Frequently asked questions
If the answer you need is not here, ask us directly — a person reads every message.
How it works
Do I need to install anything on my clients’ networks? +
No. Marchpost is entirely external. You enter a domain name and we look at it the way the internet does — DNS records, the TLS certificate, HTTP response headers, and the homepage. There is no agent, no script, no admin consent, and nothing to uninstall later.
How long does a scan take? +
About 20 to 40 seconds for a single domain. Bulk imports queue and complete in the background; a 60-domain portfolio is usually fully populated within a few minutes.
What exactly do you check? +
Roughly 40 checks across five categories: email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT), certificates and encryption, DNS and domain configuration, website hardening headers, and exposed surface. The full list is here.
How is the score calculated? +
By a fixed, published ruleset — never by an AI. Each category starts at 100 and loses points per failing check, weighted by severity, and the category scores are combined by weight. The same configuration always produces the same score. Full details.
Legality and safety
Is it legal to scan a prospect’s domain? +
The checks we run on a domain you have not verified are the same things any visitor to the website does: DNS lookups, one TLS handshake, and requests to the site’s own published pages. We do not port-scan, attempt authentication, or attempt to exploit anything. Deeper probes — looking for exposed .env files and the like — only run after the domain owner has proven control with a DNS record. We publish exactly what the scanner does.
Will my scan show up in their logs? +
Yes, as a handful of ordinary web requests from a user agent that identifies itself as Marchpost and links to an explanation. We think that is the right way to behave. If you want to be discreet about who is asking, remember that the report you produce is yours to share when you choose.
Can a domain owner opt out? +
Yes, permanently — use our contact form from an address at that domain. Denylisted domains cannot be scanned by any customer.
Plans and billing
What counts toward my domain limit? +
Only monitored domains — the ones we rescan on a schedule. One-off prospect scans are unlimited on every plan, including Free.
Do you charge per seat? +
No. Pricing is per monitored domain. Adding a technician to your workspace costs nothing, because a tool that charges you for collaborating is a tool people stop using.
Is there a contract? +
No. Monthly plans cancel any time from the billing portal and run to the end of the period you have paid for. Annual plans are two months cheaper and are also cancellable.
What happens if a payment fails? +
We retry it and email you. Your workspace keeps working through the retry period — we would rather chase an invoice than lock you out of a client report the morning you need it.
Do you offer a trial? +
The Free plan is a permanent trial of the core product: unlimited prospect scans and one monitored domain. When you start a paid plan you also get a 14-day free trial, cancellable any time.
White label
How much of the report is white-labelled? +
On Practice and Firm, everything a client sees: your logo, your colours, your company name, and your footer text. There is no “powered by” line and no Marchpost branding anywhere in the report.
Can I send reports from my own domain? +
Reports are shared as links you send yourself, and you can set a reply-to address on your workspace so client replies come to you. Fully custom sending domains are on the roadmap.
Data
Where is my data stored, and can I get it out? +
PostgreSQL in the United States, encrypted in transit and backed up daily. You can export everything from workspace settings at any time, and deleting your account deletes your data within 30 days. Privacy policy.
Do you train AI on my data? +
No. We use a language model to write the plain-English narrative in reports and to draft support replies. Our AI provider does not train on data submitted through their business API, and we never send passwords, billing data, or client contact details.