Quantified exposure
One posture score, defensible
A live 0-100 email-risk score per domain and subsidiary, trended over time, with the specific controls that move it up or down.
Your email.
Only you.
Stop email impersonation. Protect your domain with automated email authentication.
Free check · No signup required
142+ countries
Trusted by thousands of security teams
AI-native · Human-governed · SaaS or on-premise
This page adapts to your role
Now showing: CISO / Security Leader · Risk, governance and assurance
[ Agentic AI · Human in the loop ]
AI agents do the work. Your team stays in control.
EmailAuth is AI-native: agents monitor, diagnose and fix email authentication around the clock, and every change that matters waits for a human approval.
Level 1
Observe
Agents watch every sender and report. Nothing changes.
Level 2
Recommend
Agents propose fixes with the evidence behind each one.
Level 3
Approve to act
Agents prepare the change; a named approver signs it off before it goes live.
Level 4
Autonomous within guardrails
Agents act inside limits you set, with alerts, audit trail and one-click rollback.
Policy moves (none, quarantine, reject), SPF changes and new senders go through approval.
Role-based approvers and a full audit trail of every agent action.
One-click rollback of any change.
The stakes
The exposure you are accountable for
Email is still the number one way attackers get in. The numbers are consistent across every major industry report.
16%
of data breaches begin with phishing
Verizon DBIR 2024
$4.88M
average cost of a data breach worldwide
IBM Cost of a Data Breach 2024
$2.77B
lost to business email compromise in a single year
FBI IC3 2024
[ Deploy anywhere ]
SaaS, your cloud tenancy, or on-premise
Keep data and AI keys where your regulators want them.
The only Tier 1 DMARC OEM available on-premise or in your own tenancy on any cloud.
SaaS
Fully managed by EmailAuth. Live in a day, no infrastructure.
Your cloud tenancy
Runs inside your own account on AWS, Microsoft Azure, Google Cloud, Oracle Cloud (OCI), IBM Cloud, Alibaba Cloud.
On-premise and private cloud
Single-click appliance in your data centre or on VMware or OpenStack, including air-gapped.
SaaSAWSMicrosoft AzureGoogle CloudOracle Cloud (OCI)IBM CloudAlibaba CloudVMwareOpenStackOn-premise
Bring Your Own Key for AI: OpenAI, Azure OpenAI, Anthropic, Google Gemini, Self-hosted open models.
[ How it works ]
From unprotected to enforced, in three moves
No migration, no mail-flow risk. Connect once, see everything sending as you, then enforce on live evidence.
1
Connect your domain
Delegate to EmailAuth with a single CNAME. No mail-flow change, no migration, no risk to what already sends.
2
See every sender
Aggregate RUA and forensic RUF telemetry reveals every service sending as you, plus every spoof and lookalike targeting your brand.
3
Enforce with confidence
Ramp to p=reject on live evidence, flatten SPF with SmartSPF, and file takedowns, without dropping a single legitimate message.
[ Board-ready in 15 seconds ]
Quantify Your Domain's Email Risk
Enter any domain your organization owns and get an executive posture score with the exact control gaps behind it. No agent, no login, results in seconds.
[ Governance model ]
Continuous Control, Full Audit Trail
Every enforcement decision is logged, delegated and reversible. Ownership stays with your team while the evidence assembles itself for the next audit.
[ Brand & BEC risk ]
Impersonation Risk You Can Evidence
Board members ask whether you would know when the company is being impersonated. This is how you answer yes, with proof and a takedown trail.
Homoglyph & Lookalike Domain Detection
Continuous registration monitoring flags any domain with ≥90% string proximity to your brand, including Unicode homoglyphs and ligature swaps.
- 96% match
acme-c0rp.com
Homoglyph 0/o · registrar NameSilo
- 93% match
acrne-corp.com
Ligature rn/m · registrar PDR Ltd
- 91% match
acme-corp.co
TLD squat · registrar Tucows
100+ DNS Blocklists (RBL)
100+blocklists polled continuously
✓ clean · polling Spamhaus ZEN
Shadow IT Sender Discovery
Unauthorized third-party mailers sending as your domain, fingerprinted from aggregate telemetry.
- Salesforce Marketing Cloud18,402/30dUnauthorized
- SendGrid6,918/30dPending approval
- Mailchimp2,104/30dUnauthorized
- Zendesk874/30dApproved
Inbound M365 Telemetry Ingestion
4.28M
Inbound messages analyzed
1,317
Phishing hitting employee inboxes
1,244
Auto-quarantined by policy
Graph API connector surfaces spear-phishing aimed at named executives, correlated with outbound DMARC failures.
[ Assurance & reporting ]
Reporting Where Governance Already Lives
Stream authenticated risk events to your SIEM and GRC, brief the board on a schedule, and keep regulated data inside your perimeter when policy demands.
Multi-Channel Notifications
WhatsApp
Critical enforcement alerts to on-call responders
Microsoft Teams
Per-tenant channel cards with policy diffs
Slack
Threaded incident updates and takedown status
Enterprise SIEM Streaming
REST APISyslogSTIX-TAXII
Splunk
HEC ingestion of normalized DMARC events
Microsoft Sentinel
Native connector with analytics rules
IBM QRadar
Syslog LEEF stream with offense mapping
MSSP Partner Portal
- White-label logo & palette customizer per client
- Super Admin console with delegated RBAC
- Instant client tenant switcher across portfolios
Single-Click On-Premises Appliance
- Footprint
- 8 vCPU / 32 GB
- Storage
- 500 GB NVMe
- Runtime
- Hardened container
- Updates
- Automated code & patch
[ Control coverage ]
Capabilities, Priority & Deployment Mode
The full control set, how we sequence rollout against your risk register, and where each control can run to satisfy data-residency requirements.
| Feature Domain | Capabilities | Implementation Priority | Deployment Mode |
|---|---|---|---|
| Aggregate Reporting (RUA) | Multi-ISP XML ingestion, sender classification, SPF/DKIM alignment matrix | Priority 1 | Cloud SaaS + On-Premises |
| Forensic Reporting (RUF) | RFC 6591 AFRF parsing, targeted phishing capture, automated PII redaction | Priority 1 | Cloud SaaS + On-Premises |
| SmartSPF™ Flattening | Dynamic 10-lookup resolution, scheduled 3rd-party IP sync, macro fallback | Priority 1 | Cloud SaaS |
| Hosted Policy Manager | CNAME-delegated DMARC/SPF/DKIM record control, zero DNS freeze windows | Priority 1 | Cloud SaaS |
| TLS-RPT & MTA-STS | Cipher mismatch telemetry, policy hosting, HTTPS enforcement monitoring | Priority 3 | Cloud SaaS + On-Premises |
| BIMI & VMC | Hosted BIMI records, SVG Tiny-PS converter, VMC certificate chain checks | Priority 3 | Cloud SaaS |
| Threat Hunting | Homoglyph detection ≥90% proximity, 100+ RBL polling, 1-click abuse takedown | Priority 1 | Cloud SaaS + On-Premises |
| Shadow IT Discovery | Unauthorized third-party sender fingerprinting and approval workflow | Priority 3 | Cloud SaaS |
| SIEM Streaming | REST API, Syslog, STIX-TAXII push to Splunk, Sentinel, QRadar | Priority 3 | Cloud SaaS + On-Premises |
| Domain Health Scanner | Public posture scan, header analyzer, record lint & DNS propagation check | Free Community Tools | Cloud SaaS |
| MSSP Multi-Tenancy | White-label branding, super admin console, tenant switcher, delegated RBAC | Priority 1 | Cloud SaaS + On-Premises |
| Appliance Lifecycle | 1-click installer, air-gapped operation, automated code & patch updates | Priority 3 | On-Premises Appliance |
[ FAQ ]
Questions security and IT teams ask us
Straight answers on DMARC, SmartSPF, deployment and impersonation defense.
What is DMARC and why do I need it?
DMARC is the email standard that tells inbox providers what to do with messages that fail authentication. Without an enforced DMARC policy, anyone can send email that appears to come from your domain. EmailAuth deploys and enforces DMARC so only your legitimate senders reach the inbox.
How does EmailAuth reach p=reject without blocking legitimate email?
EmailAuth builds a per-source alignment matrix from live RUA and RUF reports, so every service that legitimately sends as you is identified and authenticated first. You ramp enforcement gradually on real evidence, which means you reach full p=reject without dropping a single legitimate stream.
What is SmartSPF and how does it fix the 10-lookup SPF limit?
SPF fails silently once a record needs more than 10 DNS lookups. SmartSPF flattens your include chains into one optimized macro record and keeps third-party IP ranges synced automatically, so you stay under the limit even as vendors like Salesforce or SendGrid change their ranges.
What is the difference between RUA and RUF reports?
RUA aggregate reports summarize authentication results across all your senders over time. RUF forensic reports capture individual failing messages, including the header chain and originating IP, so you can investigate targeted phishing. EmailAuth parses both and redacts PII at ingestion for GDPR and HIPAA compliance.
Can EmailAuth stop someone impersonating my domain?
Yes. Continuous monitoring flags any newly registered domain with 90 percent or higher string proximity to your brand, including Unicode homoglyphs, and lets you file a one-click abuse takedown with an evidence bundle. Enforced DMARC also blocks direct spoofing of your exact domain.
Do I need to change my DNS provider or mail platform?
No. EmailAuth works with any DNS provider and any mail platform, including Microsoft 365 and Google Workspace. Hosted records are delegated by CNAME, so you make one change and manage policy from the console after that.
Can I run EmailAuth on-premises?
Yes. Alongside Cloud SaaS, EmailAuth ships as a single-click on-premises appliance with air-gapped operation and automated patching, for organizations with strict data-residency or regulatory requirements.
How long does deployment take?
Most teams see full RUA and RUF telemetry within a day of delegating their domain. The standard proof of concept runs 14 days, long enough to produce a quantified baseline and a safe path to enforcement.