How can we help?

Email spoofing is when a scammer sends an email that looks like it came from your company (for example, ceo@yourcompany.com) without actually controlling your domain. The fake email is often a wire-transfer or invoice request aimed at your staff or customers. Spoofing works because, by default, the internet has no way to prove who really sent an email.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a public instruction you publish in your DNS (the internet's address book for your domain) that tells receiving mail servers what to do with email that fails to prove it is really from you: monitor it, quarantine it to spam, or reject it outright. GenuineSender sets up and maintains the strongest setting (p=reject) for you.

We lock your domain against impersonation by hosting your DMARC enforcement record on our managed infrastructure. You add one DNS record (we show you exactly what to paste), and we enforce, monitor, and document the protection. We also produce the proof your cyber insurer may ask for.

It reads three public DNS records for any domain: your DMARC policy, your SPF record (which lists servers allowed to send your email), and how many DNS lookups your SPF requires. Nothing is installed, nothing is changed, and no email is accessed.

Yes. It only reads information that is already public for every domain on the internet. It cannot see, send, or modify any email.

CRITICAL means anyone can send convincing fake email as your domain right now (no DMARC record, or a monitor-only policy). AT RISK means you have partial protection (a quarantine policy) but spoofed email can still reach inboxes. SECURE means your domain enforces rejection of unauthenticated email (p=reject).

It instructs every receiving mail server on the internet to refuse email claiming to be from your domain unless it passes authentication. Real email from you still arrives because it carries valid cryptographic signatures. Fake email claiming to be you gets refused.

Spam filters protect what arrives in your inbox. We protect your identity: we stop other people from sending email that looks like it came FROM you. Both matter; they solve different problems.

No. Setup is one copy-paste in your DNS dashboard, and the step-by-step wizard shows your exact values, reads them back, and confirms when the lock is live. Most customers finish in about two minutes.

About two minutes to paste one record. Full enforcement then calibrates over seven days (see the Safe Harbor question below) so your legitimate email is never disrupted.

One CNAME record (an alias pointer) named _dmarc that points at your personal address on our infrastructure, like yourname.dmarc.genuinesender.com. The wizard in your dashboard shows the exact host and value for your account: copy them as-is.

Enter only _dmarc as the name. Some providers automatically append your domain to whatever you type; if you type the full _dmarc.yourcompany.com, it becomes _dmarc.yourcompany.com.yourcompany.com, which is wrong.

All of them. The wizard includes step-by-step instructions for the most common (Cloudflare, GoDaddy, Porkbun, Namecheap, Google, Squarespace, Network Solutions) and a generic guide for anything else. Any DNS host that lets you add a CNAME record works.

No, and we will never ask for it. You add the record yourself in your own DNS dashboard. We only ever see the public DNS result.

Usually a few minutes, occasionally up to a few hours depending on your DNS provider. After you press Verify once, the wizard quietly re-checks every 15 seconds (up to 8 automatic attempts), and you can always press the Verify button again at any time.

Yes. In the setup wizard, click Forward Setup Packet to My IT Person and enter their email. We send them the exact CNAME values, a plain-English instruction sheet, and a public verification link (no account login required). You can also copy the full instructions to paste into Slack, Teams, or a text message.

The Safe Harbor calibration period. For seven days we watch your domain's DMARC reports to confirm every legitimate sender (your email platform, your billing tool, your CRM) passes authentication. Only when the picture is clean do we enforce p=reject. If we see a sender that would fail, we hold the lock and alert you instead of breaking your email.

No. That is the entire point of the 7-day calibration: we never flip to enforcement until your real senders are proven to pass. This is the Zero-Breakage guarantee.

Once you are locked, we re-check your DNS every day. If anyone changes, deletes, or hijacks the record (a rogue employee, a compromised registrar account, a provider migration), we detect it within 24 hours and alert you immediately.

Delete the _dmarc CNAME record in your own DNS dashboard. The moment it is gone, your domain has no DMARC policy and nothing is rejected. This is your kill switch: it always works, instantly, without contacting us. (It also removes your protection, so use it only for genuine emergencies and reach out so we can help you re-lock safely.)

Because scammers do not stop at your real domain: they register lookalikes (smithlawyers.com for smithlaw.com) and aliases (smithlaw-alerts.com) and use those for invoice and wire fraud. Covering your primary plus two defensive lookalikes closes the loophole.

Solo is $19/month ($190/year) and covers one domain. Business is $49/month ($490/year) and covers up to 3 domains plus the compliance certificate and threat reports. Agency pricing for 20+ domains is arranged through sales. Annual billing gives you two months free.

All major credit and debit cards, processed by Stripe. We never see or store your card number.

No. Click Subscribe, pay with your card, and we create your account from the email you pay with. You land on your dashboard already signed in, so there is no password and no waiting for an email. You can sign in later with that same email using a sign-in link or Google.

Yes, upgrade or downgrade any time from your dashboard. Stripe automatically prorates the difference so you never pay twice for the same period.

From your dashboard, click Manage / Cancel Protection. You will see exactly what you lose, be offered lighter options first, and answer a short exit survey. Your protection stays live until the end of the period you already paid for.

A $9/month option offered during cancellation. Your hosted p=reject shield stays 100% live on our infrastructure, but the Monthly Threat PDFs, sandbox testing, and compliance certificates are paused. It exists so nobody has to choose between saving money and walking around unprotected.

At the end of your paid period you receive an ACTION REQUIRED email with plain-English cleanup instructions: your protection ends, your hosted record is retired, and you should replace the _dmarc entry with your own policy (or remove it). We tell you exactly what to paste so your domain is never left dangling or unprotected.

The price you see is the price you pay. If taxes ever apply in your region, they are calculated and shown clearly at checkout before you confirm payment.

Our cancellation flow is built so you never pay for something you do not want: you keep protection through the end of your paid period, and downgrading or Maintenance Mode are always available. For anything else, email support@genuinesender.com and we will work it out with you.

Business (and above) subscribers get a PDF certificate documenting that your domain enforces DMARC p=reject, with the record's history, the daily tamper monitoring, and a cryptographic verification hash. It is the evidence document a commercial cyber insurer asks for.

Every certificate carries a unique hash (like GS-DMARC-XXXX-XXXX-XXXX). Anyone can enter it at genuinesender.com/verify and see the live, DNS-validated confirmation in seconds. No login needed.

Commercial cyber liability policies increasingly require proof of an enforced p=reject policy before honoring claims for wire fraud and social engineering (fake invoice and fake CEO email scams). Without enforcement, the insurer can argue the loss was preventable. Our certificate is your proof.

Your SPF record can only require a maximum of 10 DNS lookups before mail servers stop evaluating it, per the standard (RFC 7208). Go over and your SPF permanently errors out, which can make legitimate email fail. Our scanner counts your budget on every scan and flags you before it becomes a problem.

It usually means years of accumulated tool signups (each adds an include to your SPF). Remove the ones for tools you no longer use, or consolidate senders. We flag this before locking your domain because enforcement with a broken SPF record can disrupt legitimate mail.

Business subscribers receive a monthly PDF summarizing spoofing attempts against your domain, DMARC report activity, and your security posture, plus a weekly one-page pulse. Made to be forwarded to management, IT, or your insurer.

Correct, there are no passwords. If you subscribed, we sign you in automatically right after payment. Later, enter your email and we send a one-time sign-in link (a magic link); click it and you are in. You can also use Sign in with Google.

Check your spam folder; it comes from noreply@genuinesender.com. If it is not there, request a new one (links expire for security), and if your company runs its own mail filtering, ask IT to allow-list that sender.

Links are single-use and time-limited for security. Just request a fresh one from the login page.

Not self-serve yet. Email support from your current address and we will move your account, domains, and subscription to the new one.

We store your account email, the domains you protect, and the DMARC reports those domains generate. We never read your actual email and we do not sell anything. Full details: Privacy Policy.

Four usual causes, in order of likelihood: (1) a typo in the value, (2) your provider appended your domain to the name twice (enter only _dmarc as the name), (3) the record was saved as the wrong type (it must be CNAME, not TXT), or (4) DNS has not propagated yet (give it an hour). The wizard re-checks live whenever you press Verify.

Two common causes: the record is at the wrong name (it must be exactly _dmarc, not dmarc or _dmarc2), or DNS has not propagated to global resolvers yet. Note that having two DMARC records is invalid: receivers ignore both. Keep exactly one.

That is the spam filter of the receiving inbox being cautious about a simulated message. It does not reflect your domain's protection status. Check your real protection status on your dashboard or by running a scan.

This should never happen thanks to Safe Harbor calibration, but if it does: use the emergency unlock (delete the _dmarc CNAME in your DNS panel; protection ends instantly, legitimate mail flows again), then email us so we can identify the failing sender and re-lock you safely.

Our daily watchdog detected that your _dmarc record no longer points where it should. This means someone or something changed your DNS: a provider migration, an employee, or a compromise. Log in to your DNS provider, check the record's change history, and restore the values shown in your dashboard wizard. If you did not authorize the change, treat it as a security incident and change your DNS provider password.