Adding a Domain
SpoofWard can monitor an unlimited number of domains. This guide explains how to add additional domains beyond your first one.
Requirements
Before adding a domain, ensure:
- You have administrative access to the domain's DNS settings
- The domain is already registered and active
- You can add TXT records to the domain's DNS zone
- You have appropriate permissions in SpoofWard (Owner or Admin role)
Adding a Domain
Step 1: Navigate to Domains
In the SpoofWard dashboard, click Domains in the left sidebar, then click Add Domain.
Step 2: Enter Domain Name
Type the domain name (e.g., sales.example.com or subsidiary.com) and click Next.
You can monitor subdomains (e.g., mail.example.com) in addition to root domains. Each domain has its own DMARC policy and settings.
Step 3: Verify Domain Ownership
SpoofWard generates a unique verification token. You must add this to your domain's DNS to prove ownership.
To verify:
- Log in to your DNS provider (examples: Cloudflare, Route 53, GoDaddy, Namecheap, etc.)
- Find the DNS management section for your domain
- Create a new TXT record with:
- Name/Host: The value shown in SpoofWard (usually
_spoofwardor similar) - Value: The verification token from SpoofWard (copy the entire string)
- Save the record
- Return to SpoofWard and click Verify Domain
After adding the DNS record, verification is usually instant, but can take up to 5 minutes. If it fails, wait a moment and try again.
Step 4: Configure DMARC Reporting
Once verified, configure your DMARC record to point reports to SpoofWard:
Add or update your DMARC record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
If you already have a DMARC record with different report addresses, update only the rua and ruf fields to point to [email protected]. Keep all other settings.
Example (updating existing record):
Old record:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]
Updated record:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]
If your DMARC policy is already in enforcement (p=quarantine or p=reject), changing the report address will not affect your policy. Only the report destination changes.
Step 5: Wait for First Reports
DMARC reports are sent daily by receiving mail servers. Allow 24-48 hours for the first reports to arrive. During this time, the domain will show "No data yet" - this is expected.
To speed up report arrival:
- Send yourself a test email from your domain
- Send email to addresses at other domains (Gmail, Outlook, etc.)
- These receiving servers will generate DMARC reports within 24 hours
Managing Multiple Domains
Switching Between Domains
Once you have multiple domains added, you can switch between them:
- Click the domain selector in the top-left of the dashboard
- Choose which domain you want to view
- The dashboard updates to show data for that domain
Organization vs. Domains
- Organization - Your company or team (one per account)
- Domains - Individual email domains you own and monitor (unlimited per organization)
All team members in your organization can see all domains (based on their role permissions).
Domain Settings
For each domain, you can configure:
- Domain Name - Display name (can differ from actual domain)
- Description - Notes about the domain (internal use)
- Policy Status - Current DMARC policy (p=none, p=quarantine, p=reject)
- Email Addresses - Notifications for this domain
- DNS Records - View and validate current records
Click the domain settings icon (gear) to access these options.
SPF, DKIM, and Other Records
SPF Record
Your SPF record (at root of domain) specifies which IP addresses can send email for your domain:
v=spf1 include:sendgrid.net include:mailchimp.com ~all
SpoofWard's SPF Builder tool helps you construct and test SPF records without breaking existing ones.
DKIM Records
DKIM records (named like selector1._domainkey.yourdomain.com) contain public keys that sign outgoing email:
v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNA...
Most email providers (SendGrid, Mailchimp, Office 365) provide DKIM records for you. SpoofWard's DKIM Checker validates they're correctly configured.
MTA-STS Record
Optional but recommended for maximum security. Tells receiving servers to require TLS for email connections to your server:
v=STSv1; id=2024010101;
Requires a policy file at /.well-known/mta-sts.txt. SpoofWard's MTA-STS wizard helps set this up.
Removing a Domain
To remove a domain from monitoring:
- Go to Domains → Select domain → Settings
- Click Remove Domain
- Confirm the action
Removing a domain deletes all historical DMARC reports and settings. You can re-add the domain later, but historical data won't be recovered.
Troubleshooting
Verification token rejected?
- Ensure the DNS TXT record was created at the correct location
- Copy the verification token exactly (it's case-sensitive)
- Wait 30 seconds and try again
- Check that the DNS record was actually saved
DMARC reports not arriving?
- Verify your DMARC record has
rua=mailto:[email protected] - Send test emails to external domains (they generate reports)
- Wait up to 48 hours for first report
- Check if your DMARC policy is rejecting all email (unlikely, but possible)
Can't edit domain settings?
- You need Owner or Admin role
- Contact your organization owner to grant permissions
Next Steps
Once your domain is added and verified: