Skip to content
Signet
Start free
AuthenticateDetectHost

Prove it’s you.

Your mail carries proof. Theirs can’t.

Signet checks that every service your records authorise can sign as you, shows you who else is using your domain from your DMARC reports, and keeps the records that decide delivery correct.

Free, no account. It names the services your SPF authorises and checks whether each one signs.

What Signet is

Authenticate, detect, host. One system for the identity you send from.

Email fraud defence, authentication and DMARC management get sold as three purchases. They are three sides of one question: who is allowed to send as you. The same records answer a second question, whether your own mail reaches the inbox at all. Signet covers both in one place, rather than leaving you to stitch three tools together and reconcile them yourself.

  1. 01

    Authenticate

    Proof that the mail is yours.

    Signet finds every service your domain authorises to send, checks whether each one can actually sign, and names the ones that cannot. You end up knowing, rather than assuming, that the mail you meant to send carries proof it came from you.

    286 default selectors across 40+ named services, plus your own

  2. 02

    Detect

    Proof that the rest is not.

    Aggregate and forensic reports arrive from every major mailbox provider. Signet separates your own infrastructure from authorised third parties, from forwarders, from impostors, and raises only the last. Nobody needs an alert every time a mailing list forwards a message.

    Two independent signals before anything is called spoofing

  3. 03

    Host

    Proof that stays true.

    We host your MTA-STS policy, your reporting endpoints and your TLS reporting. You publish two records once. After that, changes happen in Signet rather than in a DNS console at eleven at night. Nothing quietly expires while nobody is looking.

    MX read from live DNS, enforcement gated behind a testing period

Deliverability

Security is half of it. The same records decide whether your own mail arrives.

Gmail, Yahoo and Outlook.com now hold every meaningful sender to the same list. Most of that list is authentication, and it is checkable in advance. Signet tells you which items you pass, which you fail, and which it cannot see from outside, so you know exactly where to look next.

What the providers require

Gmail, Yahoo and Outlook.com, for bulk senders.

  • SPF and DKIM, with DMARC aligned to the From domain
  • A published DMARC policy, at minimum p=none with reporting
  • Valid forward and reverse DNS on every sending address
  • TLS on the connection
  • One-click unsubscribe on marketing mail, honoured within two days
  • A spam complaint rate under 0.3%, and ideally under 0.1%
What p=none does, and when to move past it →

What Signet verifies

Checked from your DNS, your reports and your mail.

  • SPF, DKIM and DMARC, and whether each authorised service can actually sign
  • Alignment, policy and coverage, and whether reports can reach you
  • Forward-confirmed reverse DNS on your mail hosts
  • MTA-STS, TLS-RPT and DANE for the transport
  • Public blocklists: whether your mail hosts and confirmed sending addresses appear
  • Any single message you send to a one-time address, end to end
  • One-click unsubscribe on a message you send in: the headers, the https URI, and whether DKIM signed them

What it will not pretend to

Measured only inside the mailbox providers.

  • Your spam complaint rate. Only Google Postmaster Tools and Microsoft SNDS have that number, and the report tells you to go and read it.
  • Whether an unsubscribe is honoured. We can check that a message you send us offers one-click correctly; whether somebody acts on the click within two days is a property of the process behind it, not of the mail.
  • Inbox placement. Nobody outside the mailbox provider can measure it honestly, and we would rather say so than sell you a seed list.

What you get back

This is the report, not a picture of one.

real report component · sample data

Below is the top of the real report, rendered from sample data for a fictional company that is broken in the three ways most domains are broken: over the SPF lookup ceiling, an authorised service that cannot sign, and a policy that enforces nothing. The full report goes on to every record, every sending service and every finding.

northwind-logistics.example

Receivers are asked to report on mail claiming to be this domain, and told to deliver it whether or not it authenticates.

Monitoring only

Aggregate reports are requested, so receivers that send them will show you who is sending as your domain -- but receivers are told to deliver mail that fails authentication. This is the right place to start and the wrong place to stop.

· 146 DNS queries · 16.2 s

Do these first
  1. 1
    SPF exceeds the 10 DNS-lookup limit (12 used)
    Remove unused include: mechanisms, or replace a costly provider include with the ip4/ip6 ranges it resolves to. The include tree below shows the cost of each branch.
  2. 2
    Mailchimp can send as your domain but publishes no DKIM key
    Enable DKIM signing in Mailchimp and publish the public key it gives you.
  3. 3
    Twilio SendGrid can send as your domain but publishes no DKIM key
    Enable DKIM signing in Twilio SendGrid and publish the public key it gives you. Setup guide: https://www.twilio.com/docs/sendgrid/ui/account-and-settings/dkim-records
  4. 4
    BIMI is published but DMARC is not enforcing
    Move DMARC to p=quarantine, then p=reject.
Run this against your domain

Free, no account. northwind-logistics.example is not a real domain. The .example TLD is reserved by RFC 2606.

How we behave

Proof means being right, not being loud.

Any tool in this space can produce a long list. The ones people still have switched on a year later are the ones whose list is worth reading on a Monday morning.

  1. 01

    Forwarding never alerts

    Most DMARC failures are messages forwarded by a mailing list or a redirect. Alerting on those is how monitoring tools get muted inside a fortnight, and a muted tool protects nobody.

  2. 02

    Two signals before we say spoofing

    Network evidence and signature evidence must both fail before anything is reported as unauthorised. Calling your own marketing platform an attacker costs more than a missed alert.

  3. 03

    We never flatten your SPF

    Flattening swaps the services you authorised for the IPs behind them. When a provider moves, your mail starts failing. We count your lookups and name the include to drop.

Before you ask

The questions that decide it.

Will turning this on affect my email?
No. Monitoring changes nothing about how your mail is delivered. You publish a DMARC record asking receivers to send reports, and they carry on treating your mail exactly as before. Delivery only changes when you decide to move to p=quarantine or p=reject, and that is your decision, taken after the reports show it is safe.
How long before I see anything?
Aggregate reports arrive on the mailbox providers' schedule, not ours, usually within 48 hours, sometimes longer for a low-volume domain. The scan is instant, but the useful picture of who is sending as you builds over the first week.
What if something is sending as us that is not in our SPF record?
The scan will not see it, and no scan of any kind could. A scan reads DNS, so it can only show what you have authorised: your SPF includes and your MX hosts. Something sending as you without that authorisation leaves no trace in your DNS at all. It does leave a trace in DMARC aggregate reports, which is why monitoring is a separate thing from scanning. The scan tells you what you have declared; the reports tell you what is actually happening. You need both, and the first one is free.
Can you read my email?
No. We never touch your mailbox and there is no integration that would let us. DMARC aggregate reports contain counts and IP addresses, not messages. Forensic reports can contain fragments, so those are redacted before they are written to disk rather than before they are shown to you.
What does it cost?
Deliverability and authentication are free on this platform and will stay free: two domains, one person and thirty days of aggregate reports, with every check, for nothing. That is the reason Signet exists: eSec Forte kept finding the same unowned, drifting records on engagement after engagement, and the tools meant to fix them were needlessly complex and expensive. Team is US$25 a month for up to 25 domains and 25 people, with ninety days of history and the API; it is asked for from the portal and invoiced by email. Managed service providers and larger estates are priced by arrangement. The plans are set out in full on the pricing page.

Custom selectors, forwarding, SPF flattening, AI agents, and what the scan reads: every question we are asked.

See what your domain proves today.

The scan tells you what your identity looks like right now, in under half a minute. Signet tells you who has been using it, and keeps it true from there.

Scan your domainStart monitoring, free