Stop client emails
from landing in spam.
Most MSPs don't know their clients' emails are failing authentication checks - until the calls start coming in.
For MSP owners and technical directors managing email across 50 to 500 client domains.
You're sending emails into a black hole.
Right now, there could be client domains on your watch failing authentication checks - emails bouncing, invoices vanishing into spam, domains getting spoofed - and you'd have no way to know until someone calls you about it.
MXBastion watches every domain you manage - so these problems get caught and fixed before anyone notices.
From: mailer-daemon@mx1.google.com To: you@your-company.com Subject: Delivery Status Notification (Failure) --- Below this line is the bounce message --- 550 5.7.1 Unauthenticated email from your-company.com is not accepted due to domain's DMARC policy. DMARC policy: p=none (no enforcement) SPF: FAIL (too many DNS lookups) DKIM: FAIL (signature not found) Alignment: FAIL Action required: Fix your email authentication configuration.
No more 'did you get my email?' calls.
With MXBastion protecting your domains, every email is authenticated, every threat is caught, and you never get blindsided by a client call again.
Every client email lands in the inbox
SPF, DKIM, and DMARC all pass. Receiving servers trust the message. Your clients' invoices arrive, their password resets work, and their customers stop asking 'did you send that?'
Continuous Monitoring
DNS records checked every 6 hours. DMARC reports processed as they arrive. When something drifts, you fix it the same day - not three weeks later after a client churns.
Proactive Issue Resolution
When something breaks, you get the exact DNS record to fix it. No Googling RFC specs, no guessing at syntax. Copy, paste, done - verified in minutes, not days.
From vulnerable to protected in days, not months.
Use MXBastion and every client domain reaches full DMARC enforcement - p=reject - with guided steps and zero guesswork.
Add Your Domains
Enter your domains and we instantly scan their SPF, DKIM, and DMARC records.
Review Authentication
We collect and analyze your first DMARC aggregate reports to map all legitimate senders.
Tighten Enforcement
Gradually move from p=none to p=reject with guided steps and safety checks at each stage.
Monitor & Protect
Continuous monitoring catches config drift, spoofing attempts, and new sender issues in real time.
DMARC Enforcement Progression
Monitor only. No emails are blocked. You see what's happening but nothing is enforced.
Suspicious emails go to spam. Legitimate mail still delivers. A safe middle ground.
Full protection. Unauthenticated emails are rejected. Your domain can't be spoofed.
See your domain health at a glance.
SPF Exceeds 10 Lookup Limit
legacy-app.io has 13 DNS lookups in its SPF record. RFC 7208 limits this to 10.
Domains
+ Add Domainp=reject
Pass
Aligned
Healthy
2 hours agop=quarantine
Pass
Misaligned
Warning
4 hours agop=none
13 lookups
Missing
Critical
1 hour agop=reject
Pass
Aligned
Healthy
30 min agop=quarantine
Pass
Aligned
Healthy
3 hours agop=reject
Pass
Aligned
Healthy
1 hour agoDMARC Aggregate Reports
Alert History
Settings
Notification Channels
Check Frequency
Team
Simple, transparent pricing
All plans include SSO and full API access. No hidden fees.
Growth
For growing MSPs
- Up to 50 domains
- 1M emails/mo
- DMARC, SPF, DKIM monitoring
- Hourly DNS checks
- SSO + API access
Pro
For established MSPs
- Up to 150 domains
- 5M emails/mo
- DMARC, SPF, DKIM monitoring
- DNS checks every 15 min
- SSO + API access
Need more than 150 domains? Let's talk.
Stop losing clients to email problems you didn't know existed. Fix them now in a few clicks.
- 100% email authentication
- Continuous DNS monitoring
- Proactive threat detection
Common questions
Most domains reach full DMARC enforcement (p=reject) within 2-4 weeks. The timeline depends on how many third-party senders you have (like marketing platforms, CRMs, or ticketing systems) that need to be authenticated first. MXBastion guides you through each step with specific DNS records to add - no guesswork involved.
No. MXBastion works with any DNS provider. You just need to add or update a few DNS TXT records (SPF, DKIM, DMARC) - something you likely already do for your clients. We tell you exactly what records to set and verify they're correct.
MXBastion reads your existing DMARC, SPF, and DKIM records as-is during onboarding. Nothing is overwritten. We analyze your current setup, show you what's working and what's not, and guide you through improvements step by step.
We currently support alerts via email, Slack, and webhooks - which means you can connect to virtually any PSA or RMM that accepts inbound webhooks or email-based ticket creation. Native integrations with ConnectWise and HaloPSA are on the roadmap.
You can bulk-import domains via CSV or the API. MXBastion instantly scans all records and starts collecting DMARC reports. Most MSPs have their full domain portfolio loaded and initial reports flowing within an hour.
Yes. All plans include full API access. You can automate domain management, pull authentication data, and integrate MXBastion into your existing tooling and workflows.
All plans include email support with a target response time under 4 hours during business hours. We also have documentation and guides for common DMARC scenarios. If you're on the Pro plan, you get priority support.