XENONPEAK

Every check XenonPeak runs on your sending domains

XenonPeak works from two inputs: the DMARC aggregate reports mailbox providers send you, and public DNS lookups of your SPF, DKIM and DMARC records. Here is what it does with them.

01

DMARC report parsing

Mailbox providers send aggregate (rua) reports as zipped or gzipped XML, usually once every 24 hours. XenonPeak receives them at your unique reporting address, decompresses and validates them, and turns each record into a row: reporting organisation, source IP, message count, SPF result, DKIM result and alignment. Reports from Google, Microsoft, Yahoo and other providers that follow RFC 7489 are supported.

02

Sending source inventory

Each source IP is matched to a provider using reverse DNS (PTR) and published SPF ranges, so you see "SendGrid" instead of a list of addresses. New sources are flagged on the day they first appear. You can approve a source, record an internal owner, or mark it as suspected spoofing.

03

SPF lookup budget

XenonPeak resolves your full SPF include tree every hour and counts the DNS lookups that include, a, mx, ptr, exists and redirect mechanisms cost. Over 10 lookups and SPF returns permerror. We show which include adds the most lookups and suggest which to remove, and we flag duplicate or stale includes left behind by tools you stopped using.

04

DKIM key checks

From report data we learn which selectors each sender signs with, then look up each key in DNS. We flag keys under 1024 bits (the minimum Gmail accepts for personal accounts), recommend 2048-bit keys, and catch senders that sign with their own domain instead of yours, which passes DKIM but fails alignment.

Illustrative product interface

05

Policy rollout

The rollout plan moves each domain from p=none to p=quarantine (pct=25, then 100) and then p=reject. A step is suggested only after every approved source has passed alignment for 14 consecutive days. You get the exact TXT record for the next step, including sp= for subdomains.

06

Bulk-sender readiness

A checklist per domain against the published Gmail and Outlook.com requirements for senders of 5,000 or more messages a day: SPF and DKIM passing, DMARC at p=none or stricter, From-domain alignment, valid forward and reverse DNS, and TLS. Spam rate and one-click unsubscribe are listed as manual checks, since they live in Google Postmaster Tools and your sending platform.

07

Alerts

Email alerts for a new unknown source over 100 messages, a pass-rate drop of more than 5 points day over day, any change to your SPF, DKIM or DMARC record, and SPF reaching 9 of 10 lookups. Alerts go to any address you choose, and each one links to the record or source that triggered it.

08

Multi-domain workspace

Add your main domain, sending subdomains such as news. or billing., and parked domains that should never send mail. Parked domains get a lock-down template: v=spf1 -all, an empty DKIM, and p=reject.

09

Export and API

Export any report view as CSV. On Growth and Enterprise, a read-only REST API with token authentication returns sources, daily aggregates and check results as JSON, for your own dashboards or SIEM.

Illustrative product interface

What Gmail and Outlook.com require

Both providers apply stricter rules to domains sending 5,000 or more messages a day to their consumer mailboxes.

Gmail (gmail.com, googlemail.com)
SPF and DKIM, DMARC at p=none or stricter, From-domain alignment, valid PTR, TLS, spam rate under 0.3% in Postmaster Tools, and one-click unsubscribe for marketing mail. DKIM keys must be at least 1024 bits.
Outlook.com (outlook.com, hotmail.com, live.com)
SPF pass, DKIM pass, and DMARC at p=none or stricter aligned with SPF or DKIM. Since May 5, 2025, non-compliant mail is rejected with "550 5.7.515 Access denied".

Summarised from Google's Email sender guidelines and Microsoft's Outlook high-volume sender announcement. Provider rules change, so check their pages for the current text.

Run these checks on your own domain for 14 days

Compare plans Ask a question