What is hosted DMARC?

Hosted DMARC is Palisade serving your email-authentication records. You delegate DMARC, DKIM, BIMI, and MTA-STS with CNAME records — and point SPF at a hosted include — so approved changes can be applied from Palisade instead of hand-edited at your DNS provider.

Do I have to move my domain or nameservers?

No. You publish one CNAME per record type at your existing DNS provider and Palisade serves those records from its own zone. Your registrar, your nameservers, and every non-email record stay untouched, and the delegation can be undone at any time.

Which records can Palisade host?

DMARC, DKIM, BIMI, and MTA-STS through CNAME delegation, and SPF through a hosted include. Together that covers the records email authentication depends on.

Can Palisade change my records without me?

No. The Agent investigates, drafts the fix, and proposes each step — you approve before anything ships. Hosted DNS changes what happens after approval: deployment is a click instead of a copy-paste.

What if I'd rather keep records at my own provider?

That works everywhere in Palisade. Every fix is generated as a ready-to-paste record; you copy it to your provider and monitoring confirms when it's live. Hosted DNS just removes the round trip.

How reliable is the hosting?

Hosted records are served on redundant managed DNS. And because Palisade also monitors the records it serves, a resolution problem surfaces as a ticket rather than going unnoticed.

Hosted DNS

Hosted DMARC, SPF, and DKIM records — deployed on approval

Hosted DMARC is Palisade serving your DMARC, DKIM, BIMI and MTA-STS records through CNAME delegation and your SPF through a hosted include, so an approved change deploys from Palisade instead of being hand-edited at your provider. Delegate the records once and from then on every email-authentication change you approve is served from Palisade, while your registrar and nameservers stay exactly where they are. The fix you just approved shouldn't die waiting in a DNS ticket queue.

Get started Book a demo

Summarize with

Palisade Crunchy DemoAI-assisted workflow Domains Hosted DNS Reports Toolbox TLS Reports IntegrationsBIMI Verified checkmark

Set up acme-corp.com

Point one CNAME at Palisade and your DMARC, DKIM, BIMI and MTA-STS records are served for you

Delegation works at:GoDaddyCloudflareRoute 53Namecheapany provider that supports CNAME

ConfigureConfiguring…✓ DMARC configured

RecordStatus

TXT@ · SPFLive

CNAME_dmarc · DMARCLive

CNAMEs1._domainkey · DKIMAwaiting approvalDeploying…Live

CNAMEdefault._bimi · BIMILive

CNAME_mta-sts · MTA-STSLive

✓Your registrar and nameservers stay exactly where they are — Palisade touches the email-authentication records only

Approve, and it ships

No copying records into a registrar, no waiting on whoever holds the DNS login. The change you approve in Palisade is the change that goes live.

Your provider stays

Palisade touches the email-authentication records and nothing else. Your registrar, your nameservers, and every other record stay exactly where they are today.

Records that stay watched

Palisade serves the records and keeps monitoring them — if something drifts or a key needs rotating, that's a ticket, not a surprise.

Trusted by leading brands worldwide

How it works

Delegate once, deploy forever

One setup step turns every future fix into a review-and-approve.

Connect the domain once

Delegate the email-authentication records to Palisade with one CNAME each — DMARC, DKIM, BIMI and MTA-STS — and publish a single hosted include for SPF. Your registrar and nameservers do not move.

The Agent drafts a change

A new sender needs DKIM, a policy step is ready, an SPF source changed — the fix arrives as a ticket with the exact record drafted.

You approve the diff

Every ticket shows precisely what will change, down to the record diff. Nothing deploys until you say so.

Palisade deploys and verifies

The approved change goes live on Palisade's DNS and the monitoring confirms receivers see it. On domains without delegation, you copy the generated record instead.

What's included

What hosted DMARC gives you

CNAME delegation, reversible

Delegate DMARC, DKIM, BIMI and MTA-STS with one standard CNAME each, and point SPF at a hosted include. Remove the CNAME and you are back where you started.

Hosted SPF include

SPF joins through one hosted include, flattened to stay under the 10-lookup limit as your senders grow.

Redundant managed DNS

Hosted records are served on redundant managed DNS, so the answers receivers get are fast and consistently available.

Diffs before deploys

Approval means seeing the exact before-and-after of the record — not trusting a summary of it.

History and snapshots

See the authentication records Palisade sees right now, plus periodic snapshots of what changed and when.

Optional, per domain

Hosted DNS is the fast path, not a requirement. Domains on external DNS get every record generated and ready to copy to your provider.

Teams that put the Agent to work.From one domain to thousands.

Built for MSPs

A no-brainer.Why Integris chose Palisade after evaluating the field.

“We evaluated many DMARC providers before choosing Palisade. The quality of their product, the responsiveness and friendliness of their team and their rapid progress on their product roadmap made it a no-brainer for us to move forward.”

Integris

See how MSPs run Palisade

Enforcement

Work with pros before changing anything.Why Devialet would not move to reject until every app checked out.

“We thought our implementation was good, but we weren't sure all of our different apps were configured properly. We never wanted to switch to quarantine or reject before we had DMARC software in place — our email program drives a significant chunk of our revenue. We wanted to work with pros before changing anything.”

Devialet

See the integration guides

Operations

Everything done faster.How SecurITShell simplified its DMARC operations.

“Palisade streamlined all of our DMARC operations. It was so complicated at first, it was taking so much time. It allowed us to get everything done faster and have a complete overview of our operations, at such an affordable cost. We're saving so much time. It's a great improvement for our operations.”

James Morin — IT Maestro, SecurITShell

See the DMARC Agent