MSP Getting Started
This guide walks you from subscribing to a partner plan through onboarding your first customer. Steps 1, 2 and 4 take minutes. Step 3 depends on DNS propagation and step 5 depends on how quickly receivers send their first reports.
Before You Begin
Have the following ready before starting:
- A DDMARC account (any plan) — you subscribe to Partner from inside it
- A payment card: partner plans are billed monthly with no trial
- Admin access to your own DNS, if you want a vanity portal domain
- A publicly reachable HTTPS URL for your logo and favicon
- The login email address for each customer domain you plan to onboard
Setup Process
Subscribe to a Partner Plan
Partner and Partner Starter are self-serve. There is no partner agreement to sign and no credentials get mailed to you.
- Sign in to your DDMARC dashboard (or register a new account)
- Go to Settings → Billing and choose Partner or Partner Starter
- Complete Stripe Checkout — the card is charged immediately, there is no trial
- The Stripe webhook flags your organization as a partner and the Partner section appears in the sidebar
Configure Your Branding
Set the logo, colors and support details customers see in the portal.
- Go to Partner → Branding
- Paste a public HTTPS URL for your logo and favicon — there is no file upload
- Set your primary color and accent color as hex values
- Set your company name, support email and support URL
- Clear any field to fall back to the DDMARC default
Add Your Vanity Portal Domain (optional)
Your portal already works at {your-slug}.portal.ddmarc.com. A vanity domain is additive, not required.
- Go to Partner → Domain and enter the hostname you want, e.g. dmarc.yourcompany.com
- Publish the TXT record it gives you at _ddmarc-verify.<your hostname>
- Publish a CNAME from that hostname to connect.ddmarc.com
- Click Verify — the check is rate limited to 5 attempts per minute
- TLS is issued automatically once the hostname resolves to our edge
Add Your First Customer
Create the customer organization that will hold their domains.
- Go to Partner → Customers → Add customer
- Enter a name and a slug (lowercase letters, numbers and hyphens — required)
- Enter the admin email, and optionally an admin name
- Note the default domain cap: new customers are created with a 2-domain limit
- Raise the cap from the customer's detail page or from Partner → Billing
Enroll Domains and Set Login Emails
Enrolled domains verify themselves on the first DMARC report. The login email is what actually lets your customer in.
- Open the customer and add their domain — only you can do this, the portal is read-only for domains
- Publish the DMARC record we generate on the customer's domain, including our rua address
- The first aggregate report that arrives verifies the domain automatically — there is no verification TXT record to add
- Set the Login OTP email on each domain, otherwise that customer cannot sign in at all
- Reports typically start arriving within 24–48 hours as receivers batch them daily
Vanity Domain DNS Records
A vanity portal domain needs two records: a TXT record proving you own the hostname, and a CNAME pointing it at our portal edge. Both must be live before verification succeeds.
| Type | Name | Value | TTL |
|---|---|---|---|
| TXT | _ddmarc-verify.dmarc.yourcompany.com | <token from Partner → Domain> | 3600 |
| CNAME | dmarc.yourcompany.com | connect.ddmarc.com | 3600 |
Replace dmarc.yourcompany.com with the hostname you entered. The verification token is generated per partner organization and shown on Partner → Domain. After both records resolve, click Verify; TLS is then issued automatically. Global DNS propagation can take up to 24–48 hours, though most resolvers pick the records up far sooner.
Quick Wins
Tips that save partners the most time on their first few customers:
Start with your own domain
Create a customer organization for your own company first. You learn the enrollment flow with a domain whose DNS you already control.
Set the login email as you enroll
A domain with no Login OTP email is invisible at the portal login screen — the request returns the same generic response as an unknown domain. Set it at enrollment time, not when the customer complains.
Raise the domain cap early
New customer organizations are capped at 2 domains. If you know a customer has ten, raise the cap before you start adding, so you are not interrupted mid-onboarding.
Use the prospect scanner
Partner → Prospect scanner grades up to 50 domains per scan (200 per day) and produces a white-label PDF. It is a sales tool, not a provisioning tool — it does not create customers.
Not available yet — CSV bulk customer import
There is no CSV import and no bulk-provisioning endpoint. Customers are created one at a time, either in Partner → Customers or with one POST /api/v1/msp/customers call per customer. If you are onboarding a large book, script that endpoint with an admin-scoped API key.
Not available yet — Customer email template editing and inherited default alert rules
You cannot edit the wording of customer-facing emails, and there is no mechanism to define alert rules that new customer organizations inherit. Your branding is applied to the login email automatically; alert rules are configured per organization.
What to Expect
Console live
Subscription active, branding configured, first customer created. If you added a vanity domain, verification may still be waiting on DNS.
Domains enrolled
Customer domains added and DMARC records published on their DNS.
Reports start arriving
The first aggregate report auto-verifies each domain and populates the portal.
Full visibility
Enough report history to see the real sender picture and plan a policy rollout.
Next Steps
Need Help with Setup?
Both partner plans include priority support. Reach out to our partner support team and we will pick it up ahead of the standard queue.
Contact Partner Support