Customer Management
Every customer is a separate organization under your partner account, holding its own domains and its own report data. You create customers, enroll their domains and control their domain cap. Customers themselves get a read-only portal.
Customer domain caps are off by default
A new customer organization has no domain limit until you set one — enroll as many domains as the client needs from day one. Partner plans themselves carry no domain limit either; the only ceiling on your book is what you enroll and are billed for. Customer organizations do get 30 days of report retention when created, the Monitor plan's window — that is not inherited from your partner plan, whose own organization keeps its 1-year retention.
If you want to cap a specific customer, set it from their detail page under Partner → Customers, or from the per-customer row on Partner → Billing, or with PATCH /api/v1/msp/customers/{customer_public_id} and a max_domains value from 1 to 10,000. Send null to remove the cap again. Setting or removing a cap has no effect on what you pay beyond the domains you actually enroll — every enrolled domain is billable whether or not it is within a cap.
Adding a Customer
Create the organization
Go to Partner → Customers → Add customer (/dashboard/msp/customers). The dialog collects four fields and nothing else.
| Field | Required | Description |
|---|---|---|
| Name | Display name for the customer organization | |
| Slug | Lowercase letters, numbers and hyphens only. Identifies the customer organization; must be unique | |
| Admin email | Admin address for the customer organization. Note this is separate from the per-domain login email you set later | |
| Admin name | — | Full name of the primary contact |
There is no phone, notes or domain-limit field at creation time. The domain limit is a post-creation change on the customer's detail page. No welcome or invitation email is sent — creating a customer is a silent operation.
Not available yet — CSV bulk import and customer suspend/status
Customers are created one at a time. There is no CSV import, no bulk endpoint, and no Active / Pending / Suspended status field — you cannot disable a customer's access without deleting the customer or clearing the login email on their domains. The customer list does surface an At limit indicator when a customer has reached their domain cap. To onboard many customers at once, script POST /api/v1/msp/customers.
Managing Customer Domains
Domains are enrolled by you, from the customer's detail page. The customer portal is read-only: your customers cannot add or remove their own domains. There are two actions on this page.
Domain Actions
Add domain
Enroll a domain into this customer's organization. Blocked once the customer hits their domain cap.
Partner → Customers → (customer) → Add domain
Set the Login OTP email
The address that receives the one-time code when someone signs in with this domain. Until it is set, the domain shows “Not set — can't log in” and nobody can access the portal for it.
Partner → Customers → (customer) → domain row → Login OTP email
There is no per-domain settings screen and no remove-domain action on the customer page. To stop being billed for a domain, delete the customer organization that holds it — the count drops at the next daily sync, within about 24 hours. Deleting the organization deletes its history, so export anything you need for a final report first.
How Domain Ownership Is Proven
Publish the DMARC record
A receiver sends a report
The domain auto-verifies
Verification is deliberately strict: a report for mail.example.com does not verify example.com. Expect the first reports within 24–48 hours of the DMARC record going live, since receivers batch aggregate reports daily.
Customer Portal Access
Customers sign in with their domain name. There is no password anywhere in this flow.
Customer Login Flow
Visit portal
your-slug.portal.ddmarc.com or your vanity domain
Enter domain
customer.com
Receive a code
6-digit OTP + magic link, valid 15 minutes
Access portal
Their own domains only
The code goes to the Login OTP email configured on that specific domain. If it is unset, the login request returns the same generic "check your email" response as an unknown domain and nothing is sent — by design, so the endpoint cannot be used to enumerate which domains you manage. On a branded host, only domains belonging to your customers resolve.
What Customers Can See
Customers CAN
- View the dashboard and trends for their own domains
- Read DMARC aggregate reports and the sender breakdown
- Run a live DNS check against their domains
- Follow policy rollout progress
- See alerts and change their notification preferences
Customers CANNOT
- See any other customer or their data
- Add, edit or remove domains — only you can enroll domains
- Export report data — there is no export in the portal
- See any billing information
- Change partner-level settings or branding
Customer Data Retention
Customer organizations are created on the Monitor plan, which retains 30 days of report data. Your own partner organization retains 1 year. If a customer needs a longer history in their portal, raise it with our partner support team before you promise it — the child organization does not inherit your partner retention automatically.
Programmatic Access
The partner endpoints under /api/v1/msp/* accept an API key, but the key must carry the admin scope and belong to an admin user in your partner organization — a read or write key is rejected. Create keys from Settings in your dashboard.