Appearance
Getting Started
This guide takes you from sign-up to your first security score.
Step 1: Sign Up
- Go to mailshield.app and click Get Started Free, or go straight to app.mailshield.app.
- Sign in with one of these:
- Continue with Email: enter your email address and click the sign-in link MailShield emails you. There's no password.
- Continue with Google or Continue with Microsoft: use your work account.
- The first time you sign in, enter your first name, last name and a team name, and click Continue. This creates your organization, named after your team. You can rename it later under Settings → Team.
After your first sign-in, you can add a passkey under Settings → Account → Passkeys and use Sign in with passkey from then on.
Sign-in options
Email links, passkeys, and Google or Microsoft sign-in are available on every plan. MailShield doesn't support SAML or connecting your own identity provider.
Step 2: Add Your First Domain
Go to Domains in the sidebar and click Add Domain. The wizard walks you through these steps:
- Domain: enter your domain, for example
example.com, and click Continue. - Email: choose how the domain is used: it sends and receives email, only receives, only sends, or is parked. For a domain that receives email, also enter a mailbox that exists on it, such as
admin. MailShield uses it to test that your mail servers accept mail; no email is sent. Click Continue to add the domain. - Verify: add a TXT record that proves you own the domain.
- DMARC: add your Reporting address to your DMARC record.
- TLS-RPT: add a TLS reporting record (skipped for parked and send-only domains).
- Complete: MailShield checks your records automatically.
The Free plan includes 1 domain. For the details of each step, see Adding a Domain.
Step 3: Verify Ownership
Add this TXT record at your DNS provider, using the value the wizard shows:
txt
_mailshield.example.com. TXT "mailshield-verify=your-verification-code"You don't need to click anything to verify. MailShield looks for the record during the wizard's last step and keeps checking in the background, then marks the domain Verified as soon as it finds it. Until then, MailShield collects reports for the domain but doesn't score it or send alerts about it.
INFO
DNS changes can take up to 48 hours to propagate, though most are visible within minutes.
Step 4: Configure DMARC Reporting
To receive DMARC reports from email providers, add your domain's Reporting address to your DMARC record (the TXT record at _dmarc.example.com).
The Reporting address is a full email address, such as abc123@reports.mailshield.app. You'll find it in the header of the domain's Overview page and under Domain → Settings → Domain Information. Copy the whole address into the rua tag:
txt
v=DMARC1; p=none; rua=mailto:abc123@reports.mailshield.appUse your own Reporting address exactly as MailShield shows it. Don't add your domain name or anything else to it. Providers send reports once they've seen mail from your domain, usually within 24-48 hours.
Step 5: Review Your Security Score
Once the domain is verified and checked, its Overview shows a grade from A to F and a score out of 100. The Email Security list shows each check with a status:
| Status | Meaning |
|---|---|
| Pass | Configured correctly |
| Attention | Works, but something should be improved |
| Fail | Missing or invalid |
| N/A | Doesn't apply to this domain's usage type |
| Not checked | No result yet |
MailShield checks every domain every 2 hours. After you change DNS, click Run Checks in the domain header to see the result right away. See Security Score for how the score works.
Finding Your Way Around
| To... | Go to |
|---|---|
| See all your domains | Domains in the sidebar |
| Open a domain's checks | The domain's Checks tab (Summary, SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC, BIMI) |
| Read DMARC and TLS reports | Reports in the sidebar, or the domain's Reports tab |
| See alerts | Notifications in the sidebar |
| Change a domain's usage type or test mailbox | The domain's Settings → Email Configuration |
| Choose which alerts you get | Settings → Notifications |
| Invite your team | Settings → Team |
| Switch organizations | The organization switcher at the top of the sidebar |
The checks shown for a domain depend on its usage type: DKIM and BIMI appear for domains that send mail, and MTA-STS and TLS-RPT for domains that receive it. DANE results are on the MX page.
Next Steps
- Learn about Adding a Domain in detail
- Understand your Security Score
- Set up Notifications for alerts