Built for Microsoft 365

Enterprise DMARC visibility.
Not enterprise pricing.

Someone could be sending phishing emails pretending to be you right now. DMARC stops that. Sentura ingests your DMARC reports, maps every sender, and guides you from p=none to p=reject — for a fraction of what the big platforms charge.

Start free 14-day trial Book a demo
No credit card  ·  Cancel anytime  ·  Setup in under 10 minutes
Domain posture
acme.com
SPF DKIM p=none
mail.acme.com
SPF DKIM no record
Enforcement path — acme.com
p=none
p=quarantine
p=reject
Readiness score
78%
Classifies senders from Microsoft 365 SendGrid Mailchimp HubSpot Zendesk DocuSign Proofpoint Mimecast + dozens more
How it works

From blind to protected in three steps

No agents to install. No MX record changes. Connect your DMARC mailbox and Sentura does the rest.

1

Monitor

Point your DMARC rua= tag at a shared mailbox. Sentura ingests reports automatically via Microsoft Graph and shows you every sender.

2

Classify

Every source IP is matched against a global provider library. Legitimate senders are identified by name. Unknown sources are flagged for review.

3

Enforce

Once every sender is classified, Sentura gives you a clear readiness score and guides you safely from p=none to p=quarantine to p=reject.

Features

Everything you need.
Nothing you don't.

The big DMARC platforms are built for Fortune 500 teams with dedicated security engineers. Sentura is built for the IT admin managing everything.

Microsoft Graph API ingestion

Point your rua= tag at a shared mailbox. Sentura polls it automatically via Microsoft Graph — no forwarding rules, no credentials shared, no manual downloads.

Automatic sender classification

Every source IP matched against a global provider library. Microsoft 365, SendGrid, Mailchimp — identified by name, not just IP address. Unknown senders flagged immediately.

Enforcement readiness scoring

A live readiness score per domain. Know exactly what's blocking you from p=reject — and get a clear signal when it's safe to tighten policy.

Spoofing detection and alerts

New unknown senders, failure spikes, and previously passing senders that start failing — all surfaced immediately with actionable alerts.

Multi-domain dashboard

All your domains in one view. SPF, DKIM, and DMARC health checked live. Sender inventory, trend charts, and failure drill-down — no switching between tools.

As-built .docx reports

Generate a professional email authentication posture report in one click — ready for audits, compliance reviews, or presenting to leadership.

Sentura shield
Why Sentura

More included. Transparent pricing.
No add-ons. No surprises.

The big platforms gate enforcement features behind add-ons or "contact sales" pricing. Every Sentura plan includes the full feature set — you only pay more for more domains.

Sentura dashboard
Feature Sentura Provider A Provider B Provider C
Starting price$19/month$19/month$8/month$35.99/month
Enforcement readiness included✓ all plansPaid upgradeAdd-onHigher tier
As-built reports included✓ all plans———
Microsoft Graph API ingestion✓✓——
Entra ID native authentication✓———
Pricing modelPer domainVolume-basedVolume-basedVolume-based
Transparent public pricing✓Contact salesPartial✓
Multi-tenant management✓ BusinessEnterprise only✓Paid add-on
Pricing

Simple, domain-based pricing.
No volume traps.

Pay per domain, not per email. Your bill stays flat whether you send 10,000 or 1,000,000 emails a month. Every plan includes the complete feature set.

Pricing
Starter
$19/month
For small organisations getting visibility into their email authentication posture.
✓3 domains
✓2 users
✓Graph API + manual ingestion
✓Sender classification
✓SPF / DKIM / DMARC health
✓Enforcement readiness scoring
✓Alerts and notifications
✓As-built .docx reports
✓90-day data retention
Start free trial
Most popular
Pro
$59/month
For organisations managing multiple domains or needing longer data history.
✓10 domains
✓5 users
✓Everything in Starter
✓12-month data retention
✓Priority support
Start free trial
Business
$129/month
For MSPs and IT teams managing email authentication across multiple customers.
✓25 domains
✓10 users
✓Everything in Pro
✓Multi-tenant management
✓White-label reports
✓24-month data retention
✓Dedicated onboarding
Start free trial

All plans include a 14-day free trial. No credit card required. Annual billing saves 20%.

14-day free trial  ·  No credit card

See who's really sending
on your behalf.

Connect your DMARC mailbox. Get your first report parsed
and your senders classified in under 10 minutes.

Start free trial Book a demo
Trusted by IT teams and MSPs
FAQ

Frequently asked questions

What is DMARC?+
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that lets domain owners tell receiving mail servers what to do with messages that fail SPF and DKIM checks. It also provides a reporting mechanism so you can see who is sending email on behalf of your domain — including attackers trying to spoof it.
Why is p=none not enough?+
A DMARC policy of p=none tells receiving servers to take no action on failing email — it only generates reports. This means spoofed emails pretending to be from your domain are still delivered to inboxes. p=none is a necessary first step for visibility, but you need to move to p=quarantine or p=reject to actually stop spoofing. Sentura helps you make that transition safely by classifying every sender first.
What is SPF?+
SPF (Sender Policy Framework) is a DNS TXT record that lists all the mail servers and services authorised to send email on behalf of your domain. When a receiving server gets an email, it checks the sending IP against your SPF record. If the IP is not listed, the check fails. SPF has a limit of 10 DNS lookups, so managing it carefully is important as you add more services.
What is DKIM?+
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. The receiving server uses a public key published in your DNS to verify the signature. If the signature is valid, it proves the email was not tampered with in transit and was genuinely sent by an authorised system. DKIM works alongside SPF and is required for DMARC alignment.
How long does DMARC enforcement take?+
It depends on how many services send email on your behalf and how quickly you can classify them all. For a simple domain with one or two senders, you could move to p=reject within a few weeks. For organisations with many third-party senders, it typically takes 4 to 12 weeks of monitoring at p=none, followed by a gradual rollout through p=quarantine. Sentura tracks your readiness score in real time so you know exactly when it is safe to tighten policy.
Can I use one mailbox for multiple domains?+
Yes. You can point the rua= tag for all your domains at a single shared mailbox in Microsoft 365. Sentura will ingest reports from that mailbox and automatically separate the data by domain. This is the simplest setup for organisations managing multiple domains — one mailbox, one Graph API connection, full visibility across everything.