Email auth & domain security
Someone is sending email as you.
Find out who.
Most anti-phishing tools watch for domains impersonating you. This watches the other half — your own domain being used to send mail. Monitelia validates DMARC, SPF, DKIM and BIMI, then ingests real aggregate reports and maps the countries sending mail in your name.
DMARC · SPF · DKIM · BIMI · RUA reports · SSL · DNSSEC · TLS · blocklists
The four records
Published isn't the same as protected
Most domains have some of these. Far fewer have them configured so they actually stop anything.
Is the policy present, and is it actually enforcing? We flag p=none — published but permitting — as the gap it is, and score the escalation path to quarantine and reject.
Parsed and counted. The 10-lookup limit in RFC 7208 is silently exceeded by most growing stacks, and once you cross it SPF stops evaluating.
Probed across the common selectors, plus any you add — so a rotated or half-configured key doesn't sit broken unnoticed.
Checks the record and whether a VMC is referenced — the piece that puts your logo next to authenticated mail in supporting clients.
The differentiator
A map of who's spoofing you
Publishing a DMARC record with rua= means mailbox providers send you daily reports on every source using your domain — and almost nobody reads them, because they arrive as zipped XML.
Monitelia parses them for you: source IP, resolved country, message volume, SPF and DKIM pass rates, and what the receiver did about it — rendered as a country map and a table of top senders. That's how you find out a bulletproof host in another country has been sending invoices in your name.
Domain posture
The infrastructure checks that quietly cost you
Certificate expiry
Issuer, validity window, days remaining and SAN coverage. Alerts at 14 days, before the outage — not during it.
DNSSEC
Whether your zone is signed at all, checked daily.
TLS version
What your server actually negotiates — not what the config claims.
Blocklists
Your resolved IP against Spamhaus, SpamCop and Barracuda. Being listed silently is how deliverability dies.
Records-only checking needs no setup at all. Ingesting aggregate reports requires pointing your DMARC rua= at an inbound address — a one-time DNS edit, documented in setup.
Check your domain in about a minute.
Add a domain on the free plan and see your DMARC, SPF, DKIM, BIMI and certificate posture scored — before deciding anything.