Managing domains and groups

22 June 2026 · 12 min read

Once you have added a domain or two, the Domains page becomes the place you live in day to day. It is where you keep an entire estate tidy: searching for one domain among hundreds, filtering down to the ones that still need attention, sorting domains into groups, importing a long list in one paste, rechecking records after you change something at your DNS provider, reading the per-service status badges at a glance, and removing a domain safely when a project ends. This guide covers all of that. If you have not yet added your very first domain or you want the full Add Domain wizard walkthrough, read Adding your first domain first; this page picks up where that one leaves off.

Orientating yourself on the Domains page

At the top of the page is the title Domains with the description "Manage your domains and their email authentication services", and two buttons on the right:

Bulk Import: opens a modal for adding many domains in one paste.
Add Domain: opens the four-step setup wizard for a single domain (covered in Adding your first domain).

The four stat cards

A row of four summary cards sits directly under the header and updates live as you work. They are the fastest health check on your whole account:

Total Domains: every domain on your account, whatever its state.
Verified: domains where you have proven ownership with the verification TXT record.
Pending: domains added but not yet verified. These still need their verification TXT record published before the platform will manage them.
Fully Protected: domains where every service (DMARC, SPF, DKIM, MTA-STS and BIMI) is reporting as Active. This is the number you are working towards across the estate.

When you manage a large portfolio, glance at these four cards first. If Pending is high, you have onboarding to finish; if Verified is high but Fully Protected is low, your domains are owned but their service records are not all delegated yet.

The two tabs

Below the stat cards are two tabs, each showing a count in brackets so you always know the size of your estate:

All Domains: the default view, where every domain is its own card.
Domain Groups: a grouped view that buckets domains by the group you assigned them.

Searching and filtering a large estate

The All Domains tab is built for scale. Two controls sit above the list.

The search box carries the placeholder "Search domains...". Type any part of a domain name and the list filters instantly as you type, with no need to press Enter. Because it matches on any substring, searching corp will surface corp.io, corp.example.com and mycorp.net together. This is the quickest way to jump to one domain in a list of hundreds.

The status filter

Next to the search box is a status filter that defaults to All Statuses. Open it to restrict the list to one state:

Verified: show only domains whose ownership is confirmed.
Pending: show only domains still waiting on their verification TXT record.

Filtering to Pending is the single most useful move when you are part-way through onboarding a large estate: it hides everything that is already done and leaves you with a clean worklist of domains that still need their verification record published. When you have cleared the list, switch the filter back to All Statuses.

Search and the status filter combine, so you can, for example, filter to Pending and then type eu- to see only the unverified domains in one region.

The empty state

If no domains match (or you have none at all), the page shows the No domains yet empty state with the prompt "Add your first domain to start protecting your email authentication" and an Add Domain button. Clearing the search box or resetting the filter brings your domains back into view.

Adding many domains at once with Bulk Import

When you are onboarding a portfolio, adding domains one at a time through the wizard is slow. Bulk Import lets you paste the whole list.

Click Bulk Import to open the modal titled Bulk Import Domains.

In the Domains (one per line) textarea, paste your domains, one per line, for example:

example.com
corp.io
brand.co
shop.example.net

The helper text reminds you that each domain goes on its own line and that invalid entries will be skipped, so you do not have to pre-clean the list by hand.

Optionally fill in the Group (optional) field to assign every imported domain to the same group in one go. As you type, a datalist suggests the group names you already use, which keeps your naming consistent rather than ending up with Marketing, marketing and Mktg as three separate groups.
Click Parse. DMARC Engine reads your list and renders a preview titled "Preview: N domains found", with one row per entry so you can see exactly what it understood before anything is created.
Review the preview, then click Import All (N), where N is the number of parsed domains. The button reads "Importing..." while the import runs.

Reading the preview badges

As each domain is processed, its preview row is badged with the outcome, line by line, so nothing happens silently:

Added: the domain was created successfully.
Duplicate: the domain already exists on your account, so it was skipped rather than added twice.
Invalid: the entry is not a valid domain. The badge includes a short reason, so you can spot a stray email address, a URL with https:// left on, or a typo.
Error: something else went wrong while creating it. The badge includes the message.

If every domain imports cleanly, the modal closes and the new domains appear in your list. If some lines fail, DMARC Engine keeps only the failed lines in the textarea so you can fix and re-import just those, without disturbing the ones that already succeeded. A toast also summarises how many imported and how many could not be added.

Bulk-imported domains all start in the Pending state. Each one still needs its verification TXT record published before it becomes Verified. The fastest way to work through them is to filter the list to Pending and verify each from its card, as described next.

Reading a domain card

Every domain on the All Domains tab is shown as a card that packs its status and actions into one place.

At the top of the card you will see the domain name, a status badge (Verified in green, or Pending in amber), the group badge if one is assigned, and the date the domain was added.

The service status badges (D, S, K, M, B)

Each card shows a row of five service tiles, one per service, abbreviated to a single letter:

D = DMARC
S = SPF
K = DKIM
M = MTA-STS
B = BIMI

Each tile is colour-coded by state so you can judge a domain in a single glance, without opening anything:

Green means the service is Active: its record is published, delegated and resolving correctly.
Amber means the service is Pending: it is mid-delegation or still propagating, so the record exists somewhere in the chain but is not fully live yet.
Grey means Not configured: the service has not been set up for this domain at all.

Alongside the tiles, the card shows a setup score as a percentage. The higher the score, the closer the domain is to Fully Protected; a domain at 100% has all five tiles green and is counted in the Fully Protected stat card at the top of the page. Use the score to triage: a domain at 40% with two amber tiles needs a recheck or a published record, whereas a domain sitting at 20% has services that have never been configured.

A handy reading habit: amber usually means "wait or recheck" (DNS is propagating), while grey means "set it up" (there is nothing to wait for because nothing has been published). That distinction tells you whether your next move is patience or action.

Verifying a Pending domain from its card

If a domain is still Pending, everything you need to finish ownership verification is on the card, so you never have to reopen the wizard.

The verification value is shown in a monospace block as dmarcengine-verify=<token>. It is click-to-copy: click the block and the full TXT value lands on your clipboard, confirmed by a "TXT record copied" message.
The Verify DNS button runs a live ownership check. If the TXT record is found, the domain flips to Verified with a success toast. If it is not found yet, you will see "TXT record not found yet. DNS may still be propagating."
The Set up DNS toggle expands the full verification panel inline, with the copyable Type, Name / Host, Value and TTL fields and a built-in Verify button. Once expanded, the toggle reads Hide setup so you can collapse it again.

Publish that TXT record (type TXT, name @, value the copied dmarcengine-verify=... string) at wherever your DNS is hosted, then click Verify DNS. DMARC Engine also re-checks unverified domains automatically in the background while the page is open, so a domain can flip to Verified on its own once the record propagates.

Rechecking your published records

Verifying ownership is only the first step. After that you want confidence that your DMARC, SPF, DKIM, MTA-STS and BIMI records are actually resolving. Two card controls cover this.

Recheck records

The Recheck records button re-resolves all of the domain's service records on demand and reports how many are delegated, for example "All 5 services delegated" or "3/5 delegated" with the not-yet-delegated services named. The button shows "Checking..." while it runs.

This is the button to press the moment you have published or changed records at your provider: rather than waiting for the background poll, you get an immediate answer. If a tile is amber and a recheck still reports it as not delegated, the record has not propagated yet or the value at your provider does not match; give DNS a few minutes and recheck again, or open the records panel to compare the exact value.

Finish DNS setup / View all DNS records

This button expands the records panel directly on the card and changes label to reflect where the domain is:

While setup is incomplete, it is highlighted and reads Finish DNS setup with a count such as 2/5, making it the obvious next action on that domain. Expanding it lists every record still to publish, each value with its own copy button.
Once everything is active, it becomes the quieter View all DNS records, kept for reference, exports and future changes.

DMARC Engine also auto-rechecks records in the background while the page is open and visible, so published records can turn green on their own without any clicking. Domains whose records panel is already expanded are left to that panel's own polling, so you will not see two checks fighting each other.

For a field-by-field explanation of every record this panel shows, see DNS record reference. If you want a second opinion from outside the dashboard, the free DMARC checker, SPF checker, DKIM checker, MTA-STS checker and BIMI checker resolve the same records from the public internet.

Organising domains into groups

Groups are how you keep a large account navigable. They are optional labels, and a domain belongs to at most one group at a time. There is nothing to "create" separately: a group exists as soon as one domain is assigned to it, and disappears when the last domain leaves it.

Three ways to set a group

In the Add Domain wizard, via the Group (optional) field on step 1, when you first add a domain.
In Bulk Import, via the Group (optional) field, to assign every imported domain at once.
On any existing domain card, via the Set group button. If the domain already belongs to a group, that button instead reads Move group.

Clicking Set group or Move group opens a modal (titled Set domain group or Move domain to group). Type a group name into the field. The datalist beneath it suggests your existing group names, so reusing a name is a click rather than a retype, which keeps your grouping clean. To remove a domain from its group entirely, clear the field and save with it blank.

Click Save to apply (the button briefly reads "Saving..."), or Cancel to abandon the change.

Because group names are free text, pick a small, deliberate set of names up front, for example by brand, by business unit, by region or by environment (production versus staging). The datalist only helps if everyone reuses the same names.

The Domain Groups tab

Switch to the Domain Groups tab to see your groups laid out together. Each group is a card showing the group name and a count of how many domains it contains, then the list of those domains, each with a verified or pending indicator and a Move button for quick reassignment without leaving the tab.

If you have not assigned any groups yet, this tab shows the No groups yet empty state. It explains that groups organise related domains and points you back to the All Domains tab to set a group, or to add your first domain. As soon as you assign one domain to a group, that group's card appears here.

Deleting a domain safely

Removing a domain is deliberately guarded, because it is destructive and cannot be undone.

On the domain's card, click the red Delete button.
A confirmation modal titled Delete domain opens with a warning. It spells out that deleting permanently removes the domain and all of its DMARC, SPF, DKIM, MTA-STS and BIMI records, its hosted DNS records, and its analytics, and that this cannot be undone.
To confirm, type the exact domain name into the field labelled "Type <domain> to confirm". The red Delete domain button stays disabled until what you type matches the domain name character for character, which is what stops you deleting the wrong domain from a long list.
Click Delete domain (it reads "Deleting..." while it runs), or click Cancel to back out with nothing changed.

After deletion you will see a "Domain deleted" confirmation and the card disappears from the list, along with that domain's contribution to the stat cards at the top.

When not to delete

Deleting is the right move only when you genuinely want a domain gone from the platform, records and analytics included. If your real goal is narrower, choose a gentler path instead:

To stop a single service rather than the whole domain, manage that one service from its setup page or from the records panel on the card. See Hosted DMARC, Hosted SPF, Hosted DKIM, Hosted MTA-STS and Hosted BIMI.
To pause reporting noise, adjust your alerts rather than removing the domain; see Setting up alerts.
To hand a domain to a colleague, reassign it with a group and adjust who has access; see Team and roles.

Remember that deletion throws away historical analytics for that domain. If you might need the aggregate data later, export or review it first; Aggregate report analysis explains what that data contains.

A suggested workflow for a large estate

Putting the pieces together, here is an efficient way to take a fresh portfolio from nothing to fully protected:

Open Bulk Import, paste your full domain list, set a sensible Group for the batch, click Parse, review the badges, then Import All (N). Correct any Invalid lines left in the textarea and re-import.
Set the status filter to Pending so you are looking only at domains that still need ownership proven.
Work down the list, publishing each dmarcengine-verify=... TXT record at your DNS provider and clicking Verify DNS on each card (or just let the background check catch up).
As domains turn Verified, use Finish DNS setup on each to publish the service records, then Recheck records to confirm they delegate. Watch the D / S / K / M / B tiles go from grey or amber to green.
Reset the filter to All Statuses and keep an eye on the Fully Protected stat card climbing towards your Total Domains figure.
Use the Domain Groups tab to sanity-check that every domain landed in the right group, moving any strays with the Move button.

Where to go next

With your estate organised, verified and rechecking cleanly, you are ready to push from monitoring towards enforcement and to keep an eye on changes over time:

Plan the move from p=none to p=reject safely in The enforcement journey.
Understand why monitoring alone is not enough in p=none is a false sense of security.
Tighten each domain's authentication with Hosted SPF, Hosted DKIM and Hosted DMARC, and lock transport down with Hosted MTA-STS.
Turn on notifications so you hear about record changes promptly in Setting up alerts.
Compare what mailbox providers now expect on the requirements page, and look up any unfamiliar term in the glossary.

If you ever want a quick external check while triaging, the free DMARC report analyzer and DMARC generator sit alongside the per-service checkers, and the product pages for DMARC, SPF, DKIM, MTA-STS and BIMI explain what each hosted service does under the bonnet.