Features
The full DMARC ops stack
Monitoring, managed DNS, automation, private AI, and MSP plumbing — one console, per-domain pricing.
Monitoring
See every sender, on every client domain
Aggregate reports are parsed, deduplicated by content hash, classified, and rolled up daily — so dashboards stay fast at portfolio scale.
- Portfolio and per-domain dashboards with compliance timeseries, policy donut, and record states
- Drill-down explorer: domain → reporter → source IP → header_from, with pass/fail alignment detail
- Geolocation on every source IP, with a country bubble map for spotting anomalies fast
- CSV export of any aggregate view for client-ready reporting
Managed DNS
Hosted DMARC, DKIM, and SPF — delegated by CNAME
Clients delegate their authentication records to zones we operate. Your team edits policy in the console; the records publish themselves.
- DMARC record editor with linting — publish policy changes without touching the client's DNS panel
- Hosted DKIM with managed selectors and key rotation, CNAME-delegated per domain
- Hosted SPF flattening: includes rewritten to flat records, re-resolved daily, chaining across client zones
- Verification watches that keep re-checking delegation until it is correct — and alert if it drifts
v=spf1 include:_spf.acme-com.anvilmail.io ~all
Automation
Remediation that runs itself
Every check that fails becomes a tracked unit of work, not a line in a spreadsheet.
- Pending actions: guided, domain-scoped remediation with the exact record to publish
- Delegation watches re-verify CNAMEs and TXT ownership on a schedule, with timeout escalation
- Verification queues for new domains — ownership TXT re-checked every 5 minutes until proven
- SPF refresh republishes flattened records only when resolution actually changes
_titan-verify.acme.com TXT "anvil-verify=9f2c…"
AI — private fleet
AI classification without the data leak
Source classification and digest narratives run on models we host ourselves. No OpenAI, no third-party inference API, ever.
- AI source classification for unknown senders, with a human review queue before labels stick
- Narrative digests: plain-English summaries of what changed across a client's domains
- Pre-publish review so every AI-generated label or narrative is approved before it ships
- Fleet-powered and rack-local — report contents never leave hardware we own
MSP platform
Built around org → client → domain
Tenancy, billing counters, and integrations all mirror how an MSP actually operates.
- ClientSync integration: import clients, map them, and open tickets on the right account automatically
- Per-client Cloudflare linking with scoped API tokens for pushing records into client zones
- Domain Connect one-click enrollment on the roadmap for providers that support it
- Full audit log of every mutating action, with RBAC from org owner down to read-only client viewer
Integrations
Plays well with the rest of your stack
Reports arrive by mail or API; alerts leave by email, webhook, or PSA ticket.
- Resend inbound for rua= mailboxes — aggregate reports land straight in the ingest queue
- Signed outbound webhooks (HMAC) for alerts, with per-org endpoints and secrets
- Public REST API under /api/v1 for domains, reports, sources, and dashboard rollups
- Cloudflare DNS provider for publishing managed records into client zones
POST /hooks/anvil x-anvil-signature: sha256=…
{ "type": "alert.compliance_drop", "domain": "acme.com" }