Test scope, screenshots, checkpoint findings and tier rationale were supplied by an identified reviewer. Identity is retained internally unless public attribution is explicitly enabled.
Cybersecurity · South AfricaFull evidence record
Sendmarc
Sendmarc is an email-security platform focused on DMARC, SPF and DKIM configuration, monitoring and enforcement to reduce domain spoofing, phishing and impersonation.
Sandbox Africa checked the submitted evidence and promoted the verified checkpoint record. Any visible adjustment is identified rather than silently rewritten.
The official public tier and technical record below are the verified publication outcome.
Tier 2 — Market-Ready
Keep Tier 2. The core self-service detection/onboarding surface was directly verified and the product is actively operated, but the evidence does not yet support enterprise-grade integration and governance assurance.
Strongest supporting evidence
Self-serve registration completed independently, with working OTP verification and no payment required. The core detection engine was directly tested against three separate domains — a control domain, a third-party domain, and the employer's own domain — returning fast (~3 second), accurate, differentiated results with no gating. The dashboard confirms real account state, including a 3-of-7 onboarding progress indicator and a live trial quota (0/80K), evidencing a genuinely functioning backend rather than a static interface.
Why the next tier is not yet supported
Tier 3 requires comprehensive integration documentation and confirmed enterprise security readiness. Neither is demonstrated. No API reference or webhook documentation was located anywhere on the site — a material gap for a security product, where technical buyers typically expect programmatic integration into SIEM or alerting systems. Enterprise SSO and MFA are stated as available on the Premium tier and above per the published pricing page, but could not be independently confirmed in account settings, since full configuration requires DNS control over a verified domain, which was not available during testing.
Verified findings and limitations
Direct review observations
The intern completed self-service trial registration with OTP and no card, tested the public domain checker against three domains and reached a functioning account dashboard. DNS ownership was not available to complete full DMARC onboarding.
Independent verification
The current Sendmarc site continues to present an active DMARC management platform and related email-security capabilities.
Observed issues
No material defect was identified in the directly tested domain-checking workflow; enterprise integration and configuration depth were not independently established.
Testing limitations
Full DNS configuration, enforcement rollout, enterprise SSO/MFA configuration and production customer operations were not tested.
Independent verification sources. Source 1
What was actually assessed
Loaded sendmarc.com and reviewed the homepage, navigation and footer for load faults and dead links, confirming both entry paths — a free trial and a demo booking — before registering. Completed self-serve registration for the free trial, verifying via OTP, with no card required. Used the free public domain checker as the primary functional test, running it against three domains in sequence — tut4life.ac.za, ignitingminds.co.za, and bosigo.co.za — to compare results across a control domain, a known third party, and the employer domain, recording each result and response time via browser DevTools. Logged into the resulting trial dashboard and reviewed the account settings area for MFA and SSO options, but could not complete configuration or reach further settings, as full account access required DNS control over a domain that was not available. Cross-checked the published pricing page against what was observable in the account, to compare advertised tier features (2FA on all tiers, SSO on Premium and above) with what could be directly confirmed. Searched the footer and standard URL patterns for a status page and for compliance or certification documentation.
Environment / device / browser
Edge on Windows
Account or access type
Business account
Access limitations
Full account access could not be completed, as configuring the core DMARC product requires DNS control over a domain, which was not available. Settings, MFA configuration, and any features beyond the free trial's initial state could not be independently verified as a result. Enterprise-tier features — SSO, audit logs, and Premium-tier capabilities — are stated by the vendor's own pricing page but could not be tested directly, since the analyst's account is on the free trial tier only. No production or paying-customer environment was tested.
What was observed
These images formed part of the evidence pack considered during verification. Full-standard records retain the contributor's factual caption for each screenshot.
Seven checkpoint assessment
The verified result is the official public checkpoint record. For earlier-standard reviews, these findings may have been reconstructed from preserved evidence during Sandbox Africa’s 2026 audit; they are not presented as if the contributor originally completed a structured worksheet. Contributor-submitted checkpoint wording is shown only where explicit public reviewer attribution has been enabled.
Step 1 — The Existence & Accessibility Check
Is it live?
Checking for dead links, infinite loading screens, or "Coming Soon" landing pages masquerading as live products.
Sandbox verifiedpass
Site loads fully with no dead links across main navigation and footer, checked on both desktop and mobile. No infinite loading, no "coming soon" placeholder — a genuinely live, functioning product.
Onboarding friction
Can a user or enterprise actually sign up, or is it gated behind broken "Contact Sales" forms?
Sandbox verifiedpass
Self-serve registration completed in approximately 5 minutes via the free trial path, with working OTP verification and no card required. This is a functioning self-serve signup, not a broken or sales-gated form — a demo booking is offered as an alternative, not the only route.
Step 2 — Functional Testing (The "Try It Out" Phase)
Core loop execution
Does the application actually do what it claims to do? (e.g. a payment gateway completing a test transaction, a logistics app's routing engine working.)
Sandbox verifiedpartial
The free domain checker — the core detection engine — was tested directly against three domains (a control domain, a third-party domain, and the employer's own domain) and returned differentiated, accurate results in approximately 3 seconds each, HTTP 200, no gating. However, the platform's actual product — configuring and monitoring DMARC enforcement on a domain — could not be completed, as it requires DNS control over a domain, which was not available to the analyst. The underlying engine is confirmed working; the full end-to-end product loop is not independently confirmed.
User experience (UX) & interface (UI)
Assessing the logical flow, responsiveness, and basic accessibility of the platform.
Sandbox verifiedpass
The trial dashboard is organised into nine clearly labelled sections with a guided setup checklist and a quota indicator. Navigation is responsive with no faults, and the site renders correctly at mobile width.
Step 3 — Technical & Architectural Assessment
Performance
Load speeds, uptime reliability, and basic stress responses.
Sandbox verifiedpass
Domain checker response times were consistently fast (~3 seconds) across all three tests, with no errors. However, no uptime commitment or status page exists to confirm reliability over time, so ongoing performance under load or during incidents cannot be assessed.
Integration readiness
Availability, clarity, and functionality of API documentation and webhooks.
Sandbox verifiedpartial
No API reference or webhook documentation was located anywhere on the site. Editorial proposal adjusted from not_assessed to partial using current independent verification and the established gated-product/safety-critical rules.
Verification adjustmentSecurity basics
SSL certification, basic encryption standards, and data handling transparency.
Sandbox verifiedpartial
Two-Factor Authentication is documented as available on all tiers including the free trial, and Enterprise SSO is documented on Premium tier and above, per the published pricing page — but neither could be independently confirmed in account settings, as the settings interface required DNS-dependent configuration not available to the analyst.
Company right of reply
Claim company profile
Represent Sendmarc?
Claiming verifies company ownership and enables a response or additional evidence. It does not permit editing of the independent review.