Enforcement
Sender identity
Setting up the address seller notices come from: the sending domain, the DNS records to create, checking verification, the reply-to, and why MapProtector requires a verified brand sender.
Last revised
Every seller notice leaves from an address your organization owns — never from a MapProtector address. Before the first notice can go, a Brand Admin sets that address up under Settings › Enforcement › Sender identity and takes its domain through verification with the mail provider. Until the sender reads Verified, no notice can be sent; a notice prepared in the meantime shows Sender not verified as its blocker.
Why a verified brand sender
- Attribution. A notice about your MAP policy is a communication from your organization. The seller should see your brand in the From line, not a platform.
- Replies. A seller who answers writes to your reply-to, where your compliance team sees it.
- Deliverability. Receiving mail servers check that the sending domain has authorized the message. A verified domain is signed on your behalf; an unverified one is the kind of mail that lands in spam or is refused.
MapProtector delivers each notice through its own transactional mail infrastructure. The seller sees your organization’s verified From identity. MapProtector does not require your organization to provide SMTP credentials, a mail server, or an account with any mail provider — verification is done with DNS records on a domain you control.
The stages
| Stage | What it means | What to do |
|---|---|---|
| Not configured | No address has been saved. | Enter the display name, From address and reply-to. |
| Domain setup required | The address is saved. Its domain has not been registered for verification. | Choose Start verification. This needs a recent second factor. |
| DNS verification pending | The mail provider has issued the DNS records and is waiting for them. | Add the records at your domain host (one DMARC record only), then Check verification. Allow up to 48 hours. |
| Domain authenticated | The records resolve and the domain is authenticated. The address is being registered. | Check verification again. |
| Sender verification pending | The address is registered but not yet active with the mail provider. | Check again shortly. If a confirmation code was sent to the address, enter it. |
| Verified | Enforcement notices may use this sender. | Nothing. The product re-checks it periodically. |
Configure the address
- Under Settings › Enforcement › Sender identity, enter the display name (what a seller sees before the address — usually your brand), the From address, and optionally a reply-to. Both addresses must be on a domain your organization controls; MapProtector’s own domain is refused.
- Choose Save and continue. A recent second factor is required. The address is saved as pending: nothing is verified yet, and the screen shows the sending domain it implies — the part of the From address after the @.
Verify the sending domain
- Choose Start verification. MapProtector registers the domain with the mail provider and shows the DNS records to create — typically a domain-ownership record, one or more signing-key (DKIM) records and a mail-policy (DMARC) record, each with a host, a type and a value.
- Sign in to the service that hosts DNS for the domain — usually the registrar, or a DNS provider such as Cloudflare or Route 53 — and add the ownership and signing-key (DKIM) records exactly as shown. The host is shown the way your DNS console expects it — relative to the domain you manage:
@means the domain itself, and a name such as_dmarcmeans that name under it. If the From address is on a subdomain, the hosts already include the subdomain part. Use the copy buttons; a stray space or a truncated value is a record that never resolves. - Handle the mail-policy (DMARC) record with care — see the next section. A domain must have only one
_dmarcrecord, and if your organization already publishes one, its policy must be kept. - Wait for DNS to propagate and for the mail provider to recognize the records. Most hosts publish within minutes, but allow up to 48 hours before concluding a record is wrong.
- Choose Check verification. Each record shows Found or Not found yet. Once every record is found and the mail provider has authenticated the domain, the stage moves on and the address is registered automatically.
The DMARC record
The ownership and DKIM records are additive: they are new names under your domain and conflict with nothing. The DMARC record is different. It lives at _dmarc, a domain must have exactly one, and your organization may already publish one with a policy — p=quarantine or p=reject — that governs every mail stream on the domain. MapProtector does not read your DNS and cannot tell whether one exists; check at your domain host before adding anything.
- If the domain has no
_dmarcrecord yet, add the record exactly as shown on the screen. - If the domain already has a
_dmarcrecord, do not create a second one — two DMARC records make both unreliable. Do not replace the existing record blindly either: keep your organization’s existing policy, and do not downgradep=quarantineorp=rejecttop=none. Instead, add the reporting address from the value shown (therua=mailbox) to your existing record, following the mail provider’s current guidance for merging it. - If the existing policy is quarantine or reject, or DMARC is managed centrally (by an email security team or a DMARC service), ask your DNS or email administrator before changing anything.
The exact value the mail provider issued stays on the screen for copying or reference in either case, so whoever edits the record has it to hand.
Complete the sender
On an authenticated domain the address is usually active as soon as it is registered, and the stage reads Verified after the next check. Some addresses receive a confirmation code from the mail provider instead: enter it in the Confirmation code field that appears, then check verification again.
Sender versus reply-to
The From address is who the notice is from, and the address the mail provider verifies. The reply-to is where a seller’s answer goes; it may be a different mailbox — a shared compliance inbox, for instance — and it is not verified, but it must be a monitored mailbox on a domain that accepts mail. Receiving a reply needs MX records and a mailbox on the reply-to domain, which MapProtector cannot check for you. Leave the reply-to blank to receive replies at the From address.
Changing the sender
- Changing the display name or reply-to keeps a verified sender verified: neither is what the mail provider verified.
- Changing the From address restarts verification for the new address. On the same domain the DNS records stay in place and the new address is registered on the next check; on a different domain, verification starts again from DNS.
- A domain can be the sending domain of one workspace at a time. If your organization runs several workspaces, give each its own address on its own subdomain.
When verification is withdrawn
The product re-checks a verified sender with the mail provider every few hours and before each send. If a DNS record has been removed, or the address has been deactivated with the provider, the sender returns to pending, the reason is shown on the screen, and no further notice is sent as it until it is verified again. A notice that was about to go is returned for review rather than sent from an address that no longer authorizes it.
Who may do what
Configuring the sender, starting verification and entering a confirmation code need the Brand Admin role and a recent second factor. Checking verification needs the Brand Admin role. Compliance Managers and Analysts can see the sender, its stage and the DNS records.