On the Agency plans, Perimetry Cloud can make the DNS changes of a fix for you, in your own account at Cloudflare, OVHcloud or Gandi. You see the change before and after, you confirm, and every change can be undone. Your zones stay in your account: we only change the records you confirm.

Connect your DNS provider

Owners and admins connect providers in Settings, card DNS fixes in one click. Connect the provider that holds each of your zones; you can connect several.

Cloudflare: create a token in Cloudflare (My Profile → API Tokens → Create Token → the “Edit zone DNS” template), with “Zone: Read” and “DNS: Edit”, limited to the zones of your domains. Paste it and press Connect Cloudflare.
OVHcloud: create a token on the OVHcloud API (eu.api.ovh.com/createToken, or ca.api.ovh.com for Canada) with only these rights: GET /domain/zone, GET /domain/zone/*/record*, POST /domain/zone/*/record, PUT and DELETE /domain/zone/*/record/*, and POST /domain/zone/*/refresh (nothing that could reset or delete a whole zone). Choose the API region, paste the application key, the application secret and the consumer key, and press Connect OVHcloud. Give the token a long validity: an expired token stops the fixes.
Gandi: create a personal access token at Gandi (Organizations → Personal Access Tokens) with the permission “Manage domain name technical configurations”, limited to your domains, and press Connect Gandi. The domains’ DNS must be on Gandi LiveDNS.

The credentials are checked with the provider before they are saved, then stored encrypted. The card then shows the zones the connection can reach, and the last error if a call failed.

Apply a fix

Open a proved domain whose zone (or parent zone) is in a connected account, and find a finding about SPF, DMARC, CAA, a null MX or TLS reporting in its latest report.
Press Apply in your DNS. Perimetry Cloud reads the zone and shows the changes: each record to add, change or delete, with its value before and after, the zone and the provider.
Read the notes of the Ready to copy box first. For SPF especially, add any other service that sends mail as your domain before applying.
Press Apply these changes, or Cancel.
“Check if it is fixed” starts on its own right after, and the result shows under the finding.

Nothing is written if the records concerned changed since the audit: run a new audit first. At Cloudflare, a fix is made in one atomic step, all of it or none of it. At OVHcloud and Gandi, records are changed one by one: if a change stops half-way, the log says what was done, and that part can be undone.

MTA-STS cannot be applied this way, since it needs a file on a web server. A fix never writes an SPF v=spf1 -all (it would refuse all of the domain’s mail), and never moves a DMARC policy to p=reject either: that is done step by step, when the reports show it is safe (see DMARC step by step).

The log and undo

Every change appears on the domain’s page in DNS changes: when it was made, by whom, for which finding, and what was added, changed or deleted. Undo puts back what was there before, if nobody changed the record since. A change that was undone says so.

Only owners and admins can apply and undo DNS changes. The log stays, with its undo buttons, even if the plan changes later.

Disconnect

Press Disconnect under the provider in Settings. The credentials are deleted on our side; revoke them at the provider as well. A connection can still be removed after a change to a plan without DNS fixes.