Postmark DMARC Monitoring: Run the Weekly Review

Postmark DMARC monitoring is a free service that turns aggregate DMARC data into a weekly email summary. It is a practical starting point when one owner can review a domain on a weekly cadence and follow up with the people responsible for each sending service. It is not a complete enforcement program by itself. The value comes from a repeatable review that separates known senders, unknown sources and authentication failures, then assigns each finding to an owner.

What Postmark's Free DMARC Service Does

The Postmark DMARC monitoring page describes a free weekly email that processes reports from participating mailbox providers and turns DMARC alignment data into a readable summary. The setup begins with an email address and the domain to monitor. Postmark then provides a DMARC DNS record whose aggregate-reporting address sends data to its service.

That solves an important formatting problem. Aggregate reports arrive as XML and group activity by source and authentication result. Postmark's DMARC guide says those reports include the sending source, such as a domain or IP address, plus SPF and DKIM pass or fail results. The digest makes that evidence easier to scan, but it does not decide whether a sender is approved or whether a message reached the inbox.

Our view: Postmark's free digest is best treated as a weekly control for a small, understood sending estate. It earns its place when the recipient has the authority and time to investigate what changed. An unread summary is not monitoring, and a green result is not permission to stop maintaining the sender register.

Enroll the Domain Without Losing Existing Reporting

Start by finding the current DMARC record at _dmarc.yourdomain.com. Record its present policy, reporting destinations and alignment settings before editing anything. The Postmark DMARC FAQ says its setup creates a valid DMARC record and that the first weekly digest should follow after the record is published and Postmark begins receiving data.

If the domain already sends aggregate reports somewhere else, do not silently replace that destination. The same FAQ explains that the rua tag can contain multiple email addresses. That means an existing archive or analyzer can continue receiving raw reports while Postmark receives a copy. Have the DNS owner validate the final syntax, publish the TXT record and save the old and new values with a change timestamp.

Then verify the public result from more than one resolver. Confirm that exactly one DMARC policy record is returned for the domain and that the Postmark reporting address appears in rua. DNS publication proves only that the request exists. Data still depends on receivers generating reports and sending them to the listed destination.

Read Each Weekly Digest in the Same Order

A fixed sequence keeps a large source from hiding a risky one and prevents a single red label from driving an unplanned DNS edit.

1. Confirm the Scope

Check the domain, reporting period and total represented volume. Compare them with the prior digest and with known business events. A sharp change may reflect a product launch, billing run, recruiting campaign or a reporting gap. It is a prompt to investigate, not evidence of abuse by itself.

2. Classify Every Source

Use three states:

Do not authorize a sender because its name looks familiar. Match it to a contract, application owner, campaign or system record. A service discovered in DMARC data is evidence of use, not evidence of approval.

3. Separate Passing From Failing Traffic

DMARC depends on SPF or DKIM passing with an identifier aligned to the visible From domain. A known source that fails needs an authentication review. Check the actual From domain, return-path domain, DKIM signing domain and the vendor's current setup instructions before editing DNS.

An unknown source that passes deserves priority because it may have a valid path to authenticate as the domain. An unknown source that fails may be attempted spoofing already being identified by the policy. Preserve the evidence and examine volume and pattern before deciding that a system is broken.

4. Assign the Next Action

Each legitimate sending service needs a business owner and a technical owner. The business owner confirms that the service should send. The technical owner corrects SPF, DKIM or alignment and supplies a test message. Record the source, represented volume, decision, owner, due date and verification result outside the email thread.

LeadHaste practice: keep a sender register and reconcile the digest against it every week. This is an editorial operating recommendation, not a Postmark feature claim. The register should include the domain, service, purpose, owner, approved From domain, authentication path, last-seen date and retirement decision.

Know What the Digest Does Not Prove

A DMARC digest is authentication and policy evidence. It does not show whether every message reached the primary inbox, whether recipients engaged, whether content triggered filtering or whether a campaign was wanted. Postmark's guide describes DMARC reports in terms of source, SPF and DKIM results. Do not turn that scope into an inbox-placement claim.

The weekly view also creates a timing boundary. A failing sender may appear only when the next digest arrives. If the business needs same-day response, a weekly summary is too slow, even if it remains useful for review.

The free service has documented processing limits. Postmark's FAQ says it fully processes reports with fewer than 100,000 records and truncates larger reports to the first 100,000 items. It lists a 3 MB maximum for storing an unarchived report; for larger reports it extracts metadata and discards the report. The same page says report metadata is available through the API for up to two weeks. These limits matter more as volume and investigation needs grow.

Decide When a Paid Analyzer Is Necessary

Do not upgrade merely because a paid dashboard exists. Upgrade when the operating requirement exceeds what a weekly email and short metadata window can support.

A fuller analyzer becomes easier to justify when:

• several domains or business units require separate ownership and roll-up reporting;
• an incident team needs alerts sooner than the weekly cadence;
• investigations require retained history beyond the documented free window;
• multiple operators need role-based access, comments or tracked remediation;
• analysts need to pivot across sources, domains, providers and time periods;
• policy changes require approval records and staged enforcement evidence;
• report size approaches the free processing or storage limits.

The current Postmark monitoring page also presents a paid DMARC Digests option with a web dashboard, report history, recommendations, user management and email digests. Treat those as vendor-described capabilities and test the proposed plan against a real investigation. The buying question is not whether the paid view has more features. It is whether it replaces manual work or closes a response gap that the weekly email cannot.

Run a Four-Week Acceptance Test

Use four digests before deciding the free service is sufficient. Include one normal week, one known campaign or system event and, if safely possible, one controlled authentication correction.

For each digest, record arrival time, covered period, source classification, represented volume, assigned action and closure evidence. Confirm that a new legitimate sender can be identified, that a known failing sender can be corrected, and that the next available data reflects the change. Do not manufacture spoofing or weaken a live policy to create a test.

At the end, ask whether every source got an owner, the cadence and history were sufficient, and another operator could reconstruct each decision. Keep the free service if the answers are yes. Escalate if unknowns recur, incidents wait for the next digest or evidence disappears before review.

A weekly DMARC email becomes useful only when it produces owned work. Build the review loop first, then buy more software if the loop needs faster signals, longer evidence or better coordination.

If you want to map your sending domains, service owners and monitoring requirements before choosing a DMARC tool, book a free ICP and campaign-fit discovery call →.