Every client domain. Watched.
AuthDrift checks the email authentication and website security of every client domain you manage, every day. You hear about a change the day it’s confirmed, and clients get a monthly report with your name on it.
How it works
Set it once. Hear from us only when it matters.
Add your clients’ domains
Group domains by client. We audit each one straight away and record the result as its baseline.
We re-check every day
Every scan is compared against the last confirmed one. You can also trigger a re-scan yourself at any time.
One alert on real change
A confirmed change emails your team a plain-English diff, with Slack and webhooks if you want them. DNS glitches are filtered out.
What we check
Standards-based and read-only. We only look at public DNS records and HTTP responses.
| Check | Area | What it tells you |
|---|---|---|
| SPF | Who may send as the domain, and how close it is to the 10-lookup limit that silently breaks SPF. | |
| DKIM | Signing keys are published, long enough and not revoked, across declared and common selectors. | |
| DMARC | Whether spoofed mail is actually blocked, or the policy is published but enforcing nothing. | |
| MTA-STS | Incoming mail is forced over encrypted connections, and the policy file is reachable. | |
| BIMI | The brand logo record exists and the logo it points at can be fetched. | |
| DNSSEC | DNS | The zone is signed, so its records can’t be quietly forged in transit. |
| TLS | Web | Protocol version, certificate chain and how many days until the certificate expires. |
| HSTS | Web | Browsers are told to always use HTTPS, with a long enough max-age. |
| Security headers | Web | CSP, frame, referrer and permissions policies the site actually serves. |
Built for agencies
Monitor every client from one account and show them the work you do.
- AGroup domains by client and see every client’s posture on one screen.
- BMonthly reports per domain and per client, carrying your name and accent color.
- CRead-only share links for clients, revocable and with an optional expiry.
- DPlain-English alerts with a ready-made note you can send the client.
- EInvite teammates. Owners manage the account; members manage domains.
Alerts you can trust
Spotting a change is easy. Not crying wolf is the hard part.
- AEvery candidate change is re-checked through independent resolvers before anyone is alerted.
- BPlain-English diffs: what changed, in which record, and when it was confirmed.
- CNo repeat alerts while a change is unresolved; a recurrence counts as new.
- DDMARC aggregate reports turned into who is sending as each domain, authorized or not.
- EA self-monitoring heartbeat, so you’re told if scanning ever stalls.
- FHosted in the EU. An account owner can delete everything at any time.
Pricing
Free for everyone during early access.
No trial, checkout or card. Every feature is included. Before any paid plan starts, early-access accounts get 30 days’ notice and a founding discount.
Start free- Up to 25 monitored domains
- Daily monitoring and on-demand re-scans
- 365-day posture history
- DMARC (RUA) report analysis
- Email, Slack and webhook alerts
- Clients, share links and branded reports
FAQ
6.1Do I need to sign up to run a check?
No. The public checker is free and needs no account. You only sign up to monitor domains over time and get drift alerts.
6.2How is this different from a one-off SPF or DMARC checker?
One-off checkers show the state right now. AuthDrift re-scans every day and tells you when that state changes — confirmed, de-duplicated and explained in plain English.
6.3Will my clients see AuthDrift?
Reports carry your brand name and accent color. A small "audited by AuthDrift" line stays in the footer.
6.4Why can't you always find a DKIM key?
DKIM selectors can't be listed from DNS, so we probe common defaults and let you add your own. For monitored domains we also learn live selectors from DMARC reports.
6.5Where is my data hosted?
In the European Union. We hold as little personal data as the product allows, hash IP addresses, and let an account owner delete everything at any time. See the Privacy Policy.