How trustedMARC handles your data
Last updated: June 2026
The short version: trustedMARC runs on your own machine. Your DMARC report files, and everything it works out from them, stay on your computer. They are never sent to us or to any DMARC service. The only connections it makes are a few optional lookups that you can turn off, and a check of your licence key.
What stays on your machine
The report files you load (your .zip, .gz and .xml aggregate reports), everything parsed from them, and the dashboard trustedMARC builds all stay local to your computer. There is no trustedMARC server that receives, stores, or can read your email authentication data. With the optional lookups below switched off, the application runs entirely offline.
The connections it does make
To turn raw reports into something useful, trustedMARC can reach out for a small amount of supporting information. None of these send the contents of your reports:
IP geolocation (optional). To show where a sending IP address is located, trustedMARC looks the address up against a geolocation service. This sends the IP addresses from your reports, and nothing else, to that service. You can turn geolocation off, and the rest of the report still works.
DNS lookups. To name senders by their domain (reverse DNS) and to check your live SPF, DKIM and DMARC records, trustedMARC performs ordinary DNS queries. These are the same kind of lookups your computer makes whenever you visit a website, and they involve domain names and IP addresses, not the contents of your reports.
Licence check. To confirm your licence is valid, trustedMARC contacts our licensing provider. This sends your licence key, not your report data.
What we can see
As the makers of trustedMARC, we never receive your DMARC reports or any of the email data inside them. The only information we hold about you is what you give us when you buy a licence: your name, email address and licence record, which we use to issue your key and provide support. You can read the full detail in our Privacy Policy.
No account, no tracking
There is no user account to create, and no usage analytics or telemetry. trustedMARC does not report back on how you use it or what is in your reports. The only outbound traffic is the optional lookups and the licence check described above.
Running it fully locally
If you would rather no third party sees even the sending IP addresses, turn geolocation off and trustedMARC will not contact the geolocation service. Sender naming and the live record checks still use standard DNS, which is needed to identify senders and verify your DNS. For the most self-contained run, work from the report data alone with the optional lookups disabled.
Questions
If anything here is unclear, or you need detail for a security review, get in touch at hello@trustedmarc.co.uk.