Portfolio Benchmark Audit

It makes point-in-time public DNS checks for a valid DMARC record, DMARC enforcement and aggregate reporting, one valid SPF record and its recursive DNS lookup count, MX publication, and a default-selector BIMI record. It does not access mailboxes, messages, DNS accounts, or private client systems.

Use one organizational website domain per row. A Domain, Website, Host, or URL column works, and extra columns are ignored. The file stays in the browser: only the normalized domains extracted from it are submitted to the DNS audit.

No. The reference cohort measured 566 North American MSP organizational domains observed from a sourced public directory. It did not measure those MSPs' customer portfolios. The comparison provides context for a conversation, not a grade, ranking, security-maturity claim, or causal conclusion.

DMARC adoption is measured across all successfully observed domains, while enforcement and aggregate reporting are measured only among valid DMARC publishers. SPF lookup-limit health is measured only among valid SPF publishers. The report shows every numerator and denominator so a missing record cannot silently enter the wrong metric.

No. Public DNS records show configuration state, not compromise, internal security maturity, mailbox-provider reputation, or final delivery. Use the prioritized findings to decide what to investigate, then verify legitimate senders and message-level authentication before changing an enforcement policy.

The 25-domain version is designed to validate the workflow quickly without an account and without creating unnecessary load on public DNS resolvers. The exported CSV and PDF are complete for that sample; Palisade is the path for ongoing monitoring and larger managed portfolios.