Skip to content

Using the Domains Page

The Domains page is where you manage domains on boarded to VerifyDMARC, including subdomains if you have created specific DMARC records for these. It displays the status of each domain or subdomain, supports tagging, and provides a way to generate DMARC records for each domain or subdomain.

Each domain or subdomain listed here counts towards your plan limit. Subdomains that do not have their own dedicated DMARC record, do not.

Domains Page

Tip: Look out for the filter and sort icons.

The Domains page has the following columns:

  • Domain: The domain or subdomain.
    • If you send mail on a specific subdomain e.g. @marketing.example.com, and you want granular control of the DMARC policy, then you should explicitly add this subdomain to VerifyDMARC and create a specific DMARC record for it.
  • Status: This reflects whether the domain has a DMARC record, and if it does, whether it is set to none, quarantine, reject or is inheriting policy.
    • means that the domain has a DMARC record and it is set to quarantine or reject.
    • means that the domain has a DMARC policy (p=), subdomain policy (sp=), or non-existent subdomain policy (np=) set to none.
    • means that the domain does not have a DMARC record or an invalid DMARC record.
  • Parked: This is a toggle which indicates and controls the parked flag.
    • Parked domains are ones that are not expected to send legitimate email. They are usually reserved or not used for email purposes but are important to protect from abuse or misconfiguration.
    • The primary purpose of the flag is to keep the Dashboard clear and actionable by using the Hide Park toggle to only view active domains.
    • To successfully flag a domain as parked it must have:
      • A valid reject DMARC policy. Do not use a Subdomain Policy (sp=) tag in your record. Guidance can be found below under Domain Setup Page.
      • An an empty v=spf1 -all SPF policy indicating no mail servers are authorised to send from it.
    • Without meeting those conditions, an attempt to flag a domain as parked will fail.
    • The parked flag will automatically toggle off if any of these conditions are met:
      • Reports of DMARC complaint email are received for the domain.
      • When DMARC records are refreshed, the DMARC policy is no longer valid or reject
    • To be notified when a parked flag has been automatically toggled off, set one or more Alert Email Addresses under Alerts.
  • TLS (if TLS reporting on): This reflects whether the domain has a TLS reporting record, and if it does, whether any issues relating to TLS are detected.
    • Empty means TLS Reporting is not on for the domain.
    • means the domain has a TLS reporting record and no issues are detected.
    • means the domain has a TLS reporting record, but issues are detected. Hover over the icon for or click the cog for more detail.
    • means that the domain has TLS reporting on but does not have the correct TLS reporting record configured.
    • means we detected DNSSEC is in use for this domain.
  • TLS Mode (if TLS reporting on): Any TLS protocols detected.
    • Empty means TLS Reporting is not on for the domain or the TLS Reporting record is not valid.
    • None: No DANE or MTA-STS detected, the domain is likely using opportunistic SMTP TLS.
    • DANE: The domain has TLSA records detected indicating DANE is configured.
    • MTA-STS Enforce: The domain has an _mta-sts TXT record and a policy file with mode: enforce, indicating MTA-STS is mandated and mail senders should not attempt to send mail unencrypted if TLS fails.
    • MTA-STS Testing: The domain has an _mta-sts TXT record and a policy file with mode: testing, indicating MTA-STS is testing mode and is allowed to fallback to unencrypted if it fails.
    • MTA-STS Error: There is an _mta-sts TXT record but there is an issue with accessing the policy file or the policy file format is not valid. Hover over the status icon or click the cog for additional detail.
    • MTA-STS None: The domain has an _mta-sts TXT record and a policy file with mode: none, indicating MTA-STS is explicitly disabled, usually when it is being decommissioned. TLS will not be enforced unless DANE is in use.
    • MTA-STS Pending: An MTA-STS setup is saved in VerifyDMARC but its policy is not yet live in DNS. See Set Up MTA-STS.
  • MTA-STS Setup (Preview): MTA-STS configurations saved in VerifyDMARC that need action, such as DNS records still to add. The TLS Mode column shows what DNS currently publishes. See Set Up MTA-STS.
  • Reference: This is a single reference property to help you identify a domain.
    • This is intended for scenarios such as a third party billing reference, or a customer ID.
    • We'd love to hear how you are using references, and how we can improve this feature. Please let us know at feedback@verifydmarc.com.
  • Tags: You can add free form tags to each domain to help you categorise and manage your domains.
    • This is intended for scenarios such as MSPs needing to group multiple domains belonging to the same customer, or noting specific people or teams responsible for each domain.
    • To give that customer read-only access to only their own domains, add them as a user with a scoped role.
    • Tags can contain letters, numbers, spaces, underscores, and hyphens.
    • We'd love to hear how you are using tags, and how we can improve this feature. Please let us know at feedback@verifydmarc.com.
  • Action: Select the cog to reach the Domain Setup page, or the delete icon to off board the domain from VerifyDMARC.

Adding a Domain

Select Add Domain to add a domain to VerifyDMARC. You will be prompted to enter the domain name and then taken to the Domain Setup page to generate a DMARC record for the domain.

If your organisation is already using all the domains included in your plan, the Add Domain page will explain this instead of showing the form. Upgrade your plan using Manage Billing on the Organisation page to add more domains.

Auto Park

As a convenience, select Auto Park to check all domains, any that have a valid reject DMARC policy and an empty v=spf1 -all SPF policy will be flagged as parked. Any that were parked but no longer meet the criteria will be un-flagged as parked.

This operation is designed to efficiently reconcile the parked status of the domains. After a domain is flagged as parked, any subsequent DMARC compliant emails reported will cause the domain's parked flag to be toggled off automatically. If the Dashboard detects a policy change away from a valid DMARC reject policy, this will also cause the domain's parked flag to be toggled off. Once the parked flag is toggled off it automatically appears in the filtered Dashboard list again.

Domain Bulk Import and Export

Bulk Import

A fast way to onboard many domains is to export or scrape the list of domains from your DNS manager or domain registrar, MSP tools, documentation, or other sources, and then import them into VerifyDMARC.

Select Import to access the Import Domains wizard. You can download a sample CSV file to use as a template for your import. The CSV file must a column with the header domain and a list of domains to import. It can optionally include a reference column and a tags column.

NOTE If you include the reference or tags columns these will overwrite any existing references or tags for the domain, including if you leave the reference or tag field blank for one of the domains in your import file. If you do not include the reference or tags columns, any existing references or tags will be left as is.

VerifyDMARC automatically de-duplicates domains, so you don't need to worry about removing duplicates from your list.

If you exclude existing domains already on boarded to VerifyDMARC from the import file, the domains will be left untouched.

When you run an import, the Results area will show each imported or update domain, and if a tag or reference was updated.

Bulk Export

Select Export to download a CSV file containing all of your domains. You can use this file to audit your domains or to import your domains into another system.

Removing a Domain

Select the delete icon next to a domain to remove it from VerifyDMARC.

When you remove a domain, VerifyDMARC will not purge any historical DMARC data until it ages out of our system normally. This is because some customers may want to transition between having an explicit subdomain DMARC record and go back to using an inherited policy.

When you delete a domain, we schedule the record to be aged out 30 days after the last DMARC or TLS report is received. If we continue to receive DMARC or TLS reports for the domain more than 48 hours after removal we will send a reminder to remove your organisation's VerifyDMARC reporting address from the domain's rua tag in the DMARC or TLS DNS records.

If you re-add a domain that you removed, any already ingested DMARC data will show up again provided it has not aged out of our system, as long as the domain is re-added to the same organisation.

Detailed Information

At the top of the page, you'll see a link to 'View detailed info' in the Quick Reference banner. Select this to access your unique reporting address if you prefer to manually edit an existing DMARC record or want to build a DMARC record that sends reports to VerifyDMARC as well as other destinations.

Domain Setup Page

The Domain Setup page includes a DMARC record wizard to help you generate a DMARC record for your domain or turn on TLS Reporting.

The Live DMARC Record is the current DNS result we see for your domain. If you have just added your domain, or have just updated your DMARC record, it may take time for the Live DMARC Record to show the updated record.

Generating a DMARC Record

There are two input fields:

  1. Select Domain Policy (p=): This is the policy setting that will apply to your domain and all subdomains unless otherwise specified. The options are none, quarantine, and reject.
  2. Select Subdomain Policy (sp=): This is the policy setting that will apply to subdomains of your domain. The options are Inherit, none, quarantine, and reject. If you select Inherit, the Domain Policy (p=) will apply to subdomains. You can still override individual subdomains by adding the subdomain separately to VerifyDMARC and creating a DMARC record for the subdomain.

If your environment is not complex, we recommend you set the subdomain policy to inherit.

Once you have set both fields, select Show Record to display the DNS TXT record that you need to add to your domain's DNS manager.

Turn On TLS Reporting

To turn on TLS reporting for the domain, click the Turn On TLS Reporting button. If this is the first domain in the organisation to have TLS Reporting turned on, a modal will appear with guidance and TLS-related columns will appear in the Dashboard and Domains pages going forwards.

Once turned on, SMTP TLS Status will be revealed with the record you need to add to your domain's DNS manager.

TLS Reporting will turn on automatically if TLS reports are received for the domain.

Set Up MTA-STS (Preview)

MTA-STS tells sending mail servers to deliver your email only over TLS with a valid certificate. Set it up from the MTA-STS section of the Domain Setup page, in one of two ways:

  • Managed MTA-STS: add two CNAME records and VerifyDMARC hosts your policy.
  • Self-hosted MTA-STS: VerifyDMARC generates the policy file and DNS record for you to publish on your own web host. Choose this if you need an availability SLA, a custom cache lifetime or a none policy.

MTA-STS setup is a public preview and needs the Domain Manager role or higher. Before you start, the domain needs:

  • TLS Reporting turned on, with its record published
  • at least one MX record (a null MX does not count)
  • a DMARC record that sends reports to your organisation
  • for Managed MTA-STS, room in your plan's allowance, shown on the Organisation page

Start in testing mode and review your TLS reports before you enforce; VerifyDMARC never enforces a policy for you. Hourly checks warn if your MX records change and the policy no longer covers them; turn on Domain Setup Regression Alerts to be emailed.

Managed MTA-STS

Write and publish the policy, then add the two CNAME records shown, copying the exact values. Remove any existing mta-sts or _mta-sts records first, unless you are moving an existing policy. The domain's TLS Mode shows MTA-STS Pending until the policy is live. To change the policy later, edit and publish it; there is nothing to change in DNS.

Managed hosting is best-effort and has no availability SLA. Senders cache your policy, so a short outage does not remove protection.

  • Moving an existing policy: keep your current records. Publish the policy in VerifyDMARC and replace your mta-sts record with Record 1 (policy hostname). Leave _mta-sts unchanged until the page shows your managed policy is verified, then replace it with Record 2 (policy ID).
  • Retiring: select Retire hosting and keep both CNAME records until the page confirms hosting has been removed, then delete them. TLS Reporting can't be turned off while Managed MTA-STS is active.

Self-hosted MTA-STS

Write the policy, download mta-sts.txt and serve it at the HTTPS address shown, on a host with a valid certificate and no redirects, then add the _mta-sts TXT record shown. When you change the policy, update the file first, then the ID in the TXT record. Self-hosted domains don't count towards your Managed allowance.

DANE

The DANE section shows whether senders that check DANE can authenticate your mail servers. DANE is optional and is set up by your mail and DNS providers. The section needs TLS Reporting turned on.

The header shows Detected when every mail server has a TLSA record validated with DNSSEC, Incomplete when only some do or the records can't be validated, or Not detected. Unknown means the latest check has no DANE result; refresh the domain to retrieve it. Expand the section for a checklist of what is in place.

Setup History

An entry is created when setup changes are detected during hourly checks. The latest plus up to 10 prior entries are displayed (up to 90 days old).

Note: Repeated entries may indicate inconsistent DNS configuration, an outage preventing checks from completing or poor DNS performance causing timeouts during checks.

Email alerts for regressions can be turned on under Alerts.