XENONPEAK

See every service that sends email as your domain.

XenonPeak reads the DMARC reports Gmail, Outlook and Yahoo send about your domain, shows which senders fail SPF or DKIM, and walks you to p=reject before mailbox providers start rejecting your mail.

Start 14-day trial See how it works

Setup is one DNS TXT record. No mailbox or admin access.

Illustrative product interface

What XenonPeak checks

Nine checks, one domain at a time. Pick one to read how it works.

  1. 01 DMARC report parsing Aggregate (rua) XML from Google, Microsoft, Yahoo and others, decoded into daily rows.
  2. 02 Sending source inventory Every IP and service that sent mail with your From domain, grouped by provider.
  3. 03 SPF lookup budget Counts DNS lookups across nested includes and warns before you pass the limit of 10.
  4. 04 DKIM key checks Finds selectors per sender, flags keys under 1024 bits and missing signatures.
  5. 05 Policy rollout A staged plan from p=none to quarantine to reject, gated on real pass rates.
  6. 06 Bulk-sender readiness Checks your domain against the Gmail and Outlook.com rules for 5,000+ messages a day.
  7. 07 Alerts Email notices when a new source appears, a pass rate drops or a DNS record changes.
  8. 08 Multi-domain workspace Primary domain, subdomains and parked domains side by side, each with its own policy.
  9. 09 Export and API CSV export of every report row and a read-only REST API on the Growth plan.

02 · Sending sources

Find the tools nobody told IT about

Marketing signs up for a newsletter tool, finance connects an invoicing app, and each one starts sending as your domain. XenonPeak maps every reporting IP to a provider by reverse DNS and published SPF ranges, then shows its volume and whether SPF and DKIM align with your From domain.

  • Sources are labelled by provider: Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES, HubSpot and more.
  • Unknown IPs are kept separate, so spoofing attempts stay visible.
  • Mark a source as approved, or note who owns it internally.
Illustrative product interface
Illustrative product interface

Stay under the 10-lookup SPF limit

SPF allows at most 10 DNS lookups. Each include can pull in several more, and once you pass 10 the whole record fails, for every sender at once. XenonPeak resolves the full include tree every hour, counts lookups, and tells you which include to remove or replace before the next one tips you over.

Microsoft notes that records over 10 lookups may fail SPF at Outlook.com, which is one of the checks it requires from bulk senders.

Reach p=reject without blocking your own mail

Gmail and Outlook.com accept p=none from bulk senders, but p=none does nothing to stop spoofing. XenonPeak tracks each source against a staged plan: fix alignment, move to quarantine at pct=25, then 100, then reject. A step is only suggested after every approved source has passed alignment for 14 days in a row.

Illustrative product interface

Set up in one DNS change

  1. 01

    Add the rua address

    Add a reporting address like rua=mailto:a7f3@rua.xenonpeak.xyz to your _dmarc TXT record. If you have no record yet, we give you a p=none starter.

  2. 02

    Wait for reports

    Mailbox providers send aggregate reports about once a day. Sources and pass rates fill in within 24 to 48 hours.

  3. 03

    Fix and tighten

    Publish the suggested SPF, DKIM and DMARC records at your DNS host. We re-check them and track each policy step.

How we handle your report data

DMARC aggregate reports contain sending IPs, counts and authentication results. They do not contain message bodies, subjects or recipient addresses. That is all XenonPeak stores.

Read-only by design
No mailbox, admin console or DNS write access. We only receive reports and run public DNS lookups.
Encrypted
TLS 1.2 or higher in transit, AES-256 at rest for stored reports and workspace data.
Access you control
Owner, Admin and Viewer roles per workspace. Invite colleagues without sharing a login.
Export and deletion
CSV export at any time. Workspaces are deleted within 30 days of cancellation or a written request.
Support response
Email support answers within one business day (Pacific time), and within 4 business hours on Growth and Enterprise.

Questions teams ask before adding the record

Do you need access to our mailboxes or admin console?

No. XenonPeak works from DNS lookups and the DMARC aggregate reports that mailbox providers already send. You add one rua address to your DMARC TXT record. We never read message content, and we never ask for Google Workspace or Microsoft 365 admin rights.

How long until we see data?

Most providers send aggregate reports once every 24 hours, so the first sources usually appear within 24 to 48 hours of adding the record. DNS checks for SPF, DKIM and DMARC run as soon as you add the domain.

We send fewer than 5,000 messages a day. Does this still matter?

Yes. Gmail requires SPF or DKIM from every sender, and unauthenticated mail can be marked as spam or rejected at any volume. DMARC with p=reject is also the main control that stops other people from sending phishing in your name.

Will moving to p=reject block our own email?

It can, which is why XenonPeak does not rush it. The rollout plan only suggests the next step once every known source passes alignment for 14 straight days, and it shows exactly which source is holding you back.

Can XenonPeak change our DNS records for us?

No. We have no write access to your DNS. Each fix comes as the exact record to paste into your registrar or DNS host, such as Cloudflare, Route 53 or GoDaddy, and we verify it after you publish.

What happens to our report data if we cancel?

You can export everything as CSV before you leave. After cancellation we delete your workspace and stored reports within 30 days, or sooner if you email a deletion request.

Find out who is sending as your domain this week

14-day trial on any plan. Starter is $29 a month after that.

See plans Talk to us