DMARC Help: Email Trust Monitoring

When one of my customers’ email campaigns failed, I built DMARC Help. It was a private tool that showed my customers how much of their email the big mailbox providers trusted, and who else was sending mail in their name. DMARC was a new technology, and I wanted to see what it could do. I built all of it, starting in 2017, and ran it until 2024. It was never open to the public.

The reports found the cause of that failed campaign. The customer had started sending through a new mailing service, and hadn’t thought it was important enough to mention. The providers didn’t know that service was allowed to send as them, so they distrusted its mail.

Why Email Goes Missing

When you send an email, Gmail, Yahoo, AOL and the rest have to decide whether it really came from you or from someone pretending to be you. Mail that fails their checks can land in the spam folder or be thrown away, and nobody tells you.

DMARC lets the owner of a domain (the part after the @) ask those providers for a daily report on all the mail they saw using it. The reports are written for machines: compressed files, often thousands of lines long, arriving in bulk. Most people don’t want to see them. DMARC Help read the emails automatically and turned them into a short answer.

What It Did

• One number per domain. The My Domains page showed each domain with how much mail it had sent in the last 30 days and the share that passed the providers’ checks. A low number meant some of that mail was being treated as suspicious.
• Who was sending as you. Clicking a domain listed every server that had sent mail using it, color-coded by result, so a server sending in your name without permission stood out.
• Nothing to install. One line added to the domain’s settings sent the reports to DMARC Help, which collected and read them every hour on its own.
• Settings mistakes caught. It recorded the email rules each provider saw on the domain, so you could spot a difference between what you meant to publish and what the world was reading.
• Little kept, not for long. Report details were deleted in stages: the raw reports after a week, and everything after three months.
• Invite-only. The public site was a sign-up page for early access. Accounts were by invitation, and the site worked on phones.

DMARC Help was written in PHP with the Laravel framework and a MySQL database. Some providers’ reports were large, so it read them in memory-safe chunks.

Where It Is Now

I shut DMARC Help down in 2024. By then free tools, such as Cloudflare’s, gave a better analysis of the same reports.