From DMARC p=none to p=reject without guessing.
Postdock reads your DMARC aggregate reports and waits for the evidence. Postdock proposes the next policy stage when your reports support it; you make each change in your own DNS.
- p=none Monitoring. Reports arrive and sending sources are identified.
- Gate 1: 98% aligned for 14 days Two independent resolvers agree Example value. It may change before launch. You decide
- p=quarantine Current stage. Asks receivers to treat failing mail as suspicious. example.com is here.
- Gate 2: 98% aligned for 30 days Two independent resolvers agree Example value. It may change before launch. You decide
- p=reject Asks receivers to reject failing mail. Stay here.
See exactly what changes before you make it
Each proposal will show the exact record change and your last 14 days of aggregate reports: how much mail passes DMARC, how much fails, and what receivers reported doing with the failing mail.
Setup is two edits in your own DNS
You publish one record to show you own the domain, and you add a report address to the DMARC record you already have. Postdock reads your DNS and your reports. It never asks for your DNS credentials.
Record names and values are not final until launch.
Show you own the domain
Publish a TXT record with the value your account gives you.
_postdock-verify.example.com TXT "postdock-verify=<value from your account>"
Example record. The name and value are not final until launch.
Send your reports to Postdock
Add your report address to the rua tag of your DMARC record. Keep any addresses already there. To leave, remove it.
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:<your report address>"
Example record. Keep your current policy and any addresses already in rua; only add your report address.
How Postdock works
- Labeled certainty
- Every finding is Observed, Inferred, Recommended, or Inconclusive, with its source and time.
- Two resolvers
- Two independent public DNS resolvers must agree. If they don't, Postdock proposes nothing.
- Audit log
- Every proposal is logged, with each change Postdock sees in your DNS. Org owners will be able to export the log.
- Read-only for agents
- Planned: read-only MCP tools for your own agent. You decide, and you make every change.
Questions
What does Postdock do?
Postdock reads your DMARC aggregate reports and proposes the next DMARC policy stage, from p=none to p=quarantine to p=reject, when your reports support it.
What do p=none, p=quarantine and p=reject mean?
They are the three DMARC policy stages a domain can publish. p=none asks receivers for no specific action; it is the monitoring stage, where reports arrive and sending sources are identified. p=quarantine asks receivers to treat mail that fails DMARC as suspicious. p=reject asks receivers to reject mail that fails DMARC.
Who makes Postdock?
Postdock is a product of Clarivo Inc.
Does Postdock change my DNS?
No. You make every change in your own DNS, and you can undo it the same way. Postdock reads your DNS and your reports, and it never asks for your DNS credentials.
What does setup involve?
Two edits in your own DNS: a TXT record that shows you own the domain, and your report address added to the rua tag of your DMARC record.
Can I sign up?
Not yet. Postdock is in private development. Signup is not open yet, and there is no pricing.
In private development
Signup is not open yet, and there is no pricing.
Start at none. Get to reject.
No promises about inbox placement. Just evidence you can check, and every change yours to make.