What does a public DNS comparison tell you?
It compares the published records observed at one time with the records observed at another. It can identify a difference that needs explanation. It does not show every message sent between checks, who approved a change, or whether a mailbox was accessed. A weekly comparison is a scheduled observation, not continuous incident detection.
We recommend a record that states what was checked, when it was checked, whether the lookup completed, and what changed. A failed lookup should be reported as a failed observation rather than silently presented as an unchanged or safe configuration.
What is different about authentication reports?
DMARC aggregate reports summarize authentication observations from reporting receivers. Microsoft's documentation shows report fields for source addresses, counts, policy evaluations, and authentication results. These reports provide another kind of evidence, but they are not a complete transcript of every email or proof of an attacker's intentions.
Ask who receives the available reports and who interprets them. We recommend a summary that separates recognized services, unfamiliar sources, legitimate failures requiring investigation, and collection gaps. Explain what changed since the previous review rather than sending an unexplained chart and leaving the owner to guess.
What does a good monthly summary look like?
It should answer the owner's practical questions: what changed, whether an agreed action is needed, who owns it, and what remains uncertain. Include the evidence period and the scoped domain. Make a quiet month understandable without inventing a threat count to make the service appear busy.
- Observations completed and any missing data.
- Record changes and the business explanation, where confirmed.
- Sender issues requiring investigation or approval.
- Actions taken within scope, with supporting evidence.
- Open exceptions, responsible people, and the next agreed step.
How do setup and continuing review differ at Kova Shield?
Kova Shield's proposed setup is $750 for one domain and up to three sending services. The scope includes findings, agreed configuration work, sender checks, and a written handoff. The optional $149 monthly review proposes weekly public DNS comparisons, a monthly review summary, and one sender-configuration review each month.
Compare those defined activities with your needs before committing. Extra domains, additional senders, migrations, complex routing, or incident response need separate scope. The written agreement should confirm the operator, timing, access, data handling, and service limits. A recurring charge by itself is not evidence that those responsibilities have been assigned.
What should happen between scheduled reviews?
Tell the responsible administrator when the business adds a sending tool, changes provider, or retires a service. Do not wait for a monthly summary to mention a change the team already knows about. Keep the sender inventory and approval record available to the reviewer.
An urgent account or payment concern needs the organization's incident process, not the next scheduled DNS comparison. Ask about that boundary before buying ongoing work. The service should make responsibility clearer, including the circumstances in which a different specialist or immediate response is needed.