Attackers already read your domain.
See what they see.
ShieldMarc is a UK-built DMARC monitoring platform that also watches every domain you manage across DNS, TLS, uptime, lookalikes and expiry. It grades each one A+ to F and hands you the exact fix. Most DMARC tools stop at email.
- Six layers, one grade · most DMARC tools do email only
- From £1/domain on MSP annual · rivals charge £10 to £20/domain
- Published pricing, UK-built · not quote-on-request
You'll never know the clients you didn't win.
Your DMARC policy, certificates, DNS and lookalike exposure are public records. People you have never spoken to are reading them right now and drawing conclusions, and the ones who do not like what they see never get in touch to tell you.
The deal that dies before first contact
Serious buyers run due diligence before they ever email you. And if your website proudly lists the clients you protect, you have also published an audit target list: one weak client domain reflects straight back on you.
Premiums priced off your public records
Cyber-insurance underwriters score these exact signals at quote and renewal. Missing enforcement, weak TLS or lapsed registrations can mean higher premiums, for you and for every client whose domains you manage.
The same scan, run with worse intentions
Attackers read the same records and start with the weakest thing they find: the parked brand domain, the forgotten subdomain, the registration nobody renewed. They do not report their findings either.
ShieldMarc gives you their view first: every domain you manage, graded A+ to F on one screen. And it gets you to green properly: report-driven enforcement that reaches p=reject without breaking a single legitimate sender, not a checkbox exercise. Run the same scan they do. It is free and takes 10 seconds.
More than DMARC monitoring. Your entire external attack surface.
Everything below is what that silent audit reads: public record, visible to anyone who looks. ShieldMarc watches it continuously from one dashboard, so nothing expires, drifts or gets impersonated without you hearing about it first.
DMARC & email authentication
Aggregate and forensic reports parsed, every sender identified, and a report-driven path from p=none to p=reject.
Security Grade
16 outside-in checks across SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, CAA, TLS and registration hygiene, graded A+ to F: the view insurers and attackers already have of you.
SSL certificates
Expiry countdowns, chain validation and issuer changes, with alerts long before anyone sees a browser warning.
DNS & DNSSEC
Record drift, nameserver changes and the DNSSEC chain of trust, checked continuously against what you expect.
Uptime monitoring
Multi-region probes with screenshot evidence when a site goes down, so you see the incident, not just an alert.
Lookalike domains
Typosquats and brand impersonations surfaced as they appear, before your customers ever meet them.
Domain expiry & WHOIS
Registration status, EPP locks and renewal dates across every domain you manage. No lapsed-domain surprises.
AI threat analysis
Our threat model scores every report row; AI explains the verdict and hands you the fix, on demand.
Every monitor has a free one-shot version: explore all 20 free tools. No account needed.
One broken DKIM selector.
1,097 silent failures.
Four senders, 28,147 messages, 1,142 alignment failures. 1,097 trace back to a single Google Workspace selector your vendor changed without telling you. ShieldMarc connects the report data to the cause, the fix, and the DNS change you need to make.
- Every sender identified: Google, Microsoft, Mailchimp, Yahoo, and anything else.
- Which selector, which IP, which policy change explains each failure.
- What to do next, in plain English, before your clients notice.
acme-industries.co.uk, example domain
Messages
28,147
Aligned
27,005 (96%)
Failed
1,142
Senders
4
| Sender | Messages | Aligned | Failed | Status |
|---|---|---|---|---|
Google Workspace google.com | 12,400 | 11,303 | 1,097 | Investigate |
Microsoft 365 outlook.com | 9,800 | 9,800 | 0 | Pass |
Mailchimp mcsv.net | 2,847 | 2,810 | 37 | Minor |
Yahoo yahoodns.net | 3,100 | 3,092 | 8 | Minor |
- Investigate
Google Workspace
google.com
12,400 msgs11,303 aligned1,097 failed
- Pass
Microsoft 365
outlook.com
9,800 msgs9,800 aligned0 failed
- Minor
Mailchimp
mcsv.net
2,847 msgs2,810 aligned37 failed
- Minor
Yahoo
yahoodns.net
3,100 msgs3,092 aligned8 failed
ShieldMarc found
Your Google Workspace stream has been failing DKIM alignment since Apr 17. A new selector, google-v2, started signing outbound mail after a workspace update, and it is not in your sender list. 1,097 messages affected this week.
The one-line fix, applied
CNAME google-v2._domainkey added to DNS. 1,097 of 1,142 failures clear overnight.
Illustrative data. Your reports, your senders, your findings.
Up and running in minutes
Add a domain, change one DNS record, and reports start landing in the dashboard within 24 to 48 hours. No agent, no proxy, no traffic rerouting.
Add your domains
Add domains one by one or in bulk. ShieldMarc automatically detects TLD variants and domain types.
Update your DNS
SSL, DNS, uptime and lookalike monitoring start immediately. Add the DMARC reporting address ShieldMarc gives you and reports land within 24 to 48 hours.
Get alerted
SSL expiry, DNS changes, DMARC failures, spoofing attempts. You hear about problems before your clients do.
DMARC monitoring for UK organisations
ShieldMarc Ltd is registered in England and Wales, company number 17352242, with a registered office at 66 Paul Street, London, EC2A 4NA. Customer monitoring data is EU hosted by default, and dedicated UK hosting is available on request for organisations that require UK data residency. Pricing is published in pounds: £0, £50 and £100 per month on annual billing, with Enterprise on application.
What that covers in practice: DMARC aggregate reports parsed and every sender identified, a report-driven route from p=none to p=reject, and continuous checks on SPF, DKIM, MTA-STS, TLS-RPT, DNSSEC, CAA, certificates, uptime and registration dates. Setup is a DNS change: no agent, no proxy and no traffic rerouting. The MSP plan carries 100 brand-grouped domain slots, which works out at about £1 per domain per month on annual billing.
NCSC Mail Check was retired on 31 March 2026, so UK public sector and MSP teams now source DMARC aggregate report processing commercially. We publish a migration route from Mail Check, a practical guide to running DMARC across client domains and the Q1 2026 baseline audit that began our quarterly re-scan of 192 UK Managed Service Providers.
We audit the industry. Not just our own customers.
Every quarter we re-scan the same 192 UK Managed Service Providers and grade them A+ to F. In Q2 2026 the average MSP scores a C, only 6% earn an A, and just 18% publish MTA-STS. The sector is improving quarter on quarter, which means standing still is falling behind. Public data, public methodology.
Read the Q2 2026 UK MSP AuditSimple, transparent pricing
Flat fee, not per-domain. 5 million DMARC messages per month on MSP, expandable in published buckets. Cancel anytime from your dashboard.
All prices exclude VAT. On the MSP plan, TLD variants of the same brand (e.g. .com and .co.uk) count as one slot.
You can't lose money finding out
- 30-day free trial, no card required
- 30-day money-back guarantee on annual plans
- Cancel anytime
Starter
- 20 free security tools, no sign-up
- 1 monitored domain · 10,000 messages/month
- 1 SSL monitor · 1 year data retention
- Threat model only (no deep AI review)
Professional
£600/year (save £240)
- 25 domains · 1,000,000 messages/month
- DMARC, SSL, DNS and uptime monitoring
- White-label PDF reports · 5 team members
- 1 year data retention
MSP
£1,200/year (save £360)
- 100 domains* · 5,000,000 messages/month
- From £1/domain on annual billing, rivals charge £10 to £20
- Brand TLD grouping (e.g. .com + .co.uk = 1 slot)
- Unlimited team members · Priority support
* MSP: expand in buckets of 50 domains for an extra £40/month.
Start reading your reports.
A free trial on any paid plan. No card, no agent, nothing to install. SSL, DNS, uptime and lookalike monitoring go live the moment you add a domain; point your RUA at ShieldMarc and a populated DMARC dashboard follows inside a couple of days.