Six steps, two of them DNS records

Sign up with your email address and confirm it. Name your organization, then type the domain you send email from.

We give the domain a reporting address of its own, and write the DMARC record that points to it.

A few minutes.

The domain page, with the record's name and value ready to copy.

Publish one TXT record at _dmarc.example.com. If the domain's DNS is at Cloudflare, connect Cloudflare and press Publish record.

If someone else looks after your DNS, send them the record. Put the TLS-RPT record from step 4 in the same message, so they make both changes at once.

We start the record at p=none, so mailbox providers report on your mail and deliver it as before.

A domain has only one DMARC record. If yours already has one, the Records page shows it changed to add your reporting address, once our DNS check has read it.

A minute with Cloudflare. Otherwise, as long as your DNS contact takes to answer one email.

With Cloudflare, “Published” under the record once DNS answers with it. Without Cloudflare, step 3 confirms it.

Nothing. To look at once, press Check now on the domain page.

We look the record up. Its reporting address was made for this domain alone, so finding it proves the domain is yours. Then we run the first DNS checks.

DNS changes take a few minutes to an hour to show. During the first week we look again by ourselves every 15 minutes.

“Verified” on the domain page, an email saying so, and the first results for SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI.

Publish a second TXT record, at _smtp._tls.example.com. The Records page has its value, and its own Publish record button when Cloudflare is connected.

If someone else looks after your DNS, this record goes in the same message as the DMARC record. If you sent that one already, send this one to the same person.

We read the TLS reports that come to the same reporting address. They say whether other mail servers could reach yours over an encrypted connection, which matters when the domain receives email.

No extra time when it went in the same message as the DMARC record. Otherwise, the same as step 2.

The TLS-RPT check on the DNS page finds the record, and TLS reports arrive beside your DMARC reports.

Nothing.

Mailbox providers send their reports to your reporting address. We read each one when it arrives, and email you when the first one lands.

The first report usually arrives within 24 to 48 hours. Google and Microsoft send one a day.

A full picture takes one to two weeks. Each mailbox provider reports only on the mail it received, so a service that sends once a week shows up once a week.

Nobody can make either faster. The mailbox providers decide when they send.

An email naming the mailbox provider that sent the first report. If nothing arrives within 72 hours, the domain page lists what to check.

Fix the sources that fail, using the change each one names. Move to a stricter policy when the readiness rule says you can.

We name each service that sends as you, and explain why its mail passes or fails. We check your DNS from once a day on Starter to every 15 minutes on Enterprise, and alert you when something changes.

The readiness rule's main condition: every source with at least 50 messages or 1 percent of your mail passes DMARC at 98 percent or better over 14 days.

For as long as the domain sends email. Each fix takes as long as the change in that service.

The domain page: the pass rate, the trend, your top sources and your progress toward the next policy. From the Pro plan up, each Monday brings a summary of the week by email.