From nothing to a managed estate.

A tenant is your MSP. Everything else — clients, domains, engineers — lives inside it.

1. Start a trial and follow the link in the email to set a password.
2. Name your tenant after your business. It appears on client-facing write-ups, so use the name a client would recognise.
3. You are now the tenant administrator. Nobody else has access until you invite them.

This is the only step needing something from outside DNSMentor. All 26 supported providers work the same way: one credential, scoped to DNS.

1. Go to Admin → Providers & API keys → Add connection.
2. Choose your provider. The help text under each field says exactly where in that provider to create the credential.
3. Name the connection after the account rather than the provider — most MSPs end up with several accounts at the same provider.
4. Press Test connection. DNSMentor makes a read-only call and shows you the provider’s own response.
5. Press Sync. Discovery finds every zone in that account and imports every record.

Run Estate health before you change anything. On a real MSP estate this is the step that produces the awkward conversation.

1. Open Estate → Health. Every domain is scored against mail authentication, delegation, TTL sanity, CAA and open incidents.
2. Sort worst first and read the top ten. Expect domains with no SPF, a DMARC record still on p=none, and at least one delegation pointing at a provider the client left.
3. Group domains into client portfolios. Per-client reporting, evidence export and access scoping all depend on this, and it is far easier now than in a year.
4. For providers you cannot get API access to, use Import to bring records in from a zone file, CSV, PDF or a screenshot of the old panel.

Pick something low-risk and real. Watch all 56 checks run, then apply it and watch it verify.

1. Press New change and choose a domain.
2. Add or edit a record — a TXT verification record is a good first one.
3. Press Check. Read what comes back, including the warnings you can accept.
4. Look at Simulate: the zone as it would be afterwards, including records you did not touch that are affected.
5. Apply it. DNSMentor re-reads live state first, writes through the provider API, then queries the record independently from outside to confirm it is live.
6. Open the change and copy the generated write-up into your PSA ticket.

The default is deliberately cautious. Loosen it to fit your team rather than switching it off.

1. Admin → Settings → Approvals. Set the organisation baseline.
2. Adjust per engineer. A senior who has demonstrated the skill applies unsupervised; somebody in their first week does not.
3. Vary by record type if you want ceremony only where the consequence is — an MX cutover is not a vendor verification TXT.
4. Nobody can approve their own change, and no setting removes the MX hand-check.

Invite the people who will use it, and assign the training that decides what they can do alone.

1. Admin → Users & roles → Invite. Choose a role for each person.
2. Add read-only Viewers freely — account managers and service desk staff are not billed.
3. Assign learning paths by role. There are 15 modules and 225 questions covering DNS from resolution through to MTA-STS.
4. Check Admin → Reports for training compliance, which is the evidence an ISO 27001 or Cyber Essentials assessor will ask for.

What to do next