DMARC ops for MSPs
Every client domain. Authenticated. Visible.
One console for DMARC monitoring, managed DNS (SPF/DKIM/DMARC hosting), daily DNS drift alerts, and AI-driven email security — built for MSPs, private by design.
How it works
From dark to enforced in three steps
- 01
Add domains
Import client domains in bulk or straight from ClientSync. Ownership verifies with one TXT record.
- 02
Point reports at us
One rua= CNAME per domain (or your own mailbox). Aggregate reports start flowing within a day.
- 03
Watch, fix, enforce
Classified sources, guided pending actions, then enforce — while a daily sweep re-checks every record and emails you the before/after diff if anything drifts.
The platform
Everything between p=none and p=reject
Monitoring, managed DNS, and remediation in one place — so a tech can enforce DMARC across a whole client base without living in DNS panels.
Aggregate reporting & drill-down
Every RUA report parsed, deduped, and rolled up — RUF forensic samples alongside. Drill from portfolio to domain to source IP in two clicks.
IP threat intelligence
Every source IP resolves to its network owner (ASN), city-level location, and Tor/attacker/abuser flags — inline in the reports explorer, powered by threat feeds we mirror locally plus optional abuse-score lookups.
Managed DMARC/DKIM/SPF hosting
Host the records on our zones and delegate with a single CNAME. Edit policy in the console, not in DNS tickets.
Daily DNS drift watch
All seven records — MX included — re-checked every day. Real value changes email a before/after diff to your admins; flapping resolvers stay silent. Zero setup.
SPF flattening
Hosted SPF rewrites includes into flat records and refreshes them daily. Beat the 10-lookup limit for good.
Hosted MTA-STS & BIMI
We serve the MTA-STS policy and BIMI assets from our infrastructure, ingest TLS-RPT reports, and alert before a Verified Mark Certificate expires.
Pending-actions guided remediation
p=none, missing DKIM, stale SPF — every issue becomes a guided action with the exact record to publish.
AI source classification & narratives
Our private fleet classifies unknown senders and writes the digest narrative. Data never leaves our racks.
Alerts, digests & ClientSync tickets
Compliance drops and record drift alert by email, webhook, or a ticket on the right client in ClientSync — before/after diffs included.
MSP-native
Tenancy shaped like your book of business
Anvil Mail is not a single-tenant tool with a reseller badge. The whole data model is org, client, domain — the same way you sell, staff, and bill.
- Org → client → domain tenancy that mirrors how MSPs actually bill
- Per-client portals and scopes with RBAC down to read-only techs
- Priced by domains, not people — no per-seat fees, no surprise tiers
- White-label client portal with branded, plain-English monthly reports
- Only DMARC-compliant mail meters — and soft caps never stop ingestion
- Source classification runs on our own private model fleet
- No OpenAI, no third-party AI API — report analysis never leaves our racks
- Narrative digests written per client, reviewed before they ship
Private by design
AI that never phones home
Classification and narrative generation run on our own fleet, on hardware we own. Your clients' email metadata is never sent to a third-party model API.
Free tools
Seven lookup tools. No signup.
The same record linting engine the console uses, free for anyone debugging a domain.
Put every client domain on the anvil.
Add your first domains in minutes. Reports start classifying the moment they arrive.