What does a public DNS comparison tell you?
It compares the published records observed at one time with the records observed at another. It can identify a difference that needs explanation. It does not show every message sent between checks, who approved a change, or whether a mailbox was accessed. A weekly comparison is a scheduled observation, not continuous incident detection.
Record what was checked, when, whether the lookup completed and what changed. Report failed lookups as missing observations—not unchanged or safe configurations.
What is different about authentication reports?
DMARC aggregate reports summarize authentication observations from reporting receivers. Microsoft's documentation shows report fields for source addresses, counts, policy evaluations, and authentication results. These reports provide another kind of evidence, but they are not a complete transcript of every email or proof of an attacker's intentions. Source
Name who receives and interprets reports. Summarize recognized services, unfamiliar sources, legitimate failures, collection gaps and changes since the last review—not unexplained charts.
What does a good monthly summary look like?
State the domain and evidence period, changes, required actions, owners and unknowns. Explain quiet months without inventing threat counts.
- Observations completed and any missing data.
- Record changes and the business explanation, where confirmed.
- Sender issues requiring investigation or approval.
- Actions taken within scope, with supporting evidence.
- Open exceptions, responsible people, and the next agreed step.
How do setup and continuing review differ at Kova Shield?
Shield Setup is $750 for one business domain and up to three approved sending services. It includes the agreed sender review, proposed DNS changes, written approval, post-change checks and a dated Shield Record with open items. Optional Managed Review is $149/month under a separate agreement. Confirm its checks, schedule, written summary and handling of out-of-scope issues before work begins; setup does not start a subscription.
See setup scope and optional review.
Extra domains, senders, migrations, complex routing and incident response need separate scope. Confirm operator, timing, access, data handling and limits in writing; a recurring charge does not assign those responsibilities.
Could our existing administrator cover this?
Possibly. Compare domains, senders, checks, interpretation, written evidence and unresolved-issue ownership. If your administrator already covers the work, another subscription may add no useful responsibility. Name any gap before requesting a separate agreement.
What should happen between scheduled reviews?
Tell the administrator when you add or retire a sender or change providers; do not wait for the monthly summary. Keep the inventory and approvals available to the reviewer.
An urgent account or payment concern needs the organization's incident process, not the next scheduled DNS comparison. Ask about that boundary before buying ongoing work. The service should make responsibility clearer, including the circumstances in which a different specialist or immediate response is needed.