Fix
DNS changes
with a safety net.
Most DMARC tools tell you what is wrong and leave you to fix it. We can publish the fix for you, and every change goes through the same four layers before it touches your DNS.
v=DMARC1; p=quarantine; rua=mailto:acme-7f3k@rua.trustyourinbox.com
Held for 5 minutes. Cancel with one click before anything goes live.
Applied and emailed. The exact record written, on the record, in your inbox.
Undo for 24 hours. One click rolls the change back, verified by a DNS read-back.
What one click actually does
Never a blind write. The record is computed, shown to you, and held before anything goes live.
Staged, then held
We compute the exact record and hold it for five minutes. An email lands with the record and a one-click cancel, so nothing applies while you are looking away.
Written, then read back
The change is written to Cloudflare or AWS Route 53 through a scoped connection, then read back from public DNS to confirm the value actually took.
What it will not do
It never writes to a provider we cannot read back from, never deletes a record, and refuses to stage the same fix twice while one is pending. Guided providers get the record and a deep link, not a write.
Undo for 24 hours
After a change applies you get a 24-hour undo. One click restores the previous value, and the restore is read back from DNS the same way the change was. Every stage, apply, cancel, and rollback is written to your history with who did it and from where, whether that was the app, Slack, the API, or an AI assistant.
The same staged change is offered wherever an issue appears: the domain's DMARC, SPF, and MTA-STS tabs, the issues list (fix several at once), a Slack alert's Fix this button, the MCP tool, and the REST API. One queue, one safety net, no second path that skips it.
Connect once, fix from anywhere
Connect your DNS
Cloudflare connects with an API token scoped to DNS edits; Route 53 with an IAM key scoped to your hosted zones. Both are shown before you paste them, and both can be revoked from your side at any time.
Click Fix this
On an issue we can fix, the button shows the exact record it will write. Fixes range from adding our reporting address to moving the policy to p=reject.
Watch it land
Five minutes later the record is live and confirmed by a read-back. The undo stays available for a day, and the issue clears on the next scan.
On any other DNS provider you get the computed record, a step-by-step guide, and a deep link into your provider's DNS editor. We never guess at a write we cannot verify.
Fix the first issue
in five minutes.
Add a domain, connect Cloudflare or Route 53, and the next fix is one click with a net under it.