Customer Management
Every customer is a separate organization under your partner account, holding its own domains and its own report data. You create customers, enroll their domains and control their domain cap. Customers themselves get a read-only portal.
New customers are capped at 2 domains
Customer organizations are created on the Monitor plan, which allows 2 domains and 30 days of report retention. This is not inherited from your partner plan — your own organization keeps its 365-day retention, but each child customer starts at the Monitor limits.
To lift the cap, open the customer from Partner → Customers and raise the domain limit on their detail page, or adjust it from the per-customer row on Partner → Billing. Raising the cap has no effect on what you pay beyond the domains you actually enroll — every enrolled domain is billable whether or not it is within a cap.
Adding a Customer
Create the organization
Go to Partner → Customers → Add customer (/dashboard/msp/customers). The dialog collects four fields and nothing else.
| Field | Required | Description |
|---|---|---|
| Name | Display name for the customer organization | |
| Slug | Lowercase letters, numbers and hyphens only. Identifies the customer organization; must be unique | |
| Admin email | Admin address for the customer organization. Note this is separate from the per-domain login email you set later | |
| Admin name | — | Full name of the primary contact |
There is no phone, notes or domain-limit field at creation time. The domain limit is a post-creation change on the customer's detail page. No welcome or invitation email is sent — creating a customer is a silent operation.
Not available yet — CSV bulk import and customer suspend/status
Customers are created one at a time. There is no CSV import, no bulk endpoint, and no Active / Pending / Suspended status field — you cannot disable a customer's access without deleting the customer or clearing the login email on their domains. The customer list does surface an At limit indicator when a customer has reached their domain cap. To onboard many customers at once, script POST /api/v1/msp/customers.
Managing Customer Domains
Domains are enrolled by you, from the customer's detail page. The customer portal is read-only: your customers cannot add or remove their own domains. There are two actions on this page.
Domain Actions
Add domain
Enroll a domain into this customer's organization. Blocked once the customer hits their domain cap.
Partner → Customers → (customer) → Add domain
Set the Login OTP email
The address that receives the one-time code when someone signs in with this domain. Until it is set, the domain shows “Not set — can't log in” and nobody can access the portal for it.
Partner → Customers → (customer) → domain row → Login OTP email
There is no per-domain settings screen and no remove-domain action on the customer page. To stop being billed for a domain, delete the customer organization that holds it.
How Domain Ownership Is Proven
Reports are what perform verification, not the other way round. You do not need to ask your customer for a verification TXT record, and there is no email-based verification toadmin@ orpostmaster@.
Publish the DMARC record
Enroll the domain, then publish the DMARC record we generate — its rua address contains a token unique to that domain.
A receiver sends a report
Gmail, Microsoft or Yahoo looks up _dmarc.<domain>, finds the token and routes the aggregate report to us.
The domain auto-verifies
The token plus a matching policy domain proves your customer controls that DNS. Verification flips on the first ingested report.
Verification is deliberately strict: a report for mail.example.com does not verify example.com. Expect the first reports within 24–48 hours of the DMARC record going live, since receivers batch aggregate reports daily.
Customer Portal Access
Customers sign in with their domain name. There is no password anywhere in this flow.
Customer Login Flow
Visit portal
your-slug.portal.ddmarc.com or your vanity domain
Enter domain
customer.com
Receive a code
6-digit OTP + magic link, valid 15 minutes
Access portal
Their own domains only
The code goes to the Login OTP emailconfigured on that specific domain. If it is unset, the login request returns the same generic "check your email" response as an unknown domain and nothing is sent — by design, so the endpoint cannot be used to enumerate which domains you manage. On a branded host, only domains belonging to your customers resolve.
What Customers Can See
Customers CAN
- View the dashboard and trends for their own domains
- Read DMARC aggregate reports and the sender breakdown
- Run a live DNS check against their domains
- Follow policy rollout progress
- See alerts and change their notification preferences
Customers CANNOT
- See any other customer or their data
- Add, edit or remove domains — only you can enroll domains
- Export report data — there is no export in the portal
- See any billing information
- Change partner-level settings or branding
Customer Data Retention
Customer organizations are created on the Monitor plan, which retains 30 days of report data. Your own partner organization retains 365 days. If a customer needs a longer history in their portal, raise it with our partner support team before you promise it — the child organization does not inherit your partner retention automatically.
Programmatic Access
The partner endpoints under /api/v1/msp/* accept an API key, but the key must carry the admin scope and belong to an admin user in your partner organization — a read or write key is rejected. Create keys from Settings in your dashboard.