Email authentication

Managed email authentication

Delegate your DMARC record to DomainGuard with one CNAME so the policy can be advanced without further DNS edits, and let DomainGuard flatten your SPF.

Updated · 2 min read

The hardest part of DMARC is not publishing the record; it is coming back three times to change p=none to quarantine to reject. Managed email authentication moves the record onto DomainGuard's DNS so those changes are one click, and does the same for an SPF record that has grown past the 10-lookup limit.

Plan: Starter and up (it lives under /api/dmarc/, so the DMARC report gate applies).

Managed DMARC

  1. Enable (POST /api/dmarc/managed/enable with service: dmarc; tool enable_managed_email_auth). DomainGuard returns a CNAME target of the form <token>.dmarc.nhmdmarc.com.
  2. Publish a CNAME at _dmarc.<your domain> pointing at that target, at your DNS host.
  3. Check (POST /api/dmarc/managed/check; tool check_managed_email_auth). A live lookup confirms the CNAME is published and serving.
  4. From then on DomainGuard publishes the DMARC record at the target, with your report address in it.

To change the policy: POST /api/dmarc/managed/policy with action: advance moves it one step towards reject (none, quarantine, reject) and revert steps it back. The tool is set_managed_dmarc_policy. Advance is meant to be used when the reports show every legitimate sender aligned; the two-week / 95% rule is the guide.

Managed SPF (flattening)

SPF fails permanently past 10 DNS lookups. Flattening replaces the include: chain with the IP ranges it resolves to, which then have to be re-resolved whenever a provider changes its ranges. Enable with service: spf and pass your current SPF record as source_record; DomainGuard resolves it, publishes the flattened record at a name under nhmdmarc.com, and re-flattens it on a schedule. Your SPF record then includes that name in place of the long chain.

Disabling

POST /api/dmarc/managed/disable ends a delegation. You must publish your own record again first, or the domain will have no DMARC (or no SPF) at all. The tool description says the same.

Status

GET /api/dmarc/managed (tool get_managed_email_auth) lists which of your domains have delegated which record and whether each delegation is live.

Where

  • Web: Monitor, DMARC, the Managed records card; the domain's Email & DMARC module offers it when a record is marked Review.
  • iOS: the DMARC page under Email & DMARC.

Common questions

Is the CNAME safe? A CNAME at _dmarc only affects DMARC lookups. It cannot touch your mail delivery, your website or any other record.

What if DomainGuard is unavailable? The records are served by Cloudflare's authoritative DNS for nhmdmarc.com, not by a web server, so they keep resolving.

Can I see the record you publish? Yes: dig TXT <token>.dmarc.nhmdmarc.com shows exactly what receivers see, and the domain's DMARC card shows the parsed policy.

Keep reading

Related articles

  1. Scan clearance and ownership proofProve you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.Vulnerabilities and exposure ·Updated
  2. SPF, DKIM and DMARC checksHow each record is read and graded, what Pass / Review / Fail mean, the recommended record with a Copy button, and the two DMARC policies labelled honestly.Email authentication ·Updated
  3. No DMARC reports are arrivingWhy a DMARC setup can look finished and receive nothing: the rua= address, the record location, a provider wizard, the 48-hour wait, and what to check in order.Troubleshooting ·Updated

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.

Contact supportCall (330) 305-2750