Öffentliche Demo - read-only

Änderungen werden nicht gespeichert. Nutze eine eigene DMARQ-Installation, um echte Einstellungen zu ändern.

Recommended setup

Finish the next safe setup step

Connect report intake first.

Connect report mailbox Add or review domains

Language

Choose the language used for navigation, guidance, dates, and numbers in this browser.

Language Your explicit choice is kept in this browser and takes precedence over the instance default.

Account and access diagnostics Authentication, roles, billing, and support readiness

Account and Access Milestone

Product readiness for authentication, workspace RBAC, billing ownership, provider lifecycle, enterprise provisioning, and audited support access.

Loading account readiness...

General

Basic application settings

Application Name Display name shown in the navigation bar and page titles

Base URL Public URL used in OAuth2 redirect URIs and email links

Reports Per Page How many reports are shown per page

Session Lifetime (minutes) How long login sessions remain valid

Default Sending Sources Window Applied when opening a domain. You can still choose any window, including all time, on that page.

Save this section after changing product name, public URL, or session behavior.

DMARC Policy Defaults

Default values applied when adding a new domain

Default Policy

Default Percentage Percentage of messages to which the policy is applied (pct tag)

DKIM Alignment (adkim)

SPF Alignment (aspf)

Aggregate report mailbox Used in generated DMARC rua records. Leave empty to use dmarc@domain.

TLS report mailbox Used in generated SMTP TLS-RPT records. Leave empty to use tlsrpt@domain.

These defaults feed generated DMARC and TLS-RPT records for newly added domains.

DNS Resolver

Choose how DMARQ resolves DNS records for domain lookups

DNS Resolver All profiles bypass the host resolver. Enterprise and custom profiles use resolver values supplied by environment or secret configuration.

Add to this deployment, then save or refresh this page to use the selected resolver.

Resolver changes affect DNS linting, cache refreshes, and remediation evidence.

DNS Provider Connectors

Connect provider accounts to verify domain ownership, import DNS zones, and feed safe repair previews. DNS write access remains a separate human-approved step.

Cloudflare OAuth

Connected with scoped access. Ready to connect with read-only zone and DNS access. Configure Cloudflare OAuth client credentials on the server to enable one-click connect.

Request scopes:

Cloudflare client permissions:

Granted scopes:

API Token

Optional fallback. Use Zone:Read and DNS:Read for discovery; add DNS:Edit only when repair is enabled.

Zone ID Optional. Leave blank to discover all zones available to the token.

Provider Domain Discovery

Find DNS zones and import them into DMARQ before reports arrive.

Auth:

Provider setup docs

Compare a zone export without provider credentials

Paste BIND-style zone data for a temporary comparison. Imported evidence stays separate from public DNS and never changes health scores.

Save token or OAuth profile changes before discovering provider zones.

Mail Service Imports

Discover verified sender domains from mail delivery services before DMARC reports arrive. Postmark uses an account token with read-only sender-domain discovery in DMARQ.

Postmark Account Token

Stored securely; leave as-is to keep an existing token

Verified Sender Domains

Preview Postmark domains and import them into DMARQ for DNS linting and monitoring.

Save provider credentials before previewing or importing sender domains.

Advanced privacy settings Forensic redaction controls

Forensic Reports

Control privacy for forensic report metadata

Notifications

Send alerts through Apprise-compatible targets

Enable notifications

Minimum Send Interval

Redact email addresses in messages

Alert Rules

New sending sources

Missing reports

High DMARC failures

Compliance drops

Failure Threshold

Missing After Days

Drop Points

Summary Notifications

Daily summary

Weekly summary

Send Hour (UTC)

Weekly Day

Preview Period

Alert History

Configuration Audit

Advanced webhook delivery Signed event fan-out and delivery history

Webhooks

Send signed operational events to downstream systems

Name

Endpoint URL

Events

Max Attempts

Timeout Seconds

Name	URL	Events	Status	Last Result

Recent Deliveries

Advanced AI and agent automation Opt-in model and MCP controls

AI and Agent Automation

Opt-in summaries, read-only MCP access, and human-confirmed proposal controls

AI and MCP features are disabled by default. Safe context always redacts secrets and tokens before it can be shared with model or agent surfaces. PII redaction is controlled below.

Enable AI assistance

Enable read-only MCP endpoint

Provider

Model

Redaction

Provider Base URL Required

API Key Required

For self-hosting, environment-injected credentials still work; this field is for managed settings.

Allow human-confirmed action proposals

Mail Sources

IMAP, POP3 and Gmail API inbox credentials are managed on the dedicated Mail Sources page.

Manage Mail Sources