Getting started
From a new account to a monitored domain, alerts you will see and your first DMARC decision.
Signed in, the Get started page in the dashboard walks the same steps and ticks them off as you go.
1. Your account and team
Everything you add belongs to a team: domains, alert channels, API tokens, agent access, webhooks and billing. A new account starts with its own team on the Free plan. Invite colleagues under Team: owners and admins manage domains and tokens, members and viewers read. Seats per plan: Free 1, Starter 2, Pro 5, Enterprise 25.
2. Add a domain
Under Domains, or the box on the overview. Paste several names separated by commas or spaces, or import a CSV. Domains per plan: Free 1, Starter 3, Pro 15, Enterprise 100.
3. Prove you own it
Each domain gets its own verification record. Publish it at your DNS provider, on the domain itself:
Type TXT Host @ (example.com itself) Value emailsecops-verify=<token from the domain page>
Add it next to the TXT records already there (your SPF record and other verifications stay). Then click Verify on the domain page; DNS changes can take a few minutes to show. Monitoring, alerts and report analysis start once the domain is verified, and the first check runs straight away.
4. Read the first check
You get a score from 0 to 100 with a grade, and a ledger with one row per record: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, reverse DNS and blacklists. Each row shows what is published and whether it passes.
Fix-it records give the exact host, type and value to publish. When the right value depends on something DNS can't tell us, such as which services send mail for you, the fix says so instead of guessing. How the score is built: how we check.
5. Monitoring and alerts
Verified domains are checked again on a schedule: every 24 hours on Free, 24 hours on Starter, 12 hours on Pro, 6 hours on Enterprise. Each check keeps the records it saw and compares them with the previous one. A change becomes an alert: a DKIM key removed or rotated, a weaker DMARC policy, an SPF include added or dropped, a new blacklist listing.
- Without alert rules, alerts email the team owner.
- Under Team → Alert channels, send them to more addresses (or Slack on plans that include it), with a minimum severity, for all domains or one.
- For your own systems, subscribe to signed webhooks (paid plans).
6. DMARC reports
Receivers send DMARC aggregate reports to the addresses in your record's rua= tag. They list every source that sent mail as your domain and whether it passed SPF and DKIM in alignment, which is what tells you when enforcement is safe. Report analysis is on Starter, Pro, Enterprise.
- Upload report files (
.xml,.xml.gz,.zipor the.emlthey came in) on the domain page. - The domain page also shows the domain's report address and the DMARC record that adds it to
rua=, keeping the receivers you already have. - The advisor reads the last 30 days: alignment per source, unknown senders, DKIM pass rates per selector, and whether
p=quarantineorp=rejectis safe, with the record to publish.
To look at a single report without an account, use the free DMARC report analyzer.
7. AI agents and the API
On paid plans, connect Claude, ChatGPT, Cursor or VS Code to your team over MCP with one sign-in, or create a token for the REST API. Start with AI agents (MCP) or REST API & webhooks.
Free tools
The 17 single-record tools work without an account and from the dashboard: SPF, DKIM and DMARC checkers, record generators, a DKIM signature validator, an email header analyzer and more.