EU-FIRST DMARC REMEDIATION
p=reject without breaking legitimate email.
Identify every authorised sender, understand why authentication fails, track remediation and verify when enforcement is safe.
EU-hosted · Self-hosted option planned · No charge for spoofed traffic
Report viewers stop too early
Ordinary platforms can show what arrived in aggregate reports. The hard work starts when an administrator has to decide whether a sender is legitimate, broken, unknown or safe to block.
Viewer output
SenderLedger layer
p=reject block legitimate mail?Core workflow
SenderLedger turns aggregate reports into an explainable remediation process that ends with evidence, not guesswork.
01
Group raw report records into understandable sending services.
02
Explain SPF, DKIM and alignment failures in direct technical language.
03
Turn legitimate failures into owned remediation cases with next actions.
04
Use later reports to confirm that changes actually worked.
05
Calculate readiness for quarantine or reject with evidence and confidence.
Differentiators
The product is designed around the work that blocks enforcement: sender ownership, vendor fixes, DNS changes, verification and regression detection.
Do not force administrators to manage a list of anonymous IP addresses. SenderLedger groups reports into logical sender entities with vendor or system name, source IPs, authentication domains, first seen, last seen, message volume, internal owner and authorisation status.
Identification may occasionally require confirmation. SenderLedger should communicate confidence and uncertainty rather than pretending every source is known perfectly.
Each authorised failing sender becomes trackable work. Cases can move through investigating, waiting on vendor, waiting on DNS, ready for verification and resolved.
A case is not healthy merely because someone clicked done. SenderLedger waits for later aggregate reports and confirms that aligned traffic appears consistently.
SenderLedger continuously detects new sending sources, new IPs for known senders, authentication changes, resolved failures returning and unplanned changes introduced by other departments.
Flagship assessment
The safe-to-reject assessment is evidence-based. It lists the authorised senders that would fail, the legitimate volume at risk and the next action required.
Not ready for p=reject
Three authorised senders still fail DMARC. They represent approximately 8,420 legitimate messages over the last 30 days.
For MSPs and MSSPs
Manage customer remediation work without manually inspecting every domain every month. Prioritise risk, assign technicians and report progress without losing tenant separation.
EU sovereignty and deployment
SenderLedger treats sovereignty as operational clarity: where data is processed, how long it is retained, how it can be exported and how it can be deleted.
Planned private access
Reports and application data processed in European infrastructure, with clear subprocessors and configurable retention.
Planned
Operate the full system yourself when policy or procurement requires complete control.
Planned
Run the report collector yourself while the hosted control plane receives only required normalised findings.
No use of customer reports for general AI training.
Complete export and straightforward deletion are product principles.
No difficult cancellation process or forced sales call to leave.
Fair pricing principles
Do not pay more because someone is spoofing your domain. Inactive defensive domains do not consume the plan, and there are no automatic surprise overage bills.
Product guidance is included in paid plans. Human implementation work is priced separately. Cancellation is self-service, and complete data export is a product principle.
For internal IT teams managing several domains.
€49 / month
Monthly billing, excluding VAT
For providers managing customers separately.
€149 / month
Monthly billing, excluding VAT
Short answers for teams evaluating DMARC remediation, deployment, pricing and portability.
A sending domain is a domain that legitimately sends mail or appears in DMARC reporting for mail you own. SenderLedger prices around legitimate active sending domains, not abusive spoofing volume.
Subdomains count when they are actively managed as separate sending identities. Defensive or inactive domains do not consume active-domain allowances.
No. Spoofed, fraudulent and clearly forwarded traffic does not consume the legitimate message allowance.
SenderLedger helps you understand and remediate outbound email authentication. It does not promise inbox placement and does not replace deliverability work.
Not by default. SenderLedger explains what must change and tracks the work. Controlled DNS integrations are planned for customers who explicitly enable them.
Self-hosted and hybrid deployment options are planned. Request early access if this is a requirement for your organisation.
Yes. The MSP plan is designed around customer isolation, portfolio readiness, technician assignments, white-labelled reports and bulk onboarding.
There are no automatic surprise overage bills. A 20% temporary grace allowance applies, and customers are contacted after sustained legitimate usage beyond the plan.
SenderLedger is being built around current DMARC semantics and will document RFC-specific behavior before general availability. Ask about RFC support during early access if this affects your deployment.
Complete export is a product principle. Configuration export is included in Business and MSP plans, with broader portability work planned for early access.
Monitoring shows report results. Remediation turns legitimate failures into owned work, keeps them open, and verifies later reports before enforcement.
p=reject tells receivers to reject unauthenticated mail that fails DMARC. It is the strongest published DMARC policy, but should only be used when legitimate senders are aligned.
Next enforcement decision
Request access and tell us whether you are trying to identify senders, fix authentication failures, manage customers or prepare for p=reject.