KDmarc review 2026

KDmarc identified Microsoft 365 and Google Workspace as expected sources after SPF and DKIM passed against the visible From domain. SendGrid and Mailchimp needed sender labels cleaned up before the dashboard became readable, and the support desk sender stayed unknown until we mapped its return-path pattern. The DKIM pass on the marketing subdomain appeared under subdomain activity, which helped, but the product did not turn that edge case into a clear policy-change recommendation.

The comparison run treated the same sources as an ownership workflow rather than a report review step. Microsoft 365, Google Workspace, SendGrid, Mailchimp, and the support desk sender landed in clear service groupings, and the unknown sender was easier to route to the right internal owner. The forwarded mail SPF failure was separated from spoofing, which reduced time spent explaining a harmless failure to non-email teams.

Onboarding the primary corporate domain, marketing subdomain, and parked domain was straightforward once DNS records were copied, but the parked domain created more empty-state noise than expected. The unknown sender sat in the source list without enough context, so we had to compare IPs and return-path values before classifying it. The forwarded mail SPF failure was visible, but the UI did not explain clearly that DKIM kept the message in the safe category.

In the comparison run, the same tasks were structured differently: domains, sender classification, and forwarding explanations appeared closer to the action item. The three domains were separated by purpose, the unknown sender carried stronger classification hints, and the forwarded SPF failure stayed attached to the passing DKIM result in the same event trail.

During setup, KDmarc's DNS handoff was clear enough for a technical administrator, with records and policy steps separated by domain. Escalation felt more formal than conversational: useful for a team with a security SPOC, less useful when a marketer needed to understand why Mailchimp passed DKIM but still needed sender approval. Enterprise onboarding looked plausible because IAM, SSO, domain groups, and technical SPOC language exist in product material, but buyers still need to confirm which items apply to the chosen tier.

In the comparison run, support context stayed attached to the finding. Microsoft 365 and Google Workspace records needed little help, but the SendGrid, Mailchimp, and support desk cases benefitted from fix-oriented notes that could be handed to the right owner. For escalation, the main difference was that the context stayed attached to the issue instead of living only in a separate support exchange.

KDmarc worked best in our test when one owner reviewed the primary domain and marketing subdomain together, then kept the parked domain in a quieter group. Account separation was adequate for internal domain grouping, but it did not feel like a full recurring client-handoff workflow. The executive and scheduled report options helped for enterprise review meetings, especially for the spoof sample and the blocklist (blacklist) checkpoint.

The comparison run felt better matched to teams that need recurring ownership loops. Domain grouping, sender owner notes, and client-style reporting made the Microsoft 365, Google Workspace, SendGrid, Mailchimp, and support desk cases easier to separate without losing the enforcement thread. SMB teams also benefitted because the parked-domain review stayed simple instead of becoming another dashboard to inspect.