A dated record of what was checked.
Keep the scope, observed records, approved changes, verification results, and open items in one file you can hand to your IT provider.
What gets recorded
Scope
The reviewed domain, agreed sending services, flat fee ($750), explicit exclusions, and zero-password protocol.
Baseline
Dated snapshot of published SPF, DMARC, and MX records prior to any modification.
Change Approval
Written customer authorization, approver identity, diff of proposed DNS records, and rollback reference.
Remediation
Execution timestamp, executor identity, and verification of newly propagated DNS strings.
Verification
Message authentication and DMARC alignment through aligned SPF or aligned DKIM, with unresolved checks recorded.
Handoff
Delivery status, open items, access revocation status, and designated internal owner.
Synthetic sample Shield Record
Domain: example.com · Synthetic example · No live verification
example.com
# Shield Record SAMPLE · FICTIONAL BUSINESS · EXAMPLE.COM Example Property Group example.com Sample date: September 9, 2026 · Prepared, not delivered ## Baseline - Agreed senders — Workspace; Client CRM. - Observation — Fictional monitoring-policy example. - Approval — Sample baseline acceptance. - Limit — No live domain or message was tested. ## Changes - Change state — Sample approved change. - Affected senders — Workspace; Client CRM. - Authority — Sample customer administrator. - Execution — Rehearsal only; no DNS changed. - Rollback — Sample rollback reference retained. ## Sender checks - Workspace — Sample fixture passed. - Client CRM — Sample fixture passed. - Reviewed by — Sample independent reviewer. - Limit — These are rehearsal fixtures, not evidence of a real security outcome. ## Open items - Unresolved — Live sender evidence still required. - Next owner — Customer administrator and Shield reviewer. - Next action — Confirm scope and collect authorized samples. - Delivery state — Prepared example; not delivered to a client.
Own the record of what was checked.
Shield Setup is $750 flat for one domain and up to three sending services. Zero recurring lock-in.