Email authentication
Managed email authentication
Delegate your DMARC record to DomainGuard with one CNAME so the policy can be advanced without further DNS edits, and let DomainGuard flatten your SPF.
Updated · 2 min read
The hardest part of DMARC is not publishing the record; it is coming back three times to change p=none to quarantine to reject. Managed email authentication moves the record onto DomainGuard's DNS so those changes are one click, and does the same for an SPF record that has grown past the 10-lookup limit.
Plan: Starter and up (it lives under /api/dmarc/, so the DMARC report gate applies).
Managed DMARC
- Enable (
POST /api/dmarc/managed/enablewithservice: dmarc; toolenable_managed_email_auth). DomainGuard returns a CNAME target of the form<token>.dmarc.nhmdmarc.com. - Publish a CNAME at
_dmarc.<your domain>pointing at that target, at your DNS host. - Check (
POST /api/dmarc/managed/check; toolcheck_managed_email_auth). A live lookup confirms the CNAME is published and serving. - From then on DomainGuard publishes the DMARC record at the target, with your report address in it.
To change the policy: POST /api/dmarc/managed/policy with action: advance moves it one step towards reject (none, quarantine, reject) and revert steps it back. The tool is set_managed_dmarc_policy. Advance is meant to be used when the reports show every legitimate sender aligned; the two-week / 95% rule is the guide.
Managed SPF (flattening)
SPF fails permanently past 10 DNS lookups. Flattening replaces the include: chain with the IP ranges it resolves to, which then have to be re-resolved whenever a provider changes its ranges. Enable with service: spf and pass your current SPF record as source_record; DomainGuard resolves it, publishes the flattened record at a name under nhmdmarc.com, and re-flattens it on a schedule. Your SPF record then includes that name in place of the long chain.
Disabling
POST /api/dmarc/managed/disable ends a delegation. You must publish your own record again first, or the domain will have no DMARC (or no SPF) at all. The tool description says the same.
Status
GET /api/dmarc/managed (tool get_managed_email_auth) lists which of your domains have delegated which record and whether each delegation is live.
Where
- Web: open a domain, Email & DMARC tab, Managed DMARC and SPF.
- iOS: the DMARC page under Email & DMARC.
Common questions
Is the CNAME safe? A CNAME at _dmarc only affects DMARC lookups. It cannot touch your mail delivery, your website or any other record.
What if DomainGuard is unavailable? The records are served by Cloudflare's authoritative DNS for nhmdmarc.com, not by a web server, so they keep resolving.
Can I see the record you publish? Yes: dig TXT <token>.dmarc.nhmdmarc.com shows exactly what receivers see, and the domain's DMARC card shows the parsed policy.
Keep reading
Related articles
- SPF, DKIM and DMARC checksHow each record is read and graded, what Pass / Review / Fail mean, the recommended record with a Copy button, and the two DMARC policies labelled honestly.Email authentication ·Updated
- Verifying a domain for deep scansBasic scans run on any domain. Deep scans (open ports, known vulnerabilities, exposed files) run on domains you verify: an email link, a DNS record or a file, about a minute, and we finish the check for you.Vulnerabilities and exposure ·Updated
- "Needs an account" and "Ownership proof needed"The two gates on scanning: a session for any server-side check, and, for deep scans only, a verified domain (an email link, a DNS record or a file, or your work email's domain). What each message means and the fix.Troubleshooting ·Updated