BrightPost identifies every ESP using your domain, shows which ones are missing DKIM or SPF alignment, and automates the DNS changes needed to move from p=none to enforcement — without breaking legitimate mail.
14-day free trial · No credit card required · Exit guarantee included
The visibility problem
Most domains run 2–4 sending services in parallel: Microsoft 365 for internal email, a marketing platform for campaigns, a transactional service for receipts, a support tool for ticket notifications.
DMARC reports surface all of them — but reading raw XML manually doesn't scale. BrightPost parses every report and maps each sending source to a known ESP fingerprint. The result: a per-sender authentication status view that shows exactly which services are authenticated and which are exposed.
Add DKIM record for Zendesk
Zendesk requires a CNAME record in your DNS to sign outbound mail
The operational reality of p=none
p=none is monitoring mode. It's not protection.Most IT teams know this. The gap between knowing it and fixing it — without breaking legitimate mail — is what keeps domains stuck at none for months.
Right now
DMARC at p=none
Your domain can be impersonated right now and you will not be notified in time to stop it.
After enforcement
DMARC at p=reject
No legitimate mail interrupted. Unauthorized senders stopped at the mail server.
How it works
BrightPost generates vendor-specific DNS records each service requires, applies them to your DNS provider, and confirms alignment before advancing your DMARC policy — so you don't coordinate it manually across four different admin consoles.
See SPF and DKIM alignment for each ESP detected on your domain. Know exactly what is authenticated and what is exposed — without parsing raw XML.
Each ESP has different authentication requirements. BrightPost generates the exact CNAME, TXT, and SPF entries your DNS needs for each service — no documentation-diving required.
BrightPost recommends advancing your DMARC policy from none → quarantine → reject, and shows you when report data confirms it is safe to do so. You approve each step.
DNS access and safety
DNS is production infrastructure. Here is exactly how BrightPost handles it.
Read and write access to the specific DNS zone you connect. BrightPost does not require access to other zones, your registrar account, or billing. Cloudflare and Route 53 integrations use scoped API tokens — not account-level credentials.
Every DNS change BrightPost makes is recorded with a timestamp and the record affected. Nothing is applied silently.
BrightPost shows you the exact DNS record it will create or modify before applying anything. No change is made without your explicit action.
BrightPost integrates with Cloudflare and Amazon Route 53 for automated DNS writing. If your DNS is managed elsewhere, BrightPost generates the exact records and you apply them manually.
What this looks like in practice
These examples are based on actual multi-sender domain configurations. Domain names have been removed.
Starting state
Microsoft 365 · Mailchimp · Zendesk — DMARC p=none
After BrightPost
All 3 services authenticated — DMARC p=reject
Most domains reach full enforcement in 30–45 days. Here is the typical path:
Add domain — see your full authentication status in under 60 seconds
BrightPost reads your live SPF, DKIM, and DMARC records immediately. No waiting for reports. Within a minute you see which senders are authenticated and which are exposed.
Review per-sender status
For each unauthenticated sender, BrightPost shows the specific DNS records required and which DNS provider needs to receive them.
Apply fixes — automated or manual
Connect your DNS provider (Cloudflare or Route 53) and BrightPost applies the records directly. Or export them and apply yourself — your choice.
Confirm alignment
BrightPost monitors DMARC reports as they arrive and confirms each sender is aligning correctly. You see pass/fail rates per sender, not just aggregate numbers.
Advance policy when ready
Once all detected senders are authenticated, BrightPost recommends advancing from none → quarantine. After 14+ days of clean report data, → reject. You approve each step.
BrightPost automatically identifies and generates authentication records for these platforms:
For automated one-click record management:
Pricing
14-day free trial on all plans. No credit card required.
Perfect for small businesses
For growing companies
For large organizations
Exit guarantee: if you don't continue after 30 days, we'll export your recommended DNS records. No lock-in.
p=none to enforcement — without guessing.Start a free 14-day trial. Connect your domain, see your full authentication status in under 60 seconds, and get the exact DNS records you need to fix it.
Exit guarantee: if you don't continue after 30 days, we'll export your recommended DNS records so you can implement them manually. No lock-in.