Managed email authentication

The hardest part of DMARC is not publishing the record; it is coming back three times to change p=none to quarantine to reject. Managed email authentication moves the record onto DomainGuard's DNS so those changes are one click, and does the same for an SPF record that has grown past the 10-lookup limit.

Plan: Starter and up (it lives under /api/dmarc/, so the DMARC report gate applies).

Managed DMARC

Enable (POST /api/dmarc/managed/enable with service: dmarc; tool enable_managed_email_auth). DomainGuard returns a CNAME target of the form <token>.dmarc.nhmdmarc.com.
Publish a CNAME at _dmarc.<your domain> pointing at that target, at your DNS host.
Check (POST /api/dmarc/managed/check; tool check_managed_email_auth). A live lookup confirms the CNAME is published and serving.
From then on DomainGuard publishes the DMARC record at the target, with your report address in it.

To change the policy: POST /api/dmarc/managed/policy with action: advance moves it one step towards reject (none, quarantine, reject) and revert steps it back. The tool is set_managed_dmarc_policy. Advance is meant to be used when the reports show every legitimate sender aligned; the two-week / 95% rule is the guide.

Managed SPF (flattening)

SPF fails permanently past 10 DNS lookups. Flattening replaces the include: chain with the IP ranges it resolves to, which then have to be re-resolved whenever a provider changes its ranges. Enable with service: spf and pass your current SPF record as source_record; DomainGuard resolves it, publishes the flattened record at a name under nhmdmarc.com, and re-flattens it on a schedule. Your SPF record then includes that name in place of the long chain.

Change history

Every change DomainGuard makes to a managed record is written down: the record before and after, why it changed, whether you started it or the daily SPF refresh did, and when. After each change we look the record up in DNS again. The entry reads "Verified in DNS" once DNS answers with the new value. Resolvers can hold the old answer for a few minutes, so an entry can read "Checking DNS" for up to 30 minutes; one still wrong after that reads "Not confirmed in DNS".

Read it under Change history on each managed domain, or from GET /api/dmarc/managed/history?domain=<your domain>.

Ask before changing my records

The daily SPF refresh normally publishes a new flattened record on its own when a sender changes its addresses, then tells you. Tick Ask me before DomainGuard changes my records on a domain (POST /api/dmarc/managed/settings with ask_before_change: true) and it proposes the change instead. Nothing is published until you press Approve. Dismiss keeps the current record.

The alert says what waiting costs. If a sender added addresses, mail from those addresses fails SPF until you approve. If addresses were only removed, mail keeps passing. A flattened record holds addresses only, so it stays under the 10-lookup limit either way. A proposal expires after 7 days; if the change is still needed, the next daily check proposes it again. Approving checks your senders once more, and if they moved again since the proposal you are shown the new version to approve instead.

Changes you make yourself, like tightening the DMARC policy or updating the sender list, always apply straight away. The switch is off unless you turn it on.

Disabling

POST /api/dmarc/managed/disable ends a delegation. You must publish your own record again first, or the domain will have no DMARC (or no SPF) at all. The tool description says the same.

Status

GET /api/dmarc/managed (tool get_managed_email_auth) lists which of your domains have delegated which record and whether each delegation is live.

Where

Web: open a domain, Email & DMARC tab, Managed DMARC and SPF.
iOS: the DMARC page under Email & DMARC.

Common questions

Is the CNAME safe? A CNAME at _dmarc only affects DMARC lookups. It cannot touch your mail delivery, your website or any other record.

What if DomainGuard is unavailable? The records are served by Cloudflare's authoritative DNS for nhmdmarc.com, not by a web server, so they keep resolving.

Can I see the record you publish? Yes: dig TXT <token>.dmarc.nhmdmarc.com shows exactly what receivers see, and the domain's DMARC card shows the parsed policy.