Changelog

New features, improvements, and fixes. We ship updates regularly to make MailShield better for your team.

🔧 Fixv1.37.0August 5, 2026

No More False IPv4/IPv6 Certificate Alerts

Large mail providers that rotate certificates across their server fleet no longer trigger false IPv4/IPv6 inconsistency alerts.

• Stop flagging a certificate difference between IPv4 and IPv6 when both certificates are valid, since big providers legitimately serve different certificates from different frontends during rotation
• Compare the public key instead of the certificate hash, so a renewal that reuses the same key is never reported as an inconsistency
• Only alert when the difference has a real consequence: one address family fails your published DANE TLSA pins, or serves an untrusted or mismatched certificate
• Treat unevaluable TLSA records as unknown rather than as evidence of a problem

🔧 Fixv1.36.0July 31, 2026

More Reliable DNS Lookups Behind Every Check

A resolver that fails to answer is no longer read as your record being deleted, which removes a whole class of false change alerts.

• Distinguish 'this record does not exist' from 'the resolver could not answer', so a SERVFAIL or REFUSED reply never counts as evidence that a record was removed
• Ask the next DNS provider when the first one cannot answer, instead of letting one struggling provider speak for all of them
• Hold any newly detected record disappearance for one check cycle and alert only once a second check agrees it is really gone
• Support running a dedicated validating resolver on each probe node, removing the shared dependency on third-party DNS

🔧 Fixv1.35.0July 31, 2026

Fix Repeating BIMI Change Alerts

A DNS lookup that fails is no longer reported as your BIMI record being removed, which stopped a daily change alert for domains that never changed.

• Treat a failed BIMI lookup as unknown instead of recording it as 'no record found', so a transient DNS failure is never stored as a real removal
• Verify BIMI removals against the external probe fleet before alerting, the same way SPF, DMARC and MTA-STS removals are already verified
• Fix the change summary showing an empty '()' when an alert contained only informational changes
• Relabel the informational counter in change emails, which previously called every informational change an improvement

🔧 Fixv1.34.0July 31, 2026

Fix False DANE Mismatch Alerts

Correctly configured mail servers no longer get flagged for a DANE certificate mismatch they don't have.

• Ignore the parentheses some resolvers add around line-wrapped TLSA records instead of reading them as part of the certificate digest
• Treat a TLSA record we can't parse as unknown rather than as a verified mismatch, so a parsing problem can never raise a delivery alert
• Fix affected MX hosts being reported as breaking DANE delivery when their published records actually matched

🚀 Featurev1.33.0July 30, 2026

API Access to Report Addresses, MTA-STS and DKIM Selectors

The API now exposes everything you need to finish onboarding a domain without opening the dashboard.

• Return each domain's report ingest address on create, list and detail responses, so you can publish your DMARC and TLS-RPT rua in the same pass that creates the domain
• Add GET and PATCH /domains/{id}/mta-sts to read and change MTA-STS configuration, including the expected DNS records and the policy id
• Rotate the MTA-STS policy id automatically whenever the served policy changes, and report whether the id published in DNS is still in sync
• Add endpoints to list, register and remove DKIM selectors, so a selector you already know is checked immediately instead of waiting for the first report
• Require an explicit MX list before MTA-STS enforce mode can be enabled, so a policy that matches no host cannot break delivery

🔧 Fixv1.32.0July 29, 2026

DNSSEC Detection for DANE Guidance

The TLSA generator now knows whether an MX host's zone is DNSSEC-signed, instead of asking you to confirm it yourself on every host.

• Report the DNSSEC status of the MX host's own zone, resolved from the distributed probe network
• Stop showing the 'we could not determine whether the zone is signed' notice for hosts in zones that are demonstrably signed
• Recognise a signed zone that has no TLSA records published yet, so the generator gives you a record instead of a caveat
• Keep reporting the status as unknown when the signatures are broken or the probes disagree, rather than claiming the zone is unsigned

🚀 Featurev1.31.0July 27, 2026

Reverse DNS and Network Details for SPF IP Entries

The SPF page now shows the reverse DNS (PTR) record and the announcing network next to each individual ip4 and ip6 entry, so you can see at a glance which host an address actually belongs to.

• Show the PTR hostname in the Details column of the Matching Terms table for every single ip4 or ip6 address
• Show the announcing ASN, organisation and country flag below the hostname, linking through to bgp.tools
• Show 'No PTR record' when an address has no reverse DNS configured
• Skip CIDR ranges such as /24, which cover many hosts and have no single PTR record
• Resolve everything on demand when the page opens, so the details are always current

🚀 Featurev1.30.0July 27, 2026

TLSA Record Generator for DANE

Generate DANE TLSA records from the certificate your mail servers are actually serving, without hunting down or pasting a certificate.

• Add a free TLSA record generator at app.mailshield.app/check/tlsa that connects to your MX hosts and reads the live certificate
• Add the same generator to the MX tab of every domain, with a per-host explanation when DANE is not possible
• Check whether each MX host's own zone is DNSSEC-signed, which is a different zone from your domain and the actual prerequisite for DANE
• Warn before a renewal breaks delivery when a host publishes a single TLSA record and its certificate expires within 30 days
• Add a second generator that builds a record from a pasted certificate, with full control over usage, selector, matching type, port and transport

🔒 Securityv1.29.0July 27, 2026

Invitation Links Now Survive Sign-In

Accepting a team invitation no longer drops you into onboarding and creates a second organization, and post sign-in redirects are restricted to MailShield pages.

• Carry the invitation link through the sign-in email, so invited users land back on the invitation instead of the dashboard
• Stop new members provisioning a duplicate organization when they accept an invitation
• Restrict the page you are sent to after signing in to MailShield's own pages, for magic link, passkey and single sign-on logins

⚡ Improvementv1.28.0July 27, 2026

SPF Enforcement Now Outweighs BIMI in Your Score

Tightening SPF from soft fail to hard fail is now worth more points than publishing a BIMI record, which better reflects what actually protects your domain.

• Increase the SPF component to 18 points for domains that send and receive mail, and to 22 points for send-only domains
• Make the step from ~all to -all worth 5 points in both profiles, up from 2 and 3
• Lower BIMI to 2 points for domains that send and receive mail, and to 8 points for send-only domains, since BIMI displays a logo but blocks nothing
• Correct the SPF page, which labelled ~all as recommended while the score rewarded -all

⚡ Improvementv1.27.0July 24, 2026

Alerts for Broken Mail Server Certificates

MailShield now alerts you when a mail server starts serving a broken TLS certificate, and certificate problems lower your security score.

• Send an alert when a new problem appears on a mail server: certificate hostname mismatch, self-signed or untrusted certificate, TLSA/DANE mismatch, or EHLO issues
• Zero the MX score component when a mail server presents a certificate with a hostname mismatch, a self-signed certificate, or an untrusted chain
• Forfeit DANE points when TLSA records no longer match the certificate the server actually serves
• Alert on score swings of 10 points or more (previously more than 10), so losing a full component always notifies you

⚡ Improvementv1.26.0July 23, 2026

Deliverability Tester Rename and Logo Fixes

The Inbound Mail Tester is now called the Deliverability Tester, and reporter logos in the reports viewer load reliably again.

• Rename the Inbound Mail Tester to Deliverability Tester to better reflect what it does: testing how your outbound email is scored by receiving servers
• Fix reporter and domain logos failing to load in the DMARC and TLS report viewers
• Retry failed logo lookups within an hour instead of caching the failure for 30 days

⚡ Improvementv1.25.0July 17, 2026

Redesigned App Navigation and Dashboard

A redesigned app shell with sidebar navigation, a clearer dashboard that surfaces what needs attention, and simplified domain pages.

• Add a collapsible sidebar with grouped navigation replacing the top bar
• Show a Needs Attention panel on the dashboard that links straight to the fix
• Simplify domain pages into Overview, Checks, Reports, and Settings tabs
• Add breadcrumbs and a prioritized Next Steps list on each domain overview
• Improve status badges, empty states, and dark mode consistency across the app

⚡ Improvementv1.24.0July 11, 2026

Customers Replace Domain Groups

Domain groups are now customers, making it clearer how to organize domains per customer for filtering, reports, and billing.

• Rename clients and domain groups to customers across the app
• Assign each domain to a customer and filter or group the domain list by customer
• Scope white-label PDF reports and scheduled reports to a customer
• Show the billing breakdown and CSV export per customer

⚡ Improvementv1.23.0July 10, 2026

Inactive Free Account Cleanup

Free organizations are now only deleted after 90 days without any sign-in, with a 14-day email warning that any login cancels.

• Base account deletion on sign-in activity instead of quota lockouts
• Send a deletion warning email 14 days before removal
• Cancel a scheduled deletion automatically when anyone signs in
• Fix the cleanup job so it runs reliably

🚀 Featurev1.22.0June 23, 2026

Per-Client Billing Breakdown Export

See how your subscription cost splits across your domain groups and export it for pass-through invoicing to clients.

• Add a per-client breakdown table on the billing page for per-domain (Pro) plans
• Show active and passive domain counts with an estimated monthly cost per group
• Download the breakdown as a CSV for pass-through invoicing
• Allocate graduated pricing across clients at a blended per-domain rate

🚀 Featurev1.21.0April 28, 2026

Email Volume Limit Notifications

Get a heads-up before you hit your monthly email volume limit, and see clearly when reports are gated.

• Send a soft-tone email to the org owner at 80% of monthly volume
• Send a follow-up email at 100% with an upgrade prompt
• Each notification is sent at most once per calendar month per organization
• Report viewing now pauses at 100% of the limit instead of 120%
• DMARC and TLS alert emails include an upgrade footer when the org is over its limit

🚀 Featurev1.20.0April 25, 2026

Webhook, PagerDuty, and Datadog Notifications

Send alerts directly to your ops stack — generic webhooks, PagerDuty incidents, and Datadog events.

• Add generic JSON webhook channel with optional shared-secret header
• Add PagerDuty channel using Events API v2 for incident routing
• Add Datadog channel for posting events with US and EU site support

🚀 Featurev1.19.0March 5, 2026

Passkey Authentication

Sign in instantly with passkeys — no email link required.

• Add passkey login as an alternative to magic links
• Register and manage passkeys from account settings
• Support for synced passkeys across devices (iCloud Keychain, Google Password Manager, etc.)
• Secure WebAuthn-based authentication with no passwords or codes

⚡ Improvementv1.18.0February 15, 2026

Dashboard Navigation Redesign & Bulk Import

Redesigned domain navigation with pill-style tabs, added bulk domain import, PDF score reports, and command palette for quick navigation.

• Add pill-style sub-navigation for domain detail pages
• Add bulk domain import for onboarding multiple domains at once
• Export domain security score reports as PDF
• Command palette for quick navigation across the dashboard
• Loading skeletons across all dashboard pages for smoother transitions

⚡ Improvementv1.17.0February 14, 2026

Date Range Filters & Activity Sparklines

Filter reports by custom date ranges and see domain activity at a glance with new sparkline charts.

• Date range picker in report filters using calendar UI
• Activity sparklines replace fail rate charts on the domains list
• Page size selection for DMARC and TLS report viewers
• Report pagination controls for easier browsing

🚀 Featurev1.16.0February 14, 2026

Report File Import

Import historical DMARC and TLS-RPT report files with drag-and-drop upload, automatic domain matching, and deduplication.

• Drag-and-drop upload for DMARC and TLS-RPT XML/JSON files
• Automatic domain matching to existing monitored domains
• Duplicate report detection to prevent double-counting
• Server-side pagination and SQL-based filtering for report lists

🚀 Featurev1.15.0February 13, 2026

DMARC & TLS Report Viewer

Drill into DMARC and TLS reports with filtering, volume charts, and detailed record views.

• DMARC report viewer with filtering by domain, date range, reporter, and status
• Volume chart showing DMARC report trends over time
• Detailed record-level view for individual DMARC reports
• TLS report viewer with policy results and failure details

🚀 Featurev1.14.0February 12, 2026

Domain Stats Dashboard

At-a-glance stats above your domain list showing emails monitored, domain count, average security score, and DMARC compliance rate.

• Stats row with emails monitored, domain count, avg score, and compliance rate
• Stats reflect the entire organization regardless of group or tag filters
• Free plan email volume limit updated to 250/month
• Plan tier limits aligned with current pricing

🔧 Fixv1.13.0February 11, 2026

Reliability Fixes

Fixed false TLS alerts from transient connection failures and corrected date handling in cleanup jobs.

• TLS/DANE changes only reported when MX records themselves changed
• Replaced brittle error-string matching with data-driven probe state checks
• Fixed date format in stale user cleanup queries for proper database compatibility

🚀 Featurev1.12.0February 11, 2026

Domain Groups & Tags

Organize your domains with custom groups and color-coded tags for better management at scale.

• Create domain groups to organize related domains together
• Add custom tags with colors to any domain
• Filter and search domains by group or tag
• Grouped view option in the domains list

🔒 Securityv1.11.0February 10, 2026

Anti-Spam & Account Security

Strengthened account security with invisible CAPTCHA, rate limiting, and self-service account deletion.

• Invisible CAPTCHA challenge on login to prevent abuse
• Rate limiting on authentication endpoints
• Self-service account deletion from settings
• Automatic cleanup of stale unverified accounts

🚀 Featurev1.10.0February 10, 2026

Email Volume Monitoring

Track email volume across your domains with plan-based limits and usage dashboards.

• Email volume tracked from DMARC aggregate reports
• Volume-based limits per plan tier
• Usage dashboard for administrators
• Consolidated pricing: Free, Starter, Pro, and Business plans

🚀 Featurev1.9.0February 8, 2026

Notification Channels

Get alerts where your team already works: Telegram, Slack, Discord, and more.

• Connect Telegram, Slack, Discord, or custom webhooks
• Per-channel notification preferences
• Test notifications before going live
• Available on Starter plans and above

🚀 Featurev1.8.0February 8, 2026

DANE & DNSSEC Scoring

DANE and DNSSEC validation now contribute to your domain's security score.

• DANE TLSA record validation integrated into scoring
• DNSSEC chain of trust verification
• Score breakdown shows DANE/DNSSEC contribution
• Improved BIMI logo content validation

🚀 Featurev1.7.0February 3, 2026

DMARC Report Viewer

Drill into individual DMARC reports with full record details, IP enrichment, and authentication results.

• View every record in a DMARC aggregate report
• IP addresses enriched with country flags and ASN info
• Direct links to bgp.tools for network investigation
• Detailed SPF, DKIM, and DMARC authentication results per record

⚡ Improvementv1.6.0January 28, 2026

Real-Time DNS Checks

DNS check results now stream in real time via server-sent events for a faster, more responsive experience.

• Results appear as each check completes, no more waiting for all eight
• Retry logic and timeouts prevent false alerts from transient DNS failures
• BIMI logos migrated to SVG Tiny PS format for better compatibility
• DKIM verification improvements for split TXT records and Ed25519 keys

🚀 Featurev1.5.0January 27, 2026

Scheduled Reports & DMARC Recommendations

Schedule recurring email reports and get DMARC policy recommendations tailored to how you use each domain.

• Schedule daily, weekly, or monthly email reports per domain
• Dynamic DMARC policy recommendations based on domain usage type
• IPv6 CIDR support in SPF mechanism display
• Improved DKIM signature verification accuracy

🚀 Featurev1.4.0January 25, 2026

REST API & Access Tokens

Integrate MailShield into your workflows with our REST API. Create tokens, set IP allowlists, and monitor usage.

• Create and manage API tokens with optional IP allowlists
• API access logging with detailed request/response tracking
• Token activity dashboard with filtering
• Available on Pro plans and above

🚀 Featurev1.3.0January 25, 2026

Billing & Subscription Plans

Flexible subscription plans with Stripe integration. Upgrade, downgrade, or switch billing cycles anytime.

• Four plans: Free, Starter, Pro, and Business
• Monthly and annual billing with up to 20% savings
• Domain and team member limits per plan
• Granular domain usage type support for accurate scoring

🚀 Featurev1.2.0January 24, 2026

Inbound Mail Tester

Send a test email to MailShield and get a detailed deliverability analysis with a 100-point quality score.

• 100-point email quality scoring system
• SPF, DKIM, and DMARC authentication verification
• Blocklist and reverse DNS checks
• Auto-discovery of DKIM selectors from test emails
• Test history so you can track improvements

🚀 Featurev1.1.0January 24, 2026

MTA-STS Hosting

MailShield hosts your MTA-STS policy so you can enforce encrypted email delivery. Just add two DNS records.

• Fully hosted MTA-STS policies, no web server required
• Start in testing mode, upgrade to enforce when ready
• Auto-detection of MX hosts from your latest check
• Built-in DNS verification and monitoring

🚀 Featurev1.0.0January 24, 2026

Security Scoring & SPF Checker

Launch of the domain security scoring system and public SPF record checker tool.

• Domain security score across all eight email protocols
• Score breakdown by protocol with improvement suggestions
• Public SPF checker tool for any domain's SPF record
• Parked domain detection with null MX support
• Perfect score celebration animation