Security and Two-Factor Authentication

21 June 2026 · 13 min read

What this page covers

Your DMARC Engine account controls live DNS for your domains: the records that decide whether the world's mailbox providers trust your mail. That makes account security a real part of email security. If someone takes over your login, they can change your published policy, redirect your reports or weaken your protection. This guide walks you through the Security tab in your account settings, where you harden the account itself.

You will learn how to switch on two-factor authentication, see and end active sessions on other devices, change your password, and read your login activity log. Everything here is done in the dashboard at https://app.dmarcengine.com, so sign in and follow along.

This is account-level work, separate from configuring a domain. If you have not added a domain yet, start with getting started and adding your first domain first, then come back and lock the account down.

Finding the Security tab

In the dashboard, open Settings. You can reach it from the path /settings or from the account menu in the top navigation. Settings is organised into seven tabs across the top:

Profile: your display name and the email address the account signs in with.
Organization: your organisation's name, contact email and timezone.
Security: two-factor authentication, sessions, password and login activity. This is the tab this guide is about.
Notifications: the channels that alerts are delivered to.
API Keys: programmatic access tokens.
Team: the people who share access to the account.
Billing: your plan, renewal and invoices.

Click Security. The tab is laid out top to bottom in four blocks: Two-Factor Authentication, session management, password change and the login activity log. We will take each in turn.

A quick word on the difference between Profile and Security. The Profile tab is where you set your Profile Name and read your sign-in Email (which is shown read-only there, because changing the address an account logs in with is a sensitive operation, not a casual edit). Your password and two-factor settings, by contrast, live here under Security. If you came looking for "change my email", that is a profile and support matter, not a security toggle.

Two-Factor Authentication

Two-factor authentication, usually shortened to 2FA, adds a second proof of identity on top of your password. With it switched on, signing in needs two things: something you know (your password) and something you have (a short code from an app on your phone). Even if your password is guessed, phished or reused from a breached site elsewhere, an attacker cannot get in without your second factor. For an account that can rewrite your DNS, this is the single most valuable thing on the page. Turn it on.

DMARC Engine uses TOTP, the time-based one-time password standard. That means it works with any standard authenticator app: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and the rest all speak the same protocol. You are not tied to any one vendor.

Switching 2FA on

In the Two-Factor Authentication block, find the enable control and start the setup. The dashboard will:

Generate a secret for your account and show it to you as a QR code, with the secret also written out as text in case you cannot scan.
Ask you to open your authenticator app and add a new account by scanning that QR code (or by typing the text secret in by hand).
Ask you to type the six-digit code your app is now showing, to confirm the pairing worked.

Once you enter a correct code, 2FA is active on your account. From the next sign-in onward, after your email and password you will be prompted for a current code from your app.

A few practical notes while you are doing this:

Scan, do not screenshot and walk away. The code in your app rotates every thirty seconds. Enter the one showing right now. If it ticks over while you are typing, just enter the next one.
Keep the secret if you are careful, destroy it if you are not. The text secret is the raw key. Anyone who has it can generate your codes. Treat it like a password: store it only in a real password manager, or do not store it at all once the app is paired.
Pair more than one device or app if you can. Adding the same secret to a backup authenticator (for example, your phone app and your password manager) means losing one device does not lock you out.

If you are locked out

If you lose your authenticator and have no backup, you cannot generate a code, and the account will not let you in. There is no self-service bypass, by design: a bypass an attacker could trigger would defeat the point of 2FA. Recovery is a manual, identity-verified process through support. Contact us from the email address on the account and we will help you regain access after confirming who you are. The lesson, as above, is to pair a second device before you ever need it.

Turning 2FA off

You can disable 2FA from the same block if you genuinely need to (for example, you are moving to a new phone and want to re-enrol cleanly). The dashboard will ask you to confirm. Re-enable it straight away afterwards. An account with 2FA off is meaningfully weaker, and if your account holds the admin role over the team, that weakness extends to everyone's access.

Managing your sessions

Below 2FA is the session management block. A "session" is one signed-in instance of your account: your work laptop, your home machine, your phone, a browser you used once on a borrowed computer. Each appears here as its own row.

For each active session you will typically see identifying detail such as the device or browser, an approximate location and when it was last active. The session you are using right now is marked as the current one so you do not end it by accident.

Why this matters

Sessions are how you answer two questions that passwords alone cannot:

"Is anything signed in that should not be?" If you see a device, browser or location you do not recognise, that is a live warning that someone else may have access. End it immediately, then change your password (next section) and check the login activity log (the section after that).
"Did I leave myself signed in somewhere I no longer control?" A library computer, an old phone you have since sold, a shared machine at a previous job. Ending those sessions here cuts them off without you needing physical access to the device.

Ending a session

To sign a device out remotely, find its row and end that session. The dashboard revokes it, and the next time that device tries to use the account it will be bounced back to the login screen and will need your password (and your 2FA code) to return. Where the dashboard offers a control to end all other sessions at once, that is the fastest way to recover after a scare: it leaves only your current session active and forces a fresh login everywhere else.

A good habit: any time you change your password because you suspect a problem, end every other session as well. A new password does not, on its own, throw out sessions that were already signed in.

Changing your password

The third block lets you change your account password. Open it and you will be asked for your current password, then your new password entered twice to guard against typos. You must know the current password to set a new one from here; this is the routine "I want to rotate my password" path, not the "I have forgotten it" path. If you have forgotten your password entirely, sign out and use the password-reset link on the login page instead, which verifies you by email.

What makes a good password here

Long beats clever. A passphrase of several unrelated words is both stronger and easier to type than a short string of symbols. Aim for genuine length.
Unique to this account. Never reuse a password you use anywhere else. Reuse is how a breach on some unrelated website becomes a breach of your DNS. A password manager makes "unique everywhere" simple.
Paired with 2FA. A strong password and 2FA together is the combination you want. Neither is a substitute for the other.

When you save a new password, treat your sessions as covered above: if you are changing it because you are worried, end the other sessions too, because a password change alone does not evict an attacker who is already signed in.

The last block on the Security tab is your login activity log: a record of recent sign-in attempts on your account. For each entry you can generally see when it happened, where it appeared to come from and whether it succeeded or failed.

This is your rear-view mirror. Read it now and then even when nothing is wrong, so that you know what your own normal pattern looks like; that way the abnormal stands out.

What to look for:

Successful logins you do not recognise. A success from an unfamiliar location or at a time you were not working is the most serious signal on the page. Treat it as a probable compromise: change your password, end all other sessions, and confirm 2FA is on. If 2FA was off, this is exactly the event it would have prevented.
Bursts of failed attempts. A cluster of failures can mean someone is guessing your password. If they are all failures, your password is holding, but it is a strong hint to rotate it and to make sure 2FA is enabled so that even a correct guess is not enough.
Logins from new devices you do expect. Travel, a new phone, a colleague you authorised. Recognising these is the point of building familiarity with the log.

If the log shows something you cannot explain, do not wait. Secure the account first (password, sessions, 2FA) and then contact support so we can help you review what happened.

A recommended order for hardening your account

If you are setting this up for the first time, do it in this sequence:

Set a strong, unique password in the password block, if yours is weak or reused.
Switch on Two-Factor Authentication and pair at least one authenticator app, ideally two devices.
Review your sessions and end anything you do not recognise or no longer use.
Read the login activity log once so you know your baseline.

Ten minutes here protects every domain on the account.

How account roles change the stakes

Security on your own login is only half the picture. DMARC Engine accounts can be shared with colleagues through the Team tab, and each member holds a role: admin, editor or viewer. A viewer can look but not change; an editor can configure; an admin can do everything including managing people and viewing billing. The more powerful the role, the more important that member's personal security is. A viewer with a weak password is a small risk; an admin with a weak password is a risk to the whole account.

So 2FA is not just your concern. Encourage, or require, every admin and editor on the account to switch it on in their own Security tab. For who can do what and how to invite people, see team members and roles.

Programmatic access and the API

Two-factor authentication protects sign-in to the dashboard. It does not apply to machine-to-machine access, which is the whole point of an API key: a script has no phone to read a code from. That trade-off is deliberate, but it means your API keys need their own discipline.

API keys are issued and managed on the separate API Keys tab, not here under Security, but they belong in any security review. A few principles carry over directly:

A raw API key is shown only once, at the moment you create it. Copy it into a secret store there and then; if you lose it you must regenerate, which invalidates the old one.
Give each key the narrowest permissions it needs (the Create API Key dialog lets you pick read or read-and-write scopes), and give different integrations different keys so you can revoke one without breaking the others.
Rotate keys periodically and regenerate or delete any key that may have leaked, for example one that was committed to a code repository.

For the full detail on creating, scoping, regenerating and deleting keys, see the API reference.

How alerts complement account security

The login activity log tells you about access to the account. A separate system tells you about changes to your domains. DMARC Engine re-checks your published records and your incoming report feed, and raises an alert when something important shifts: a policy weakened, a record broken, a new source failing authentication. Those alerts are routed through the channels you configure on the Notifications tab.

The two systems answer different questions. The login log answers "who got into my account?"; change alerts answer "did my protection just get worse?". You want both switched on. If an attacker did get in and quietly weakened your DMARC policy, a change alert is your second line of defence, the thing that tells you the records moved even if you missed the login. Set those up in monitoring and change alerts and setting up alerts.

Where the rest of your settings live

To round out the picture, here is what each of the other tabs in Settings does, so you know where to go next:

Profile: edit your Profile Name and read your sign-in Email (read-only); save with Save Profile.
Organization: set your Organization Name, Organization Email and Timezone, then Save Organization. The timezone here is what your reports and charts are shown against.
Notifications: list, test and remove your alert channels, or add one with Create Notification Channel.
API Keys: see your keys with their permissions, creation and last-used dates, and create new ones with Create API Key. Covered in the API reference.
Team: see members with their role and status, change a role, remove someone, or add a person with Invite Team Member. Covered in team members and roles.
Billing: review your current plan, renewal date and usage, and view or download past invoices. Billing is read-only in-product; to change your plan, payment method or subscription, arrange it with the team. Covered in billing and plans.

In summary

The Security tab is small but it carries a lot of weight. Switch on Two-Factor Authentication and pair a backup device; use session management to see and end logins on other devices; rotate your password when in doubt and never reuse it; and read your login activity log often enough to know your own normal. Extend the same care to your team's logins and to your API keys, and pair all of it with change alerts on your domains.

Do this once, properly, and the account that controls your email authentication is as hard to take over as the records it protects. If anything in the log or your sessions looks wrong and you cannot explain it, secure the account first and then reach out: the troubleshooting guide and our support team are there to help.

Security and two-factor authentication