Bulk Import

This guide covers how to add and verify many domains at once using MailShield's bulk import feature.

Overview

Requires: owner or admin.

Bulk import lets you add up to 500 domains in a single operation. You choose one usage type (and test mailbox) for the whole batch, and the domains start unverified. After import, you can configure DNS records for all domains from a single page.

Importing Domains

Via Textarea

1. On the Domains page, click Import (or choose Import multiple domains in the Add Domain wizard)
2. Enter your domains in the text area: one per line, or separated by commas
3. Click Review Domains to preview the list. It shows the new domains and what's skipped. On Pro, it also shows what the import adds to your monthly bill (excluding VAT) before you confirm
4. Under How are these domains used?, choose the usage type for all of them. For domains that receive mail, also enter a test mailbox (postmaster by default), which is used for every domain in the import
5. Click the Import button to create them

Via CSV Upload

1. Click Upload CSV and select a .csv or .txt file
2. The file can list one domain per line, or be a spreadsheet export. If the first row has a "domain" column, only that column is read, so other columns such as customer names aren't imported as domains. Quoted fields work, and semicolon- or tab-separated files are recognized
3. Review and import as above

TIP

Domains are automatically deduplicated. Duplicate entries and domains that already exist in your organization are skipped, and so are entries that aren't domains, such as email addresses.

Domain Verification

After importing, verify each domain by adding its DNS records. Until a domain is verified, MailShield doesn't score it or send score, DNS change or certificate alerts for it. Reports are collected either way.

Required DNS Records

For each domain, you need to add up to three DNS TXT records. For DMARC and TLS-RPT, that can mean updating a record the domain already has (see Exporting DNS Records):

Record	Host	Purpose
Verification	_mailshield.yourdomain.com	Proves domain ownership
DMARC	_dmarc.yourdomain.com	Enables DMARC report collection
TLS-RPT	_smtp._tls.yourdomain.com	Enables TLS failure reporting

INFO

TLS-RPT records are not required for parked or send-only domains.

Bulk DNS Setup Page

After a successful import, click Set Up DNS Records to open the bulk DNS setup page. This page shows all imported domains with their required DNS records. When it opens, MailShield looks up each domain's current records, 50 at a time, and marks domains whose verification record is already in place as verified.

Features

• Per-domain records: Expand any domain row to see its specific DNS records with copy buttons, and what the lookup found for each
• Copy All as BIND: Copies all DNS records for all domains in BIND zone file format, ready to paste into your DNS management tool or send to your DNS administrator
• Verify All: Checks every domain that isn't done yet, 50 at a time
• Filter: Switch between All and Not done. A domain is done once it's verified and its DMARC record (and TLS-RPT record, where needed) sends reports to MailShield
• Progress tracking: Shows how many domains are verified and how many report to MailShield, with a progress bar for the finished ones

Workflow

1. When the first lookup has finished, click Copy All as BIND to get all required records
2. Add the records to your DNS provider (or send to your DNS team)
3. Wait for DNS propagation (usually a few minutes, up to 48 hours)
4. Click Verify All to check which domains are done
5. Repeat step 4 as needed: records propagate at different speeds

If a verification record isn't found, check its host: when your DNS host adds the domain name automatically, enter only _mailshield as the host.

MailShield also keeps checking unverified domains in the background and verifies them automatically once their record appears.

Exporting DNS Records

The Copy All as BIND button generates a consolidated zone file grouped by domain. The DMARC and TLS-RPT records are built from what each domain publishes now:

• No record yet: a new record. For DMARC, that's a starter record with p=none, which collects reports without changing how mail is handled.
• A record without MailShield: the current record with MailShield added to rua. Every other tag, the policy included, stays as it is.
• A record that already reports to MailShield: nothing to change.
• Lookup failed: a comment instead of a record, because MailShield can't tell whether one exists. Click Verify All to look it up again.

; --- example.com ---
_mailshield.example.com. 3600 IN TXT "mailshield-verify=abc123..."
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:..."
_smtp._tls.example.com. 3600 IN TXT "v=TLSRPTv1; rua=mailto:..."

; --- example.org ---
_mailshield.example.org. 3600 IN TXT "mailshield-verify=def456..."
; Replaces the current record at _dmarc.example.org. Remove the old one: with two, receivers ignore both.
_dmarc.example.org. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.org,mailto:..."
_smtp._tls.example.org. 3600 IN TXT "v=TLSRPTv1; rua=mailto:..."

You can also expand individual domains and use the per-record copy buttons if you prefer to configure them one at a time.

Replace existing records

A record marked as a replacement takes the place of the domain's current DMARC or TLS-RPT record. Remove the old record when you publish it: with two DMARC records, receivers ignore both.

Tips for Large Imports

• Plan limits apply: The Free plan includes 1 domain, and the review step tells you how many fit. On Pro, every imported domain is billed, and the review step shows the cost before you confirm. See Plans and Billing.
• DNS propagation varies: Not all domains will verify at the same time. Click Verify All periodically to check progress.
• Unverified domains are still accessible: You can open unverified domains; they show a banner with a Set up DNS records button.
• One usage type per import: The usage type and test mailbox apply to every domain in the import. To mix usage types, import each group separately, or change them afterwards: for several domains at once from the domain list, or per domain under Domain → Settings → Email Configuration. Parked or send-only domains keep a wrong score until they have the right usage type.
• Batch your DNS changes: If you manage DNS through a provider API or zone file import, the BIND export format lets you add all records in one operation.