Features Overview

MailShield monitors the DNS records and mail server settings that protect your domains, processes the reports mailbox providers send about them, and tells you when something changes.

Core Features

DNS Security Monitoring

MailShield checks every domain every 2 hours:

Check	What it covers
SPF	Syntax, the include tree, DNS lookup count, the all policy
DKIM	Each selector's key, key type and key size
DMARC	Policy, alignment and reporting addresses
MX	Mail servers, STARTTLS, certificates and mail acceptance
MTA-STS	The DNS record and the policy file
TLS-RPT	The reporting record
BIMI	The record and the logo
DNSSEC	Whether the domain is signed and the chain of trust validates
DANE	TLSA records for your MX hosts, and whether they match the served certificates

Learn more about DNS Monitoring →

Security Scoring

• A 0-100 score and a grade from A to F for every verified domain
• Weighted by usage type, so a parked domain isn't penalized for records it doesn't need
• A score breakdown per component, and suggested next steps on each domain's Overview
• A Score history chart on each domain's Overview

Learn more about the Security Score →

Report Processing

• DMARC aggregate reports: who sends mail as your domain, and whether it passes SPF, DKIM and DMARC
• TLS reports: successful and failed TLS connections to your mail servers
• Report import: upload report files you already have

Learn more about Report Processing →

Alerts and Notifications

• Score changes, DNS changes, high failure rates and certificate expiry alerts
• Alerts by email on every plan, one by one or as a daily summary, and through Slack, Microsoft Teams, Discord, Telegram, Matrix, Mattermost, Pushover, PagerDuty, Datadog or webhooks on Pro
• Team channels on Pro: shared channels for the whole organization that keep working when members leave
• Scheduled reports on Pro: daily, weekly or monthly PDF summaries, for the whole organization or per customer

Learn more about Alerts →

Hosting

• MTA-STS hosting (Pro): MailShield serves your MTA-STS policy for a verified domain. Learn more →
• BIMI logo hosting (Pro): MailShield hosts your BIMI logo for a verified domain. Learn more →

PDF Reports

• A PDF report per domain, from the domain's Overview
• A customer report (Pro) covering all domains, from the Reports page
• Report branding (Pro): your own name, logo and color on the PDFs. See Organizations

Team Collaboration

• Roles: owner, admin and member. See Organizations
• Invitations by email. See Inviting Members
• Customers and tags to group domains per client
• Personal alert settings: each member chooses which alerts reach them
• Audit log of changes, for owners and admins. See Audit Logs

Platform Capabilities

Automatic Discovery

MailShield automatically finds:

• DKIM selectors in your DMARC reports
• Mail servers from your MX records
• Email providers from your SPF includes

SPF Include Tree

• Nested include expansion
• DNS lookup counting
• Provider identification
• Validation at each level

Bulk Import

Add up to 500 domains at once, and copy all the DNS records they need in one go. See Bulk Import.

API

A REST API for domains, customers, checks, scores, reports and alerts, on Pro. See the API documentation.

Tools

Deliverability Tester

Send a test email to a one-time address and see how receiving servers are likely to treat it:

• Authentication: SPF, DKIM and DMARC
• Reputation: reverse DNS, sender MX and blocklists
• Content and headers: common spam signals
• A 0-100 score, where higher is better

Learn more about the Deliverability Tester →

SPF Checker

Analyze the SPF record of any domain and share the result. Learn more →

Security and Privacy

Account Security

• All connections encrypted with TLS
• Sign in with an email link, a passkey, or your Google or Microsoft account
• Role-based access control

Your Report Data

• DMARC aggregate reports contain no message content: only sending IPs, message counts and authentication results.
• DMARC failure reports (ruf) can contain message headers and content. If you point ruf at your MailShield Reporting address, MailShield stores the failure reports it receives but doesn't show them in the dashboard.
• TLS reports contain connection statistics, not messages.