Adding a Domain

This guide covers adding a domain to MailShield, verifying it and sending its reports to MailShield.

Add a Domain

Requires: owner or admin. Members can view domains but not add or change them.

Go to Domains in the sidebar and click Add Domain. A wizard walks you through up to six steps: Domain, Email, Verify, DMARC, TLS-RPT and Complete. Parked and send-only domains skip the TLS-RPT step, since they receive no mail to report on.

To add many domains at once, use Import multiple domains on the first step, or see Bulk Import.

1. Domain

Enter the domain name, for example example.com, without www. If you paste a URL or an email address, MailShield keeps just the domain. Click Continue.

2. How Is This Domain Used?

Choose the option that matches how the domain handles email. The wizard shows what's checked and scored for the option you pick:

Option	Use it for	What's checked and scored
Sends and receives email	A normal email domain with mailboxes, or apps that send and receive mail	Everything: SPF, DKIM, DMARC and BIMI for sending; MX with TLS, MTA-STS, TLS-RPT and DANE for receiving; and DNSSEC
Only receives email	A domain with mailboxes that never sends, such as a support inbox	MX with TLS, MTA-STS, TLS-RPT, DANE and DNSSEC, with SPF at -all and DMARC at p=reject. DKIM and BIMI don't apply
Only sends email	Transactional or marketing mail with no incoming mail	SPF, DKIM, DMARC, BIMI, DNSSEC and an MX so bounces arrive. MTA-STS, TLS-RPT and DANE don't apply
Parked domain	A domain that neither sends nor receives email	A null MX, SPF at -all, DMARC at p=reject and DNSSEC. Nothing else applies

The usage type decides which checks MailShield runs and how your security score is calculated. You can change it later under Domain → Settings → Email Configuration.

For a domain that receives email, also enter a mailbox that exists on the domain, such as admin or postmaster (only the part before the @). MailShield connects to your mail servers and checks that they would accept mail for it. No email is sent.

Click Continue. This adds the domain to your organization. The Free plan includes 1 domain; on Pro, each domain is billed. See Plans and Billing. To fix a typo in the name after this, go back to the first step and click Remove and start again.

3. Verify Ownership

Add the TXT record the wizard shows at your DNS provider:

Host:  _mailshield.example.com
Type:  TXT
Value: mailshield-verify=your-verification-code

TIP

Some DNS hosts add your domain name to the host automatically. If yours does, enter only _mailshield as the host, or the record ends up at _mailshield.example.com.example.com. A record at @ will not work.

You can click Continue while DNS propagates. There's no button to verify: MailShield looks for the record on the Complete step and keeps checking in the background, then marks the domain Verified as soon as it finds it.

Until the domain is verified, MailShield doesn't score it or send score, DNS change or certificate alerts for it. DMARC and TLS reports are collected either way. Hosted MTA-STS and a hosted BIMI logo also need a verified domain.

4. DMARC Reporting

To receive DMARC aggregate reports from email providers (Google, Microsoft, Yahoo and others), add your domain's Reporting address to its DMARC record.

Each domain in MailShield has its own Reporting address: a full email address such as abc123@reports.mailshield.app. You'll find it in two places:

• In the header of the domain's Overview page
• Under Domain → Settings → Domain Information

Copy the whole address. Don't add your domain name or anything else to it.

The wizard reads your current DMARC record and shows what to publish:

• No DMARC record yet: it shows a new record to add at _dmarc.example.com.
• A record without reporting: it shows your record with the Reporting address added.
• A record that already sends reports elsewhere: choose Keep existing reporting and add MailShield or Switch completely to MailShield.
• The lookup failed: it doesn't suggest a record, because a new record next to an existing one would leave two, and receivers ignore both. Click Check again, or add your Reporting address to your record's rua tag yourself.

In the examples below, replace abc123@reports.mailshield.app with your own Reporting address.

If you don't have a DMARC record yet:

v=DMARC1; p=none; rua=mailto:abc123@reports.mailshield.app

If you have an existing DMARC record, add your Reporting address to its rua tag and keep your current policy:

v=DMARC1; p=quarantine; rua=mailto:existing@example.com,mailto:abc123@reports.mailshield.app

WARNING

Separate multiple rua addresses with commas within the same tag. Don't add a second rua tag, and don't publish a second DMARC record: with two records, receivers ignore both.

5. TLS-RPT Reporting

For domains that receive email, add a TLS-RPT record at _smtp._tls.example.com with the same Reporting address:

v=TLSRPTv1; rua=mailto:abc123@reports.mailshield.app

Sending servers then report failed TLS connections to your mail servers. See TLS-RPT.

6. Complete

MailShield checks the verification, DMARC and TLS-RPT records for about two minutes.

• When everything is found, click View Domain.
• If a record isn't found yet, the wizard says why for each one: there's no record at the host yet, the TXT record there has a different value, the DMARC or TLS-RPT record doesn't include your Reporting address, or the DNS lookup failed. For a missing verification record, check the host first (see the tip in step 3). Then click Retry, or Skip for now to finish. The domain is added either way, and MailShield keeps checking in the background.

An unverified domain shows a banner on its Overview with a Set up DNS records button that reopens these steps.

Adding DKIM Selectors

MailShield discovers DKIM selectors automatically from your DMARC reports. To add one yourself:

1. Open the domain and go to Checks → DKIM.
2. Click Add Selector.
3. Enter the selector name, for example google or selector1.

MailShield looks up the key and checks it. For the selectors common providers use, see Third-Party Senders.

Changing the Usage Type or Test Mailbox

Go to Domain → Settings → Email Configuration. Pick the usage type, update the test mailbox for receiving domains, and save.

A new usage type weighs the checks differently, so the score changes with it. The next check takes that score as the new baseline, without a score alert.

Grouping Domains

Assign a domain to a customer and add tags under Domain → Settings → Customer and tags. Owners and admins create customers and tags on the Domains page with Manage customers and Manage tags. See Customers and Tags.

Domain Limits

The Free plan includes 1 domain. Pro has no domain limit and bills per monitored domain. See Plans and Billing for details, or check Settings → Billing for your current usage.

Removing a Domain

Requires: owner or admin.

1. Open the domain and go to Settings.
2. In the Danger Zone, click Delete Domain.
3. Type the domain name and confirm.

DANGER

Deleting a domain removes all its check history and reports. This can't be undone.