DMARC, SPF & DKIM monitoring
Your invoices shouldn't land in spam.
When your quotes and client replies quietly go to junk, you lose deals and never know why. Since Gmail and Yahoo tightened the rules, "it used to work" isn't enough. Lavawall® tunes and monitors your SPF, DKIM, and DMARC so your legitimate email reaches the inbox, and shows you exactly who's trying to send as your domain.
Check my domain free See how it works
Reach the inbox · stop spoofing · move to enforcement safely
From "why are we in spam?" to inbox
See every service sending as you
DMARC reporting reveals every source sending email under your domain, your marketing platform, your invoicing tool, and the attacker spoofing you to phish your clients. You can't fix what you can't see; Lavawall makes it visible.
Fix SPF and DKIM the right way
Lavawall pinpoints the failing records, the SPF lookup limit you blew past, the service missing DKIM, and shows you what to change, so legitimate mail authenticates instead of getting filtered.
Move to enforcement without blocking yourself
DMARC only protects you at "quarantine" or "reject", but jump there blind and you block your own invoices. Lavawall monitors your real mail first and walks you safely from "none" to enforcement, so you get protection and deliverability.
Stay monitored, not set-and-forget
New sending services and drifting records break deliverability all over again. Lavawall keeps watching and alerts you before your email starts hitting spam.
SPF, DKIM and DMARC, in plain English
SPF says which servers may send as you, DKIM signs each message so a receiver can prove it was not tampered with, and DMARC ties the two together and tells receiving servers what to do when a message fails. All three live in your DNS.
Two things quietly break this. SPF is capped at 10 DNS lookups, add one sending service too many and the whole record hits permerror and stops authenticating. And in February 2024, Google and Yahoo began blocking mail from any organization sending over 5,000 messages a day without DMARC configured. Lavawall® shows you exactly which record is failing and why.
DMARC has three enforcement states, and only the last two actually protect you:
- p=none — deliver, just report. Monitoring only.
- p=quarantine — send failing mail to spam.
- p=reject — refuse failing mail at the receiving server.
Lavawall® steps you there with the pct= tag, quarantine at pct=10, reject at pct=25, up to pct=100, only once your reports show nothing but authorized senders in the failing column, so you reach enforcement without blocking your own invoices.
Fix the sender, not just the symptom
When a legitimate service like Mailchimp, SendGrid or Amazon SES fails alignment, Lavawall® names the misconfiguration and hands you the exact SPF and DKIM records to publish, so your marketing and invoicing mail authenticates instead of landing in junk.
Part of the bigger picture
Free domain scan (Scout)
Check your SPF, DKIM, DMARC, and external exposure in seconds, two domains free, forever.
Run a free scan →DMARC module
Ongoing monitoring, reporting, and guided enforcement for every domain you run.
Learn more →Phishing Reporter
Spoofing that gets past DMARC still lands somewhere, one-click reporting with instant verdicts catches it.
Reduce phish tickets →Losing deals to the spam folder?
ThreeShield, the CISSP/CISA team behind Lavawall® will audit your email authentication, fix what's failing, and get you to safe DMARC enforcement so your mail lands and no one spoofs your brand.
Common questions
- Why is our email going to junk when nothing changed on our end?
- Usually SPF, DKIM, or DMARC drifted, a new sending service, an SPF lookup limit, or DMARC left at "none" so providers don't trust you. Gmail and Yahoo tightened their rules, so "it used to work" isn't enough. Lavawall shows exactly which records fail and why.
- Isn't DMARC risky? I've heard it can block our own mail.
- Only if you jump to enforcement blind. Lavawall monitors your real mail first, shows every legitimate sender, and helps you fix SPF/DKIM before moving to quarantine or reject, so you never block your own invoices.
- Will this show spoofing of our domain?
- Yes, DMARC reporting reveals who's sending as your domain, including attackers spoofing you to phish your clients, so you can shut it down.