White-Label Setup
White-labeling applies to the customer portal — the app your customers sign in to. Your own partner console at app.ddmarc.com stays DDMARC-branded; it is your admin tool, not a customer-facing surface.
Which URL gets your brand
Your partner console — stays DDMARC-branded
app.ddmarc.com/dashboard/msp
Where you manage customers, branding and billing. Only your own staff sign in here.
Customer portal — carries your brand
{your-slug}.portal.ddmarc.com
dmarc.yourcompany.com (optional vanity domain)
The subdomain works as soon as your partner subscription is active. A vanity domain is additive — it does not replace the subdomain.
Vanity Domain Setup
Partner → Domain
Two DNS records, then an explicit Verify click
Enter your hostname
Go to Partner → Domain and submit the hostname you want, e.g. dmarc.yourcompany.com. We generate a verification token for your partner organization.
Publish the TXT record
Add a TXT record at _ddmarc-verify.<your hostname> whose value is the token shown on the page.
Publish the CNAME record
Point your hostname at connect.ddmarc.com — this is our portal edge, which answers TLS for verified vanity hosts.
Click Verify
We check both records live. Verification is rate limited to 5 attempts per minute, so wait for DNS rather than retrying in a loop.
TLS is issued automatically
Once the hostname resolves to our edge, a certificate is provisioned on demand. Global DNS propagation can take up to 24–48 hours.
# Required DNS records
| Type | Name | Value |
|---|---|---|
| TXT | _ddmarc-verify.dmarc.yourcompany.com | <verification token> |
| CNAME | dmarc.yourcompany.com | connect.ddmarc.com |
Branding Configuration
Branding lives at Partner → Branding (/dashboard/msp/branding). These seven fields are the entire branding surface. Clear any field to fall back to the DDMARC default.
Logo URL
Public HTTPS URLShown in the portal header and in the customer login email. This is a URL field, not an upload — we never host the file.
Recommended: SVG or PNG, served from a host you control
Favicon URL
Public HTTPS URLBrowser tab icon for the customer portal. Also a URL field, not an upload.
Recommended: Square, legible at 32×32
Primary color
Hex, e.g. #f59e0bUsed for primary buttons and accents. Defaults to #f59e0b when unset.
Recommended: Your main brand color
Accent color
Hex, e.g. #3b82f6Used for secondary highlights. Defaults to #3b82f6 when unset.
Recommended: A secondary color with enough contrast against the primary
Company name
Text, max 100 charactersAppears in the portal and in the customer login email.
Recommended: How your company should be named to customers
Support email
Email addressRendered as your support contact in the portal.
Recommended: A monitored mailbox — customers will use it
Support URL
Public HTTPS URLRendered as your support link in the portal.
Recommended: Your help desk or documentation
Preview pane
The branding page shows a single preview pane next to the form: your logo, company name, the two color swatches and your support links, updating as you edit. There is no separate mobile or email preview — check the real portal in a browser after saving.
Branding in Customer Emails
Branding is applied to outbound mail programmatically. There are no editable templates — you set the fields above and we merge them in.
Customer login email — branded
The one-time code email a customer receives when signing in carries your logo, company name and colors. This is the email your customers see most often.
Alert and digest emails — DDMARC footer still present
Alert and digest emails are sent from the shared email layout, whose footer reads "This email was sent by DDMARC". If a customer of yours is subscribed to those notifications, they will see the DDMARC name in the footer. Plan around this — do not promise customers a footer that is not there yet.
Your Own Sending Domain
By default, customer email is sent using DDMARC's sender identity. Configure a sending domain at Partner → Sending Domain (/dashboard/msp/sending-domain) and, once it is opted in and verified, customer email is sent from your domain instead.
DNS records you publish
DKIM — three CNAME records
We register the domain with Amazon SES Easy DKIM and return three tokens. Publish one CNAME per token at <token>._domainkey.<your sending domain> pointing at <token>.dkim.amazonses.com. SES manages and rotates the signing keys, so these records never change.
MAIL FROM — one MX and one TXT record (optional)
A custom bounce domain improves deliverability. If you configure one, publish the MX record that routes bounces to the SES feedback endpoint and the SPF TXT record that authorizes SES to send for it. Both are shown on the page with the exact values for your region.
Then verify
Click Verify once the records resolve. Until the sending domain is both opted in and verified, customer email continues to use DDMARC's sender identity — the fallback is silent, so check the status on this page rather than assuming.
Branded Artifacts
Two documents you can hand to prospects and customers carry your branding today.
Prospect scan PDF
White-label report from Partner → Prospect scanner, grading a prospect's email security posture.
Usage invoice (HTML)
Downloadable usage document from Partner → Billing, showing your domain count and per-customer breakdown.
The customer portal itself has no export feature, so there are no customer-downloaded PDFs or CSVs to brand.
What Your Customers See — and Don't
An honest accounting of where DDMARC is hidden and where it currently is not.
Hidden in the customer portal
- DDMARC logo and branding
- DDMARC in the page title and favicon
- Any pricing or billing information
- Support links — yours are shown instead
Still visible today
- The DDMARC footer in alert and digest emails
- The portal.ddmarc.com hostname, until you verify a vanity domain
- The sender address on customer email, until you verify a sending domain
With a verified vanity domain and a verified sending domain, the portal and the login email your customers interact with are entirely yours. The remaining gap is the shared email footer on alert and digest notifications.
Not available yet — Custom CSS, custom login page, and support-widget embedding
Portal appearance is controlled by the seven branding fields above. There is no custom CSS field on any plan, no editor for the login page, and no way to embed a third-party support widget such as Intercom or Zendesk. Your support email and support URL are the supported way to route customers to your own help desk.