Does Palisade have write access to my DNS?

Only to your email-authentication records, and only after you authorise the connection yourself in your DNS provider's own window. Palisade never asks for or stores your provider credentials. MX, A, CNAME and every other record in the zone are outside the scope, no record is written without your approval, and you can disconnect at any time.

Which DNS providers does Palisade publish to?

More than 50, covering the registrars and DNS hosts most businesses use, including GoDaddy, Cloudflare, Namecheap, Amazon Route 53, Squarespace and IONOS. The full current list is on this page. Palisade checks which provider answers for your domain and tells you before you start, so you know which path is open to you.

Can Palisade publish a record without my approval?

No. The Agent investigates, drafts the fix, and proposes each step — you approve before anything ships. What this changes is only what happens after you approve: publishing is a click instead of a copy-paste into a provider dashboard.

Do my nameservers or registrar move?

No. Your registrar and nameservers stay exactly where they are, and nothing is transferred. Palisade never takes over your zone; each record you approve is written into the zone you already have.

What if my DNS provider isn't supported?

The record is still generated in full and ready to paste, and monitoring confirms when it goes live. You lose the one-click step, not the fix, and the provider list grows without a release on our side.

How long until a published record is live?

The write itself is immediate, and how quickly resolvers see it depends on the TTL your provider serves. Palisade keeps checking after publishing and confirms when receivers can resolve the record, so a change that did not take becomes a ticket instead of something you find out about weeks later.

Smart DNS Deployment

DMARC deployment without hand-editing DNS.

Palisade publishes your SPF, DKIM, DMARC, BIMI and MTA-STS records into your own DNS, across 50+ providers. You approve the exact record; nothing waits on a ticket.

Get started Book a demo

Summarize with

MSPAI-assisted workflow Domains Hosted DNS Reports Toolbox TLS Reports IntegrationsBIMI Verified checkmark

Set up acme-corp.com

✓Records✓Provider✓Approve4Live

All five records are live in your own DNS.

TXT@ · SPFLive

CNAMEs1._domainkey · DKIMLive

TXT_dmarc · DMARCLive

CNAME_mta-sts · MTA-STSLive

CNAMEdefault._bimi · BIMILive

✓Receivers can see the new records, and monitoring stays on.

Published into your own zone at Cloudflare. Nothing else in the zone was touched.

The last mile is where DMARC dies

Knowing is not the same as publishing. Palisade's State of DMARC 2026 scan of the top 100,000 domains found 24.1% of domains with DMARC (13,928) collect the reports, can see exactly what is wrong, and still block nothing. The report is not the bottleneck. The DNS edit is.

You approve, Palisade publishes

Every change arrives as a record diff: the value now, the value proposed, and one button. Nothing reaches your zone until you accept it, access covers email-authentication records only, and you can disconnect at any time.

Works across a mixed estate

Free DMARC reporting from a DNS host only helps for the domains already parked there. Palisade recognises whichever provider answers for each domain and publishes there, so a portfolio spread across five registrars is one workflow.

Trusted by leading brands worldwide

Quickstart

Works with the DNS manager you already have

Palisade recognises the provider answering for each domain and publishes there. These are the twelve most common; the full list is below.

GoDaddy
Cloudflare
Namecheap
Amazon Route 53
Squarespace
Wix
IONOS
Hostinger
Bluehost
HostGator
OVH
Network Solutions

See all 64 providers with automatic setup

123-Reg
Alibaba Cloud
All-Inkl
Amazon Route 53
Aruba
Arsys
Bluehost
Cloudflare
ClouDNS
Crazy Domains
Domain.com
DigitalOcean
DNSimple
DreamHost
Dynadot
EasyDNS
Enom
Fasthosts
Freename
Gandi
GoDaddy
GreenGeeks
Hetzner
Home.pl
HostGator
Hosting.com
Hostinger
Hostpoint
Hover
Inmotion Hosting
IONOS
IWantMyName
LocaWeb
Mijndomein
Name.com
Namebright
Namecheap
NameSilo
Network Solutions
Netlify
O2switch
One.com
Openprovider
OpenSRS
OVH
Papaki
Porkbun
Register.com
Register.it
Registro.br
Shopify
Simply
SiteGround
Spaceship
Squarespace
Strato
TransIP
United Domains
Vercel
Web.com
Wix
Wordpress.com
World4You
Xneelo

Counted 2026-08-19. Providers are added upstream, so the list grows without a change here. If yours is not on it, the record is still written out in full for you to paste, and Palisade confirms when it goes live.

How it works

From report to published record

One connection turns every future fix into a review-and-approve.

Connect the provider once

Palisade checks which DNS provider answers for the domain and recognises it. You authorise the connection in that provider's own window. No password is shared with Palisade, and access is scoped to the email-authentication records.

The Agent drafts the fix

A new sender needs DKIM, an SPF source changed, a policy step is ready. The work arrives as a ticket with the exact record already written, not as a task telling you to go write one.

You approve the exact record

The ticket shows the current value and the proposed value side by side. Nothing is published until you accept it, and every approval is recorded.

Palisade publishes and verifies

The approved record is written into your own zone through the connection you authorised. Monitoring then confirms receivers can resolve it, so a change that silently failed becomes a ticket instead of a surprise.

At a glance

What access this actually grants

The question every security team asks first, answered before you connect anything.

What Palisade can write	Email-authentication records only: SPF, DKIM, DMARC, BIMI and MTA-STS. MX, A, CNAME and everything else in the zone are never touched.
Who authenticates	You do, with your own provider, in that provider's own window. Palisade never asks for, stores, or sees your DNS credentials.
What triggers a write	Your approval, every time. The Agent drafts the record and shows the before-and-after; no record reaches your zone unapproved.
Reversibility	Disconnect the provider whenever you like. Records already published stay in your zone. They are yours, written into your own DNS.
Your registrar and nameservers	Unchanged. Nothing is transferred and Palisade never takes over your zone; the records simply stop being typed by hand.
If your provider isn't supported	The record is still written out in full, ready to paste, and monitoring confirms when it goes live.

What's included

What you get

One-click publishing into your own DNS

Each approved record is written into your zone at your own provider. No values typed by hand.

Automatic provider detection

Palisade works out which provider answers for each domain before you start, so you know which path is open to you.

Record diffs before every write

Current value, proposed value, one approval. The diff is the unit of work, so nothing changes without being read first.

Scoped, revocable access

Email-authentication records only, authorised by you in your provider's window, and disconnectable at any time.

Portfolio publishing for MSPs

200 client domains at five auth records each is 1,000 hand-edits across a dozen provider dashboards, redone every time a sender changes. This is the alternative.

Post-publish verification

Monitoring confirms receivers can resolve each record after it lands, so a change that did not take becomes a ticket.

Teams that stopped copying records by hand.Less DNS work. More domains at enforcement.

Deliverability

21% more meetings booked.How gaiia stopped landing in spam.

“We increased our meetings booked by 21% and slept better at night knowing our emails are now secured”

Marc-André Campagna, CEO, gaiia

Read the case study

Marketplace partner

Manual email authentication doesn't scale.Why Sherweb chose Palisade for 7,500+ MSPs: an agentic platform and a roadmap that moves fast.

“MSPs are managing more client domains than ever, and manual email authentication just doesn't scale. Palisade removes the technical complexity and time drain from DMARC compliance, giving our partners a way to deliver real protection and improved deliverability to every client they serve.”

Benji Germain, Vice President of Product, Sherweb

See Palisade for MSPs

Enforcement

Work with pros before changing anything.Why Devialet would not move to reject until every app checked out.

“We thought our implementation was good, but we weren't sure all of our different apps were configured properly. We never wanted to switch to quarantine or reject before we had DMARC software in place, our email program drives a significant chunk of our revenue. We wanted to work with pros before changing anything.”

Devialet

See the integration guides

Operations

Everything done faster.How SecurITShell simplified its DMARC operations.

“Palisade streamlined all of our DMARC operations. It was so complicated at first, it was taking so much time. It allowed us to get everything done faster and have a complete overview of our operations, at such an affordable cost. We're saving so much time. It's a great improvement for our operations.”

James Morin, IT Maestro, SecurITShell

See the DMARC Agent

gaiia's trade-show booth, its overhead banner reading "grow better with gaiia" above a mint-green wall that says "If your BSS is kind of BS, talk to us."

Questions

Smart DNS Deployment: FAQ

Smart DNS Deployment is how a record gets published: Palisade connects to your DNS provider and writes the approved record into your own zone. Hosted DNS is about where the records live afterwards. You delegate them to Palisade with one CNAME each, and Palisade serves them, so future changes take effect without touching your provider at all. The deployment connection is also what publishes those delegation CNAMEs in the first place.

Stop waiting on the DNS ticket

Get started Book a demo

1 domain free up to 1,000 emails/month