Features
The full DMARC ops stack
Monitoring, managed DNS, automation, private AI, and MSP plumbing — one console, per-domain pricing — no per-seat fees.
Monitoring
See every sender, on every client domain
Aggregate reports are parsed, deduplicated by content hash, classified, and rolled up daily — so dashboards stay fast at portfolio scale.
- Portfolio and per-domain dashboards with compliance timeseries, policy donut, and record states
- Drill-down explorer: domain → reporter → source IP → header_from, with pass/fail alignment detail
- Geolocation on every source IP, with a country bubble map for spotting anomalies fast
- Threat intelligence on every source IP — network owner (ASN), city-level geolocation, and Tor/attacker/abuse flags, inline in the drill-down explorer
- Source intelligence on every IP: PTR and named-sender classification against a curated, growing database of known ESPs — with a human-reviewed AI queue for the unknowns
- DNSBL reputation monitoring across Spamhaus, SpamCop, Barracuda, and SORBS, with per-blocklist delisting links
- CSV export of any aggregate view for client-ready reporting
- Forensic (RUF) failure reports ingested into a dedicated failures explorer
Managed DNS
Hosted DMARC, DKIM, and SPF — delegated by CNAME
Clients delegate their authentication records to zones we operate. Your team edits policy in the console; the records publish themselves.
- DMARC record editor with linting — publish policy changes without touching the client's DNS panel
- Hosted DKIM with managed selectors and key rotation, CNAME-delegated per domain
- Hosted SPF flattening: includes rewritten to flat records, re-resolved daily, chaining across client zones
- Verification watches that keep re-checking delegation until it is correct — and alert if it drifts
- Hosted MTA-STS: policy file served from our infrastructure, with TLS-RPT reports ingested and rolled up
- Hosted BIMI: logo and VMC assets served per domain, with expiry alerts before the certificate lapses
v=spf1 include:_spf.acme-com.anvilmail.io ~all
Automation
Remediation that runs itself
Every check that fails becomes a tracked unit of work, not a line in a spreadsheet.
- Pending actions: guided, domain-scoped remediation with the exact record to publish
- Delegation watches re-verify CNAMEs and TXT ownership on a schedule, with timeout escalation
- Verification queues for new domains — ownership TXT re-checked every 5 minutes until proven
- SPF refresh republishes flattened records only when resolution actually changes
- Record change alerts: a daily sweep catches value-level drift on every monitored record — changed, appeared, or removed — and fires before/after diffs to email, webhook, and PSA ticket channels
_titan-verify.acme.com TXT "anvil-verify=9f2c…"
AI — private fleet
AI classification without the data leak
Source classification and digest narratives run on models we host ourselves. No OpenAI, no third-party inference API, ever.
- AI source classification for unknown senders, with a human review queue before labels stick
- Narrative digests: plain-English summaries of what changed across a client's domains
- Pre-publish review so every AI-generated label or narrative is approved before it ships
- Fleet-powered and rack-local — report contents never leave hardware we own
MSP platform
Built around org → client → domain
Tenancy, honest billing counters, and integrations all mirror how an MSP actually operates.
- Compliant-only metering: only DMARC-passing mail counts toward your volume — spoofed and unauthenticated traffic meters at zero
- Soft caps, never cutoffs: crossing an allowance raises a banner and an email — ingestion, alerts, and dashboards keep running, and no report is ever dropped
- No per-seat fees: every role from org owner to read-only client viewer, priced by domains, not people
- ClientSync integration: import clients, map them, and open tickets on the right account automatically
- Per-client Cloudflare linking with scoped API tokens for pushing records into client zones
- Domain Connect one-click record deployment when the client's DNS provider serves our templates — manual copy-paste fallback otherwise
- Full audit log of every mutating action, with RBAC from org owner down to read-only client viewer
Integrations
Plays well with the rest of your stack
Reports arrive by mail or API; alerts leave by email, webhook, or PSA ticket.
- Resend inbound for rua= mailboxes — aggregate reports land straight in the ingest queue
- Signed outbound webhooks (HMAC) for alerts, with per-org endpoints and secrets
- Public REST API under /api/v1 for domains, reports, sources, and dashboard rollups
- Cloudflare DNS provider for publishing managed records into client zones
POST /hooks/anvil x-anvil-signature: sha256=…
{ "type": "alert.compliance_drop", "domain": "acme.com" }Ready when your clients are.
Data sources: this product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. IP threat intelligence draws on the Tor Project bulk exit list, the Spamhaus Project DROP lists, CINS Army, and blocklist.de; ASN fallback data by IPinfo (CC BY-SA 4.0).