Products / Mail & messages
Hoq Reputation
Checks your domain's email records and reads its DMARC reports for you.
What it does
Add a domain and Reputation reads its SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records from public DNS. It scores each record, lists what is wrong in order of severity, and looks again every six hours.
You get a DMARC report address of your own for each domain. Google, Microsoft, Yahoo and other receivers send their daily aggregate reports there, and Reputation parses them, checks alignment, and shows which servers send mail as your domain.
Before you move to quarantine or reject, the readiness page runs seven gates against the reports you have. It shows the measurement behind each one and the senders a stricter policy would have hit over the days already reported. When a gate fails, it says what is missing.
When a record changes or disappears you get an email or a webhook call. A finding has to show up on two scans ten minutes apart before it alerts, and each domain sends at most three alerts a day. Everything else goes into a digest.
In numbers
6DNS records checked on every domain
6 hbetween automatic rescans
7readiness gates before quarantine or reject
99%DKIM alignment needed before it suggests enforcing
3alerts per domain per day, at most
Specifications
| Records checked | SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, each scored on its own. BIMI is not scored until DMARC is enforcing. |
|---|---|
| How often | Every domain is rescanned every 6 hours, and you can ask for a scan at any time. |
| SPF lookup limit | Counts the DNS lookups your SPF record causes, includes and all, against the limit of 10 in the SPF standard. |
| DKIM key strength | Keys under 1024 bits are flagged as too weak. Keys Reputation makes for you are 2048-bit RSA. |
| DMARC reports | Each domain gets its own report address. Aggregate (rua) reports are parsed, checked for alignment and rolled up by day and by sending source. |
| Who is sending | Sending servers are named from their network and a reverse DNS name that must resolve back to the same address, so a forged name does not pass as a known provider. |
| Before you enforce | At least 21 days of finished reports (30 for reject), at least 2 reporters including Google, Microsoft or Yahoo, DKIM alignment of 99% or more, and under 10% of failing mail from unnamed senders. |
| DKIM key rotation | A rotation always starts a new selector. The old key stays published for 14 days before it can be revoked, and a key is not switched on until it is visible in DNS. |
| Stored keys | Private DKIM keys are stored envelope-encrypted, and every time someone reveals one it is recorded with who and from where. |
| Alerts | Email or an https webhook. Confirmed on two scans 10 minutes apart, the same cause is not repeated within 6 hours, and a domain sends at most 3 alerts a day. |
| Proving a domain is yours | Publish a TXT record at _rep-verify on the domain. Checking public records needs no proof; reports and DKIM keys do. |
| Sign-in | Hoq ID. |
Features
21 features, all shipped. Listed from the product's code and documentation; each row shows the day it was last checked.
| Six records scored | Scores SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI separately, with no single blended grade. | |
| Findings by severity | Lists each problem as critical, serious, warning or info, worst first. | |
| SPF lookup count | Follows every include and counts the lookups against the limit of 10. | |
| MTA-STS policy fetch | Fetches and checks the MTA-STS policy file your domain publishes. | |
| A failed lookup is not a failed record | When DNS cannot be asked, that check is left out of the score instead of scored zero. |
| Your own report address | Gives each domain a report address to put in its DMARC record. | |
| Alignment checked | Works out SPF and DKIM alignment for every reported message from the published policy. | |
| Reports counted once | A report delivered twice is stored once. | |
| Report charts | Charts messages, pass rates and reporters by day for each domain. |
| Senders named | Names known mail services from the sending server's network and confirmed reverse DNS. | |
| Review queue | Lets you mark each sender as yours, not yours, or ask again later. |
| Readiness gates | Seven pass, fail or too-early checks, each showing the number it measured. | |
| Policy simulator | Shows how many reported messages a quarantine or reject policy would have caught, and from which senders. | |
| Rollback record | Writes the record to go back to before you make the change. |
| Key generation | Makes a 2048-bit key and gives the TXT record both whole and split into 255-character pieces. | |
| Publish check | Checks the record is live in DNS before the key can be switched on. | |
| Rotation by selector | Rotates to a new selector and keeps the old one for 14 days. |
| Record-change alerts | Alerts at once when DMARC or SPF disappears, a second DMARC record appears, or a policy breaks. | |
| Digest | Sends a summary built from finished days only, and once a month even when nothing changed. | |
| Webhooks | Posts alerts to an https address you give. |
| REST API | Lists and adds domains and reads their checks and findings with a rep:use key. |
Your data
| Where it is kept | In Hoq's database on Hoq's own servers. DKIM private keys are envelope-encrypted there. |
|---|---|
| Getting it out | The REST API returns your domains, checks and findings as JSON. There is no download of raw reports yet. |
| If you leave | Removing a domain archives it and keeps its report history. A full account deletion flow is not published. |
APIs and standards
- REST API: GET/POST /v1/subjects, GET /v1/subjects/{id}, /v1/subjects/{id}/checks, /v1/subjects/{id}/findings with a Bearer key (scope rep:use)
- Webhooks: alerts posted to your https endpoint
- Email alerts and digests with one-click unsubscribe
- Standard: DMARC (RFC 7489)
- Standard: SPF (RFC 7208)
- Standard: DKIM (RFC 6376)
- Standard: MTA-STS (RFC 8461)
- Standard: TLS-RPT (RFC 8460)
- Standard: BIMI
Compared
| Checked 2026-11-01 | Hoq Reputation | dmarcian | Valimail |
|---|---|---|---|
| Cheapest paid plan | Not published | Basic: $19.99/mo billed yearly, $24 billed monthly1 | Enforce Starter: custom quote2 |
| Free plan | Not published | Personal: 2 domains, 1,250 messages/month, 1 month of history1 | Monitor: free, 5 users2 |
| Report history kept | Kept while the domain is active or archived; no published limit | 1 month (free) to unlimited (Enterprise)1 | not published2 |
| Records checked | SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI | DMARC, SPF, DKIM inspectors listed1 | DMARC, SPF, DKIM, BIMI listed2 |
| DKIM key management | Generates 2048-bit keys, checks DNS, rotates by new selector | not published (DKIM inspector and validator listed)1 | Automated DKIM on paid Enforce plans2 |
| SPF beyond 10 lookups | Counts and warns; does not host or flatten SPF | not published1 | Unlimited SPF on paid plans; 10 lookups on free2 |
| API | Included: domains, checks and findings | API access listed; plans not stated1 | Add-on on Starter and Premium, included in Enterprise2 |
| Single sign-on | Hoq ID | not published1 | SSO/SAML on Enterprise2 |