p=reject without breaking legitimate email.
Identify every authorised sender, understand why authentication fails, track remediation and verify when enforcement is safe.
EU-hosted · Self-hosted option planned · No charge for spoofed traffic
Report viewers stop too early
Ordinary platforms can show what arrived in aggregate reports. The hard work starts when an administrator has to decide whether a sender is legitimate, broken, unknown or safe to block.
Viewer output
SenderLedger layer
p=reject block legitimate mail?Core workflow
SenderLedger turns aggregate reports into an explainable remediation process that ends with evidence, not guesswork.
01
Group raw report records into understandable sending services.
02
Explain SPF, DKIM and alignment failures in direct technical language.
03
Turn legitimate failures into owned remediation cases with next actions.
04
Use later reports to confirm that changes actually worked.
05
Calculate readiness for quarantine or reject with evidence and confidence.
Differentiators
The product is designed around the work that blocks enforcement: sender ownership, vendor fixes, DNS changes, verification and regression detection.
Do not force administrators to manage a list of anonymous IP addresses. SenderLedger groups reports into logical sender entities with vendor or system name, source IPs, authentication domains, first seen, last seen, message volume, internal owner and authorisation status.
Identification may occasionally require confirmation. SenderLedger should communicate confidence and uncertainty rather than pretending every source is known perfectly.
Each authorised failing sender becomes trackable work. Cases can move through investigating, waiting on vendor, waiting on DNS, ready for verification and resolved.
A case is not healthy merely because someone clicked done. SenderLedger waits for later aggregate reports and confirms that aligned traffic appears consistently.
SenderLedger continuously detects new sending sources, new IPs for known senders, authentication changes, resolved failures returning and unplanned changes introduced by other departments.
Flagship assessment
The safe-to-reject assessment is evidence-based. It lists the authorised senders that would fail, the legitimate volume at risk and the next action required.
Not ready for p=reject
Three authorised senders still fail DMARC. They represent approximately 8,420 legitimate messages over the last 30 days.
For MSPs and MSSPs
Manage customer remediation work without manually inspecting every domain every month. Prioritise risk, assign technicians and report progress without losing tenant separation.
Deployment and data handling
Operational clarity over promises: where data is processed, how long it is retained, how it can be exported and how it can be deleted.
Planned private access
Reports and application data processed in European infrastructure, with clear subprocessors and configurable retention.
Planned
Operate the full system yourself when policy or procurement requires complete control.
Planned
Run the report collector yourself while the hosted control plane receives only required normalised findings.
No use of customer reports for general AI training.
Complete export and straightforward deletion are product principles.
No difficult cancellation process or forced sales call to leave.
Fair pricing principles
Do not pay more because someone is spoofing your domain. Inactive defensive domains do not consume the plan, and there are no automatic surprise overage bills.
Product guidance is included in paid plans. Human implementation work is priced separately. Cancellation is self-service, and complete data export is a product principle.
Community
Free forever
Free DMARC monitoring for one domain — see every sender using your domain and what is failing. No card, no call.
Software
From $49 / month
Self-serve remediation you run yourself — cases, verification, safe-to-reject.
Guided to p=reject
Let's talk
MSP portfolios and Safe-to-Reject engagements — we drive enforcement with you.
Short answers for teams evaluating DMARC remediation, deployment, pricing and portability.
Yes. Community is free and the Software plan is self-serve at $49/month — cancel any time. The MSP and done-with-you options are the ones set up on a call, because they involve us doing the work alongside you.
Because the right price depends on your setup — how many domains you have, how many systems send email for you, and how far along you already are. We would rather understand that on a short call and give you an honest number than publish one that is wrong for most people. If you would rather run it yourself, the Software plan is priced openly at $49/month.
A sending domain is a domain that legitimately sends mail or appears in DMARC reporting for mail you own. SenderLedger prices around legitimate active sending domains, not abusive spoofing volume.
Subdomains count when they are actively managed as separate sending identities. Defensive or inactive domains do not consume active-domain allowances.
No. Spoofed, fraudulent and clearly forwarded traffic does not consume the legitimate message allowance.
SenderLedger helps you understand and remediate outbound email authentication. It does not promise inbox placement and does not replace deliverability work.
Not by default. SenderLedger explains what must change and tracks the work. Controlled DNS integrations are planned for customers who explicitly enable them.
Self-hosted and hybrid deployment options are planned. Request early access if this is a requirement for your organisation.
Yes. The MSP plan is designed around customer isolation, portfolio readiness, technician assignments, white-labelled reports and bulk onboarding.
There are no automatic surprise overage bills. A 20% temporary grace allowance applies, and customers are contacted after sustained legitimate usage beyond the plan.
SenderLedger is being built around current DMARC semantics and will document RFC-specific behavior before general availability. Ask about RFC support during early access if this affects your deployment.
Complete export is a product principle. Configuration export is included in the MSP path, with broader portability work planned for early access.
Most tools just show you reports — they tell you something is wrong but leave the work to you. We turn each problem into a tracked task, keep it open until it is genuinely resolved, and confirm from your real email data that it is safe before switching protection fully on.
p=reject tells receivers to reject unauthenticated mail that fails DMARC. It is the strongest published DMARC policy, but should only be used when legitimate senders are aligned.
Next enforcement decision
Request access and tell us whether you are trying to identify senders, fix authentication failures, manage customers or prepare for p=reject.