Infraova is an email infrastructure operations platform built for agencies, deliverability consultants, and MSPs managing multiple client domains. It continuously monitors 30 infrastructure checks per domain, detects problems before clients notice, generates evidence-backed remediation proposals, executes approved changes through connected DNS providers, verifies every fix, and produces automated white-label client reports.

What email domain checks does Infraova run?

Infraova runs 30 checks per domain continuously. 25 are infrastructure checks: SPF, DKIM, DMARC, DMARC Alignment, Subdomain DMARC, MX Records, PTR/Reverse DNS, Blacklist (50+ lists), SSL Certificate, WHOIS/Domain Age, MTA-STS, TLS-RPT, SPF Enforcement, DMARC Coverage, Subdomain Lockdown, BIMI, DNSSEC, CAA Records, DANE/TLSA, Nameserver Change Detection, Registrar Lock, SPF Record Length, DKIM Key Strength, Google Bulk Sender Compliance, and Null MX. The other five are spoofing detection, Gmail reputation, domain expiry, DNS change history, and sending platform metrics.

How much does Infraova cost?

Infraova offers four plans: Starter at $99/month (up to 10 domains), Growth at $249/month (up to 40 domains, remediation proposals, white-label reports), Agency at $499/month (up to 150 domains, 15-minute monitoring, full verification), and Enterprise with custom pricing for unlimited domains. All plans include a 7-day free trial with no credit card required.

How does Infraova handle remediation?

Infraova generates specific, evidence-backed fix proposals for detected infrastructure problems. Every proposal includes the current state, proposed state, supporting evidence, and risk assessment. Your team approves the change before anything executes. Infraova never silently modifies client DNS. After execution, Infraova rescans the live record to verify the fix took effect.

Does Infraova parse DMARC aggregate reports?

Yes. Infraova ingests DMARC RUA aggregate reports from Google, Microsoft, Yahoo, and other mailbox providers. When an unauthorized sender is detected impersonating a client domain, a critical alert fires with the attacker IP, hostname, and email count.

Is there a free trial?

Yes. All Infraova plans include a 7-day free trial with no credit card required.

Infrastructure

MxToolbox, EasyDMARC, and Infraova: why the tool you choose determines whether infrastructure problems get resolved or just detected

Rodrigue Shema·September 23, 2026·12 min read

The question the comparison misses

Most comparison articles between email infrastructure tools ask the wrong question. They compare feature lists how many blacklists does each tool check, does it support BIMI, what does the report look like. The implicit assumption is that more features means better tool.

The right question is different: what happens after the tool detects a problem?

A tool that detects 30 infrastructure issues and hands them back to the team to investigate, fix, verify, and document is not the same as a tool that detects 30 issues, prepares the fix for 11 of them, waits for human approval, executes the approved change, verifies the live result, and records the outcome.

Both tools detect. One stops there. The other carries the work forward.

This is the distinction that matters for agencies managing client infrastructure at scale not how many checks run, but what happens after each check fires.

What MxToolbox actually does

MxToolbox is a DNS diagnostic utility. It is the tool that most infrastructure teams have bookmarked for quick checks paste a domain, see whether SPF, DKIM, DMARC, and MX are configured, check blacklist status.

What MxToolbox does well:

Fast, free DNS lookups for individual domains
Blacklist monitoring across a wide range of lists
SPF, DKIM, DMARC configuration checking
MX record validation
Raw DNS record display

What MxToolbox stops at:

Detection and display. The tool tells the team what is wrong. The team then investigates, figures out the fix, makes the DNS change, verifies it worked, and documents the outcome manually, every time.
One domain at a time. MxToolbox's free tier monitors a single domain. Paid tiers add monitoring capacity but the operational model remains: alerts go to the team, the team does the work.
No remediation. MxToolbox checks SPF configuration. It does not fix it.
No verification. After a fix is made, MxToolbox will show the new state on the next manual check. It does not proactively verify that the change worked.
No operational history. MxToolbox shows the current state. It does not track score trends, policy progression timelines, or the history of what changed and when.

MxToolbox is a diagnostic tool. It is the right tool for a quick check. It is not an operational system for managing infrastructure across a client portfolio.

What EasyDMARC actually does

EasyDMARC is a DMARC-focused platform that goes further than MxToolbox it is designed to help teams actually complete DMARC policy progression, not just detect that they haven't.

What EasyDMARC does well:

DMARC aggregate report ingestion and visualization turning raw XML into readable sender breakdowns
AI-powered sending source identification recognizing which platforms are sending from a domain and whether they are authenticated
SPF flattening helping teams manage the 10-lookup limit by consolidating includes
Guided DMARC policy progression suggesting when it is safe to move from p=none to p=quarantine to p=reject
Multi-tenant dashboards for agencies managing multiple domains
Direct DNS integrations with Cloudflare, GoDaddy, and Google Cloud DNS for record changes

What EasyDMARC stops at:

DMARC and SPF. EasyDMARC is primarily built around email authentication DMARC policy progression, SPF management, sender classification. It does not run the broader infrastructure checks that Infraova covers: DNSSEC, CAA records, registrar lock, nameserver change detection, MTA-STS, TLS-RPT, DANE, subdomain lockdown, blacklist monitoring with tier classification, PTR records, DKIM key strength, domain expiry, WHOIS status, and more.
The approval model. EasyDMARC can make DNS changes through connected providers, but the workflow is not built around a formal proposal-and-approval model where every proposed change is staged, reviewed, and explicitly approved before execution. What the administrator approves is what executes.
Verification after execution. EasyDMARC does not proactively verify that a change took effect by reading the live DNS record after execution and confirming the expected state was reached.
The broader operational loop. EasyDMARC is strong at DMARC operations. It is not designed to operate the full infrastructure stack authentication, delivery, security, and infrastructure health as a single continuous loop.

EasyDMARC is the right tool for teams whose primary problem is DMARC policy progression and SPF management. For agencies managing the complete infrastructure stack across a client portfolio, it covers part of the operational surface.

What Infraova actually does

Infraova is an email infrastructure operations platform. The distinction is not marketing it reflects a different scope and a different operational model.

30 checks across 4 categories

Every scan runs all 30 checks in parallel the full infrastructure stack, not just authentication.

Authentication (6 checks): SPF, DKIM, DMARC, DMARC alignment, SPF enforcement, DMARC pct Delivery (5 checks): MX, Null MX, PTR/reverse DNS, Google Bulk Sender requirements, BIMI Security (8 checks): Subdomain DMARC, Subdomain lockdown, DNSSEC, CAA records, Registrar lock, Nameserver change, Blacklist (Tier 1/2/3), SSL Infrastructure (6 checks): MTA-STS, TLS-RPT, SPF record length, DKIM key strength, WHOIS/domain expiry, DANE

The blacklist check covers Tier 1 (Spamhaus DBL, Barracuda BRBL), Tier 2 (URIBL, SURBL, SpamCop, SORBS), and Tier 3 (minor/regional lists) with tier classification, shared vs dedicated IP detection, and the exact delisting URL per list. The nameserver change check detects when a domain's nameservers change between scans one of the most significant signals of domain compromise or unauthorized transfer. The WHOIS check tracks domain expiry, registration status, and domain age surfacing warming warnings for new domains under 30 days old.

Source attribution per check

Every check result is stamped with its data source: dns_provider when the connected DNS provider's API was used, public_dns when checks used Cloudflare 1.1.1.1 and Google 8.8.8.8 as fallback, or infraova_verification for checks Infraova runs directly (blacklist, WHOIS, PTR, Google Bulk Sender, SSL). When a connected provider is unavailable, Infraova logs the fallback so the team knows the data source for each result.

A health score that tracks history

Every scan produces a health score from 0 to 100, calculated from the 30 checks across the four categories. The score is stored in scan history alongside the breakdown, trend direction, and consecutive decline count.

Status thresholds: healthy (≥80), warning (60–79), critical (below 60).

Trend signals: improving (+5 points), stable (±5 points), declining (-5 points), critical decline (3+ consecutive declines or score below 60).

MxToolbox shows the current state. EasyDMARC tracks DMARC policy state over time. Infraova tracks the health score trajectory for every domain so a domain that is slowly degrading across multiple checks shows up as a declining trend before it reaches a critical state.

DMARC policy change detection

When Infraova detects that a domain's DMARC policy has changed between scans either progressing forward or being downgraded it fires a specific detection. A policy downgrade from p=reject to p=none triggers a dmarc_policy_downgrade issue with a -20 point deduction for complete loss of protection.

11 auto-remediable checks with approval gates

For 11 of the 30 checks, Infraova does not just surface the problem it prepares the exact remediation:

DMARC missing proposes a safe p=none record with reporting
DMARC RUA reporting injects Infraova's reporting address without touching existing config
DMARC policy progression proposes none→quarantine→reject based on 30-day stability and aggregate evidence
DMARC pct enforcement proposes pct=100 after 30 days of policy stability
DMARC subdomain protection proposes sp=reject when aggregate evidence confirms no subdomain sending activity
SPF missing infers sending platform includes from DKIM selectors and MX records
SPF hardening proposes changing ~all or +all to -all
CAA records reads the live TLS certificate issuer and proposes authorizing that CA
MTA-STS proposes the DNS record after confirming the policy file is reachable
TLS-RPT proposes enabling TLS failure reporting
Null MX proposes the RFC 7505 null MX record for non-sending domains
DKIM publishing proposes publishing a pending key the agency has pasted from their ESP

Every proposal stores the current state, the proposed state, the evidence, and the risk level. The proposal waits for human approval via Slack, email, or inside Infraova. What the administrator approves is exactly what Infraova executes. Nothing changes without that decision.

Approval-gated execution

This is the operational boundary that distinguishes Infraova from every other tool in this comparison.

MxToolbox has no execution capability. EasyDMARC can make DNS changes through connected providers. Infraova can make DNS changes through connected providers but only after a human reviews the proposal and explicitly approves it.

The proposal is not a suggestion. It is a complete operational record: current DNS state, proposed DNS state, evidence supporting the change, risk level, and the connection through which the change will execute. The operator reviews this record and decides. What they approve is exactly what runs.

This is not a limitation it is the correct design for a system that touches client infrastructure. An automated system that modifies DNS records without explicit human authorization is infrastructure risk, not infrastructure management.

Verification after execution

After every approved remediation, Infraova reads the live DNS record to confirm the expected state was actually reached. If the change took effect, the issue is marked resolved and monitoring continues. If the change did not take effect propagation delay, provider error, configuration conflict Infraova flags it immediately.

MxToolbox does not verify. EasyDMARC does not proactively verify the live result after execution. Infraova considers an issue resolved only when the live DNS state confirms it.

Auto-close of resolved issues

When a check that was failing on the previous scan passes on the current scan, Infraova automatically closes the related task. The team does not need to manually close resolved issues. The operational record updates to reflect the current state without manual intervention.

DMARC aggregate report monitoring for spoofing detection

Infraova monitors DMARC aggregate reports for unauthorized senders IP addresses sending email using a client domain without passing authentication. When a spoofing attempt is detected, Infraova surfaces the source IP with reverse DNS, the message count, the current DMARC policy, and whether the policy is blocking the spoofed messages.

The agency can send a spoofing incident report directly to the client's contact email from inside Infraova showing the detection details and the recommended fix if the policy is not blocking.

The capability comparison

Capability	MxToolbox	EasyDMARC	Infraova
SPF check	✓	✓	✓
DKIM check	✓	✓	✓
DMARC check	✓	✓	✓
DMARC alignment	Partial	✓	✓
SPF enforcement	Partial	✓	✓
DMARC pct		Partial	✓
Blacklist (tiered)	✓	Partial	✓ (Tier 1/2/3 + shared IP)
DNSSEC	Partial		✓
CAA records			✓
Registrar lock			✓
Nameserver change detection			✓
MTA-STS	Partial	Partial	✓
TLS-RPT			✓
DANE			✓
Subdomain DMARC		Partial	✓
DKIM key strength			✓
Domain expiry	Partial		✓
DMARC aggregate report ingestion		✓	✓
Spoofing detection		Partial	✓ (with source IP + policy status)
Health score with history		Partial	✓
Score trend tracking			✓
Proposal-based remediation		Partial	✓ (11 checks)
Human approval before execution		Partial	✓ (required, every time)
DNS execution through connected provider		✓	✓
Verification after execution			✓
Auto-close resolved tasks			✓
White-label client reports		✓	✓
Multi-tenant agency dashboard	Partial	✓	✓

Which tool fits which situation

Use MxToolbox when: You need a quick DNS diagnostic for a specific domain. You want to check blacklist status before a campaign. You need to verify a specific record exists. MxToolbox is the right bookmark for fast, free, one-off checks.

Use EasyDMARC when: Your primary challenge is completing DMARC policy progression and managing SPF complexity. You need DMARC aggregate report visualization and sender classification. You are working primarily on the authentication layer and your portfolio is DMARC-focused rather than full-infrastructure.

Use Infraova when: You are managing email infrastructure across multiple client domains and you need the full operational loop not just detection and alerting, but the workflow from detection through approved remediation to verified resolution across the complete infrastructure stack. You need score history, trend tracking, and portfolio-level visibility. You want a system where infrastructure problems are handled before clients notice them, with an audit trail of every change.

The question that decides the comparison

The right question is not "which tool has more checks." Every tool in this comparison covers the basic authentication stack.

The right question is: after a problem is detected, what does the tool do next?

MxToolbox fires an alert. The team does everything after.

EasyDMARC helps with DMARC progression and SPF management. The team handles the rest.

Infraova runs the full operational loop detect, prioritize, propose, approve, execute, verify, record for 30 infrastructure checks across every client domain, continuously. The team steps in at the approval point. Everything else is handled by the system.

That is not a feature comparison. It is a different operating model.

Infraova is an email infrastructure operations platform for agencies, MSPs, deliverability consultants, and businesses managing email at scale. Start operating your infrastructure →