DNSCitadel: DMARC & DNS Health

InterconX Limited

About this app

DNSCitadel grades the DNS and email security of every domain you look after, A to F, across 17 checks. When something critical changes, such as a weakened DMARC policy, a registrar change or a certificate close to expiry, the alert reaches your phone.

Built for MSPs and IT teams who manage domains for their clients, and for organisations that watch their own.

WHAT IT CHECKS
• Email authentication: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI and DANE.
• DNS integrity: DNSSEC, CAA, name-server health and wildcard records.
• Domain and certificate lifecycle: domain expiry, registrar transfer lock, certificate expiry, subdomain takeover and blocklist listings.
Each check is marked pass, warning or missing, explained in plain English, with what to do about it.

ON YOUR PHONE
• Your whole portfolio at a glance: grades, ungraded and parked domains, and open alerts by severity.
• Push notifications for critical alerts. Tap one and it opens that alert.
• Rescan a domain after a change and see the new grade.
• DMARC traffic: who sends mail as each domain, from the aggregate reports it receives.
• Citadel Reports: open a client's plain-English, letter-graded report and share the PDF.
• Share a public scan result with a link.
• Choose which alerts reach you by email, push, Slack, Teams or webhook.

FIXES YOU CONTROL
Scanning needs no access to your DNS: DNSCitadel reads what the internet can already see. Connect a Cloudflare account and you can apply a fix to a zone you have opted in, after reviewing it, with a snapshot taken first so it can be rolled back. For any other DNS host you get the exact record to publish.

SECURE BY DEFAULT
• Lock the app with your fingerprint, face unlock or device PIN.
• Your sign-in is kept in the device's secure keystore.
• Delete your account from Settings at any time.

You need a DNSCitadel account. You can create one in the app or at dnscitadel.com.

What’s new

• Grades the DNS and email security of every domain you manage, A to F, across 17 checks
• Push notifications for critical alerts, such as a weakened DMARC policy, a registrar change or an expiring certificate
• DMARC traffic: who sends mail as each domain
• Open and share Citadel Reports for your clients
• Apply reviewed fixes to Cloudflare zones, with a snapshot taken first
• Lock the app with your fingerprint, face or device PIN