Sign in
Reach your domains, your check history and your API tokens.
Not verified yet?
No account yet? Create one - the domain check itself stays free and needs no account.
You are seeing this account as its owner
This is a MailGuardHQ support session. It is READ-ONLY - nothing on these screens can be changed from here - and the customer has already been told it is open. Every request it makes is recorded against your name and against their account.
Seeing as Closes by itself at
Your panel
Signed in as
Dashboard
Whether mail can be forged as you right now, what has changed, and what to do next. Every figure below arrives from the API - nothing on this screen is a sample.
Can mail be forged as you right now?
Answered by running the checks live against public DNS. Both the verdict and how many checks ran come back from the run itself - this page states neither in advance.
Domains under monitoring
How many domains this organisation is watching, read from the domains route.
What changed recently
Built only from timestamps the API returned. Anything it cannot see is named rather than left out.
What to do next
Each item below is here because of something the API actually reported about this account.
Your account and plan
Straight from your account and organisation records.
Monitored domains
The domains whose DMARC reports we collect. Free covers 1; Pro allows up to 5.
What we cannot see
Hosting providers commonly act on the signals below. We cannot see them for your account, and nobody outside your provider can. A clean result elsewhere in this report is not a guarantee of delivery. Your provider acts on information it does not publish and does not share.
- How much mail your hosting account sendsProviders count every message your whole account sends, across all its domains.
- Spam complaints about mail from your accountProviders receive complaints about mail from any domain on your account.
- Which scripts or mailboxes send your mailOnly your provider's mail logs show whether a message came from a website script or a mailbox login.
- Your provider's own blocklistsProviders keep internal lists they do not publish. An address can be clean on every public list and still be on one.
- Spam trapsTrap addresses are never revealed by their owners, so no one outside can test for them.
- Microsoft's complaint reportsMicrosoft shares complaint data only with whoever is responsible for the sending server.
- Total mail sent from your server's addressOn shared hosting your server's address also sends mail for other customers.
- The name your mail server introduces itself withReceivers see the name a server gives when it connects. On shared hosting this is your provider's name, and that is normal.
- Your provider's security and firewall eventsProviders record security events against their customers' accounts and addresses.
- Automated mail sent from a person's mailboxWebsite forms, apps and billing systems sometimes send from a staff address, which ties that person's mailbox to automated mail.
- Test systems sending as your real domainA development or test system with real mail settings sends real mail as your domain.
- Your provider's reason for a blockOnly your provider knows why it blocked sending, and its first answer may describe what it sees now, not what started it.
Check history
Every check run on this account, newest first - including any you ran before you signed up.
Organisation
Your organisation, the plan it is on, and who holds a seat on it.
API tokens
Credentials that let a script or an MCP client act on this organisation.
Settings
The values that decide how MailGuardHQ behaves for this organisation. Each one says what it means, what a low value costs and what a high one costs, and - where the platform limits it - the bound you are tuning inside. Nothing here can be set past that bound.
Account activity
Everything that has happened to this organisation, newest first - members, roles, tokens, settings, and every time MailGuardHQ support opened the account. Nothing on this screen can be edited, by you or by us.
Your profile
The account you are signed in as.
A browser refresh signs you out. The session credential is held in memory only and is never written to any store a script could read - that is deliberate, and the fix is for the API to set it as an httpOnly cookie rather than for this page to persist it.
Staff console
Accounts
Every person on the platform. Search by address or by name. Nothing below is shown until the API answers - no count on this screen is a guess.
Account
One person: their sign-in state, whether their address was ever proved, and every seat they hold across every organisation.
Organisations
Every organisation on the platform, with what it is entitled to and what it is using.
Organisation
One organisation in full - plan, allowances in force, seats, domains, tokens - and the four changes support is allowed to make to it.
Audit trail
Every administrative read and write across every organisation, newest first, with who did it, what it was before, what it became, and the reference that ties it to the logs.
Platform settings
The values that decide how the platform behaves for everyone. Each one shows what it means in plain words, what a low value costs and what a high one costs, and the range it is allowed to move inside. Every change is audited with your name and the value before it.
A browser refresh signs you out and returns you to the sign-in page - the session credential is held in memory only and is never written to any store a script could read.