Other DMARC tools monitor.
Autopilot enforces.
Autopilot connects to your DNS and drives your domain to p=reject — approving your legitimate senders, then progressing your policy through quarantine to full enforcement. Every DNS change written for you, gated on your own DMARC reports. Not a list of things to fix. The fix, in your zone.
Why we need DNS access
DMARC, SPF, and DKIM live in your DNS records. To fix them, something has to write to your DNS. There are only two ways to do that:
Tell you what to write. This is what every other DMARC platform does. They send you a report — sometimes a really nice one — and leave the actual DNS work to you, your IT provider, or “someone in the team who knows about that stuff.” Most of the time, that someone is busy. So the records don’t get added. So the policy stays at p=none. So spoofers keep using your domain.
Write it ourselves. This is what Autopilot does. Sender approvals, policy progression, DKIM rotation, MTA-STS — Autopilot writes all of it to DNS directly, across Cloudflare, Route53, cPanel/WHM, and GoDaddy. Building reliable DNS automation across every provider is the hard part. We did it so enforcement actually happens, instead of landing in your to-do list.
The “tell you what to write” model exists because building reliable DNS automation across providers is hard. We did it anyway. We’ve scanned 10,409 Australian business domains for our 2026 research report, and 74% of domains that publish DMARC never reach enforcement — they sit at p=none or p=quarantine indefinitely. The records don’t get added. The policy stays passive. Spoofers keep using the domain. We didn’t want to ship a product that depended on customers doing the hard part.
Three ways to enable Autopilot
Pick whichever fits. You can change it later. Autopilot works the same regardless of which path you choose.
| Path | Best for | Setup time | Ongoing |
|---|---|---|---|
| API connector | You already have a DNS provider with an API — Cloudflare, Route53, cPanel/WHM, GoDaddy | 5 minutes (OAuth or scoped API token) | None |
| Full delegation | You want set-and-forget. We become DNS for the domain. | 10 minutes (point nameservers at ours) | None |
| Advisor Mode | You’re not ready to grant access yet. | Immediate | You apply each change manually when notified |
- Best for:
- You already have a DNS provider with an API — Cloudflare, Route53, cPanel/WHM, GoDaddy
- Setup time:
- 5 minutes (OAuth or scoped API token)
- Ongoing:
- None
- Best for:
- You want set-and-forget. We become DNS for the domain.
- Setup time:
- 10 minutes (point nameservers at ours)
- Ongoing:
- None
- Best for:
- You’re not ready to grant access yet.
- Setup time:
- Immediate
- Ongoing:
- You apply each change manually when notified
API connector
OAuth into your DNS provider, or paste a scoped API token. Autopilot only touches the records it manages — TXT and CNAME records on the domains you authorise. Tokens are yours; you can revoke them at any time. We support Cloudflare, AWS Route53, cPanel/WHM, and GoDaddy directly today, with more providers added based on customer demand.
Full delegation
Point your domain’s nameservers at ours (ns1.dkim.dmarcbusta.pro / ns2.dkim.dmarcbusta.pro). We become your DNS provider for that domain. Same model as Cloudflare’s free DNS — you delegate, we run it. You keep ownership of the domain. Un-delegate any time and your records come with you.
Advisor Mode
Autopilot still does the analysis — sender classification, policy progression recommendations, DKIM health checks. But instead of applying changes itself, it generates a queue of DNS records for you to add manually. Use this if your security policy doesn’t allow third-party DNS access yet. Most customers start here and switch to API connector or delegation within a few months.
Your DNS, your keys, your audit log
Customer-owned credentials
When you connect via API, the tokens are scoped to TXT and CNAME records on the domains you authorise — not your whole zone. We can’t change your A records, MX records, or anything else. Revoke from your DNS provider any time.
Encryption at rest
Tokens are encrypted in our database with per-customer keys. Nobody at DMARC Busta can read them in plaintext, including support.
Full audit log
Every DNS change Autopilot makes is logged with timestamp, change type, before/after values, and the trigger that caused it. Exportable any time.
One-click rollback
Roll back any change from the audit log in one click. Every change is logged with before/after values, so stepping back to your last-known-good policy is immediate.
We eat our own dogfood
dmarcbusta.com, dmarcbusta.pro, hcse.au, and websiterescuers.com.au are all at p=reject with MTA-STS and TLS-RPT — managed by Autopilot itself. If you’re scanning before you sign up, you’re scanning a platform that practises what it sells.
Beyond “approve senders”: what runs in the background
Sender classification
Reads incoming DMARC reports, classifies sources by volume, pass rate, and known fingerprint, and approves legitimate senders (Microsoft 365, Google Workspace, Mailchimp, Klaviyo, and so on) without prompting.
Policy progression
Moves your policy through p=none → p=quarantine → p=reject. It advances only when your pass rates justify it — weak or regressing data means it holds position rather than stepping up. Enforcement earned, not forced.
DKIM rotation
Rotates DKIM keys on a schedule and updates DNS without breaking outbound mail.
MTA-STS publishing
Publishes and maintains MTA-STS policies and TLS-RPT reporting endpoints. Most DMARC platforms ignore MTA-STS entirely. We don’t.
Report analysis
Autopilot reads every incoming DMARC report — volume, pass rates, and which sources are authenticating as you. Progression advances only when that data justifies the next step, so enforcement tracks your real mail, not a timer.
One-click rollback
Every change Autopilot makes is logged with before/after values. If a policy change ever hurts your pass rate, roll back in one click from the audit log — or, on managed plans, we do it for you and let you know. Enforcement you can always step back from.
What other DMARC platforms do
Most DMARC platforms — including the well-funded ones — are monitoring tools. They aggregate DMARC reports, render them in charts, and produce a list of recommendations. The actual fixing is your job. This is the standard model, and there’s a reason for it: building reliable DNS automation across dozens of provider APIs is hard, supporting it is harder, and rolling back safely is harder still.
Autopilot is the part of DMARC Busta that does the hard thing. Everything else — scanning, reporting, alerting — most platforms have. The difference is whether anyone closes the loop.
Ready?
Self-serve, single domain or a few
Start free — connect a domain in 5 minutesManaging client domains as an MSP
See how Autopilot works for MSPs