Glockapps vs.
DMARC-SRG in 2026

In GlockApps, Microsoft 365 and Google Workspace were grouped quickly under known corporate mail, while SendGrid and Mailchimp were easier to split into transactional and marketing owners. The normal SPF-pass and DKIM-pass cases for Microsoft 365 and Google Workspace appeared as approved before we tested the mismatch case. The unknown sender showed enough IP and authentication context for us to narrow it to a vendor trial, but the UI still asked for human judgment before treating it as approved. SPF pass with visible From mismatch was visible in the authentication drilldown, and the parked-domain spoof sample surfaced as a higher-risk failure rather than just another red row.

DMARC-SRG parsed the same report files into domain, reporting organization, source IP, SPF, and DKIM rows, so Microsoft 365 and Google Workspace traffic was visible after we knew what to search for. SendGrid and Mailchimp were not converted into friendly service names in our setup, and the unknown sender stayed a manual IP and hostname investigation. DKIM pass on a subdomain and forwarded mail with SPF failure were present in the raw result detail, but no guided policy or sender-owner workflow sat on top.

We added the corporate domain, marketing subdomain, and parked domain without building infrastructure, then copied DNS records and waited for aggregate reports. The unknown sender was findable through the source list and authentication drilldown, but we still wanted a clearer owner assignment field. Forwarded mail with SPF failure was understandable after opening the row because DKIM pass carried the message, though the explanation was more DMARC-literate than executive-ready.

DMARC-SRG required mailbox ingestion, database setup, and cron scheduling before the three domains had usable history. Finding the unknown sender meant filtering by month, domain, and source IP, then checking hostnames outside the app. The forwarded mail SPF failure was visible in the result data, but the UI did not turn it into a plain-language explanation for support or marketing.

During GlockApps setup, DNS handoff was easier because the app gave us the reporting destination and validation status for each domain. We wrote our own escalation notes for the support desk sender and the parked-domain spoof sample because the product did not package those findings as a ready handoff. Enterprise onboarding looked commercially available through custom plans, but API and volume questions needed confirmation before rollout.

DMARC-SRG support was the support we provided ourselves: server logs, database checks, mailbox permissions, and documentation. DNS handoff was a manual ticket with the rua address we chose, not a guided flow. Escalation for the unknown sender and forwarded mail case depended on our internal DMARC knowledge, which is acceptable for a technical team and weak for a non-technical owner.

For GlockApps, account separation felt more like users and plan limits than a full MSP control plane. Domain grouping worked well enough for our corporate domain, marketing subdomain, and parked domain, and recurring report exports gave a weekly operating rhythm. Client handoff still needed our own summary when explaining the support desk sender, SendGrid owner, and spoof sample to non-technical stakeholders.

DMARC-SRG was suitable for an SMB or internal team that wanted one self-hosted place to inspect reports, not for an MSP managing many unrelated clients. Account separation and client grouping were absent in the way a managed platform buyer expects, and recurring reporting was summary-oriented rather than client-ready. Handoff depended on the operator writing notes that translate source IPs, DKIM domains, and forwarded mail results.