Setup & Records

Record Wizard: adding your first domain

What it is: a 3-step guided flow for onboarding a brand-new domain. Your progress is saved as you go, so a session timeout mid-wizard won't lose your place.

1. Step 1: Identify your domain. Enter a bare domain (example.com, no https:// or trailing path, typing a full URL is automatically trimmed down to the bare host). Click Continue.
2. Step 2: Generate the DMARC record. Choose your starting policy: none (recommended to start, monitors without affecting delivery), quarantine, or reject. The wizard shows the exact TXT record to publish:

   Host:  _dmarc
   Value: v=DMARC1; p={policy}; rua=mailto:rua.reports@dmarcs.com; ruf=mailto:ruf.reports@dmarcs.com

   Use the copy button, add it as a TXT record with your DNS provider, then click I've Published the Record. The report addresses always point at DMARCS: this is how your aggregate/forensic reports actually reach the app.
3. Step 3: Verify. Click Verify Record Now. DMARCS checks the live DNS record for _dmarc.{domain}; on success the domain is added to your account and you can jump straight to the Dashboard. If verification succeeds but adding the domain to your account fails for some other reason, you'll see a specific message explaining that (rather than a generic error), and your draft is preserved so you don't have to redo the wizard. On failure, the wizard shows the exact hostname it looked up, so you can confirm the record landed on the right host, and offers Retry or a way back to recheck the record value, plus links to common DNS providers' own instructions.

Adding additional domains

What it is: once you have one domain set up, add more from Organisation → Settings → Domain Management without going through the full wizard again.

How to use it: type the domain under Add New Domain and click Add. It appears in the list with a Pending status; expand Show Record to get the exact Host/Type/Value to publish, then click Verify once it's live. Your organization's primary domain (the one on your account) is always shown as Primary and can't be removed from this list; every other domain can be deleted if you stop monitoring it.

Smart DMARC

What it is: hosted, instantly-updating DMARC management, for domains where you'd rather not hand-edit a DNS TXT record every time you want to change policy.

How it works: you delegate _dmarc.{domain} to DMARCS with a one-time CNAME record, then change policy from a form: pick the domain, the policy (none / quarantine / reject), an enforcement percentage (start low, e.g. 10%, when first tightening), and optionally your own reporting addresses and alignment mode. Saving publishes the change globally within moments, no DNS edit required after the initial CNAME.

Automated Enforcement: once a domain is CNAME-delegated, Smart DMARC can advance its own policy automatically along a monitored ladder (none → quarantine 25% → 50% → 100% → reject 50% → 100%), only stepping up when your real pass-rate and volume data say it's safe to. Turn on Auto-advance, pick a target (quarantine or reject), and DMARCS handles the rest, or click Advance now yourself once the readiness check says you're ready.

Smart SPF (Flattening)

What it is: SPF is limited to 10 DNS lookups by the protocol itself; exceed it and SPF silently fails for everyone, with no warning from your DNS provider. Smart SPF fixes this by flattening your SPF chain into a single hosted include.

How to use it: pick the domain, then add your authorized senders, either with one-click buttons for common providers (Google, Microsoft 365, Salesforce, SendGrid, Mailchimp) or by typing any other include: source manually. Choose Soft Fail (~all) (standard, marks unauthorized mail without blocking it) or Hard Fail (-all) (strict, rejects it), then click Analyze & Preview. DMARCS resolves every include recursively down to raw IP addresses and shows you the lookup count it collapses to. If that count is still over 10, it's flagged clearly. Click Create Hosted Record to get a single include: line that replaces your entire existing SPF record.

Hosted MTA-STS

What it is: MTA-STS forces other mail servers to use encrypted TLS when delivering to you, closing the door on downgrade attacks. DMARCS can host the policy file for you so you don't have to run your own web server for it.

How to use it: pick a domain, then set the Policy Mode: Testing (report only, recommended to start), Enforce (strict, require TLS), or None (disabled). Set Max Age (how long receivers cache the policy, defaults to one day) and list your Allowed MX Patterns, one per line, wildcards allowed. Click Publish to DNS to have DMARCS write both required records for you (a CNAME pointing your mta-sts host at DMARCS, plus the TXT discovery record); DMARCS then hosts and serves the actual policy file.

The page's status card tells you exactly where you stand: live and active (green), a DNS lookup failure that doesn't necessarily mean anything's wrong (amber, just retry), or not yet configured.

Enforcement Guide

What it is: a guided readiness check for moving your policy from p=none → quarantine → reject, built from whichever DMARC report you currently have loaded.

What you'll see: a 3-step progress tracker showing where you are today, and a plain-language readiness verdict: green "Ready for Enforcement" once your traffic is over 95% aligned, or amber "Not Ready Yet" with your actual alignment percentage if it isn't. Below that, an Unverified Sources table lists every sender currently failing, grouped by hostname with a favicon, IP addresses, message volume, and whether it's failing SPF, DKIM, or both, so you know exactly what would break before you tighten policy.