proves it is safe. The stack is self-hosted, and our own domains run on it.
The dashboard below is a worked example with fictional domains and illustrative numbers. The pipeline is real; your data stays yours.
One view of every domain
30 days of authentication, day by day
Day 9 is a new sender coming online before its SPF record landed. Day 19 is a newsletter burst with a misaligned envelope domain. This is exactly the kind of thing the dashboard makes visible before an enforcement step would have eaten the mail.
- msgs/7d
- 2,304
- msgs/30d
- 9,882
- senders
- 17
- reports
- 61
- aligned · 30d
- 98.9%
- msgs/7d
- 1,178
- msgs/30d
- 5,204
- senders
- 12
- reports
- 38
- aligned · 30d
- 95.6%
+ 2 more domains in this example workspace
Every sender, classified
Aggregate reports name every IP that sent mail as your domain. The pipeline groups them into senders and sorts them into authorized, suspicious, and threats, so the spoofing shows up on a list instead of in your customers’ inboxes.
The policy ramp
A daily evaluator advances each domain through none → quarantine pct=10 → pct=100 → reject as health metrics permit, and rolls back if they slip. There is a manual gate before reject: the last step is always a human decision.
Current state · acme.example
14 clean days at pct=10. Next step is reject, which waits for approval.
Evaluation log
| when | before → after | advanced | pass | vol | reason |
|---|---|---|---|---|---|
| 2026-07-20 06:00 | quarantine_10 → quarantine_100 | yes | 99.2% | 9,882 | 14 consecutive days over threshold; volume stable; advancing |
| 2026-07-06 06:00 | quarantine_10 → quarantine_10 | held | 92.1% | 8,987 | pass rate under 98% threshold after newsletter SPF misalignment; holding until clean |
| 2026-06-21 06:00 | none → quarantine_10 | yes | 99.4% | 8,410 | 21 days of monitoring, all known senders aligned; starting enforcement at pct=10 |
| 2026-06-01 06:00 | none → none | - | 98.8% | 7,905 | monitoring window not yet complete |
What actually runs
- Ingest. A mailbox collects aggregate reports from every provider; the pipeline watches it and parses the XML attachments as they arrive.
- Store. Parsed records land in Postgres: every source IP, alignment result, and disposition, per report, per domain.
- See. The dashboard above - rollup, per-domain posture, sender classification, geography, and the full report archive.
- Ramp. The daily evaluator reads the last window of data and moves your DNS policy record itself - forward when it is safe, back when it is not.
- Digest. A weekly PDF lands in your inbox: what changed, who started sending, where the ramp stands.
A one-page domain checker for client conversations - SPF, DKIM, DMARC, MTA-STS, DNSSEC in one report - came out of the same work. All of it runs on our own hardware. Nothing about your mail flow leaves infrastructure we control, and if you'd rather run the same kind of snapshot from an iPhone than watch a dashboard, that's Parallax Recon.