Is someone
sending emails
pretending to be you?
Sentinel monitors your domain's email authentication, DNS configuration, and SSL certificates — continuously, automatically, and for free.
What happens when
email authentication fails.
Domain spoofing
Attackers send emails from your domain without touching your servers.
A missing or weak DMARC record means anyone can set your domain as the sender address. No login required. No access to your infrastructure. Just a free AWS account and a CSV of email addresses.
We experienced this attack twice on our own domain. The second time, 10,000 emails were sent in a single day.
SSL expiry
Your certificate expires on a Friday evening. Nobody notices until Monday.
Let's Encrypt renewals fail silently. Cron jobs stop running. Certificates expire. Your customers see browser security warnings and assume you've been hacked. Your support inbox fills up over the weekend.
SSL expiry is the most preventable outage in software. 65% of organisations have experienced it.
Silent M365 misconfiguration
DKIM signing was never enabled for your custom domain.
Microsoft 365 doesn't enable DKIM for custom domains by default. Your emails are signed with the onmicrosoft.com key. They fail DMARC alignment. They go to spam. You don't know because there's no alert — the emails just quietly underperform.
This is the most common misconfiguration we find. It affects most M365 tenants that migrated from another provider.
Add your domain
Enter yourcompany.com. No DNS changes required. No installation. No agents to deploy on your servers. Sentinel reads your public DNS records — that's it.
We scan continuously
SPF, DKIM, DMARC, SSL certificates, MX records, MTA-STS, and Microsoft 365 configuration — checked every 6 hours from multiple locations. Results stored with full history.
Get alerted before problems become incidents
Email, Slack, webhook, or Microsoft Teams when anything changes or degrades. SSL expiry warnings at 30 days and 7 days. DMARC failures within the hour they happen.
Every check.
No surprises.
Ready to monitor continuously?
Free for 3 domains. Checks run every 6 hours. No credit card required.
Common questions.
No. Sentinel reads your public DNS records over HTTPS. No DNS changes, no server access, no agents, no code to deploy. You add a domain name and we handle the rest.
We check whether DKIM signing is enabled for your custom domain (not just the onmicrosoft.com default), whether your Conditional Access policies have country-based restrictions, MFA configuration gaps, and your outbound sending limit usage. We surface the gaps that M365's own dashboard buries in menus most admins never visit.
MXToolbox is a manual, point-in-time checker. You run it when you remember to. Sentinel is continuous monitoring — we run the equivalent of MXToolbox every 6 hours, store the history, alert you the moment anything changes, and generate a compliance report from the results. MXToolbox tells you what's wrong today. Sentinel tells you the moment something goes wrong.
Yes. All data is stored in Frankfurt, Germany (AWS eu-central-1). We are an Italian company operating under EU law with GDPR-compliant data processing. Data processing agreements are available in English and Italian.
The report maps each of your findings to the relevant NIS2 Article 21 sub-clause, shows which controls are passing and which are failing, includes the specific remediation steps for each failure, and generates a dated PDF you can share with customers, auditors, or the Italian ACN. It is an automated technical controls assessment — not a legal certification, which we state clearly in the report.
Yes. The free tier covers 3 domains. Pro and Team cover unlimited domains. All domains are monitored on the same schedule and shown in a unified dashboard. You can add subdomains separately — for example monitoring yourcompany.it, mail.yourcompany.it, and news.yourcompany.it as three separate entries.
You receive an alert via your configured channel (email, Slack, webhook, or Microsoft Teams) with the specific finding, its severity, and the exact remediation step to fix it. We don't send you a vague "something is wrong" message — we tell you which check failed, why it matters, and what to change in your DNS or M365 configuration.
Still have questions? hello@groundcontrol.land