What is changing
AutoSPF and DMARC Report now use the shared DuoCircle sign-in page. When you sign in you are taken to auth.duocircle.com, and after signing in you land on your product dashboard as usual.
The same sign-in works across DuoCircle products, so you only need one set of credentials.
Only the way you sign in has changed. Your domains, reports, teams and settings are not affected.
Most of this article applies to both products. Where the two differ, the section is split into "AutoSPF" and "DMARC Report".
Signing in
1. Go to your product as usual (AutoSPF, or app.dmarcreport.com for DMARC Report).
2. Enter your email address and choose "Continue with email".
3. On the next screen, enter the same password you use today and choose "Sign in". Nothing needs to be reset or set up in advance.
Other ways to sign in:
- "Continue with Google" or "Continue with Microsoft" on the first screen, as long as it is the same email address as your account.
- "Sign in with a passkey" on the password screen.
- "Email sign-in code" on the password screen, to have a one-time code emailed to you instead of using a password.
Using a password manager? It may not fill in automatically, because the sign-in page has a new address. Search your saved logins for the site you signed in to before (autospf.com or dmarcreport.com) and reuse those details.
If you use both AutoSPF and DMARC Report
If you have an AutoSPF account and a DMARC Report account with the same email address, you now have one DuoCircle login for both products.
- Sign in to both products with your AutoSPF password. Your previous DMARC Report password is no longer used.
- If you reset your password, the new password applies to both products.
- If you already set up two-factor authentication in AutoSPF, the same code now protects DMARC Report too. Nothing more is needed.
If you use two-factor authentication
AutoSPF
Your existing authenticator app carries over. You are asked for a code exactly as before, and the same app and the same codes keep working. There is nothing to re-scan or re-enroll.
If you used Authy: Authy is no longer supported as a two-factor method, so two-factor authentication has been removed from the accounts that were using it. Sign in with your email address and password as normal; you will not be asked for a code. We recommend setting up an authenticator app again from the account portal so your account stays protected. You can still use the Authy app itself, it simply needs to be added the new way (see "Setting up two-factor authentication" below).
DMARC Report
Your DMARC Report authenticator entry does not carry over. It was stored with a separate service that the new sign-in cannot read, so you set two-factor authentication up once more. It takes about two minutes (see below).
Until you set it up, you sign in with your email and password and are not asked for a code. DMARC Report shows a reminder at the top of the page.
[SCREENSHOT: the two-factor reminder banner at the top of DMARC Report]
Setting up two-factor authentication (both products)
1. Sign in at account.duocircle.com.
2. Open the two-factor settings.
3. Scan the new QR code with your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy and so on).
4. Enter the code from the app to confirm.
From then on you are asked for a code each time you sign in.
See Enabling two-factor authentication.
If your organisation uses single sign-on
Enter your work email address and you are sent straight to your company's identity provider.
AutoSPF
There is nothing new to configure, and your administrator does not need to change your existing connection.
DMARC Report
If single sign-on stopped working for your team, the team owner can reconnect it:
1. In DMARC Report, open Teams and choose "Edit" next to the team.
2. Choose "Go to setup page".
3. Follow the steps to connect your identity provider (Okta, Microsoft Entra ID, Google Workspace and others).
New colleagues need to be invited to the team before they can sign in with single sign-on.
If you forget your password
Choose "Reset password" on the password screen, enter your email and choose "Send reset instructions". The email comes from DuoCircle rather than AutoSPF or DMARC Report.
The link is valid for 15 minutes, so open it straight away. If it has expired, request a new one.
If you have never set a password (for example your account was set up for you when you subscribed, you were invited to a team, or you always used Google), choose "Email sign-in code" on the password screen instead. We email you a one-time code to sign in with, and you can set a password afterwards in the account portal.
Your account settings have moved
Your profile, password, two-factor settings and active sessions are now in the DuoCircle account portal at account.duocircle.com.
From the portal you can jump straight back into your product or open its support portal, without signing in again.
AutoSPF
Open the portal from AutoSPF under Your Settings, in the Account section.
Domain and SPF management stays exactly where it is, inside AutoSPF.
DMARC Report
Your domains, DMARC reports, alerts, teams, white-label settings and API tokens stay where they are, inside DMARC Report.
[SCREENSHOT: DMARC Report, location of the portal link]
Creating a new account
AutoSPF
Signup by choosing a plan at https://autospf.com/pricing/
DMARC Report
Sign up at app.dmarcreport.com/signup and choose your plan. We email you a "Create my password" link; open it, choose your password, and you are signed in to DMARC Report.
If you choose "Sign up" on the DuoCircle sign-in page instead, you are asked to choose a DMARC Report plan before your account is created.
If you were invited to a team
Open the invitation email and accept it. Then sign in, or create your login, with the same email address the invitation was sent to.
Signing out
Signing out of your product also signs you out of the DuoCircle sign-in page, so you are asked to sign in again next time.
API and integrations
Nothing changes for the API.
If you have trouble signing in
- Check that you are using the email address of your AutoSPF or DMARC Report account.
- If you use both products, use your AutoSPF password.
- If your password is not accepted, use "Reset password" or "Email sign-in code" rather than trying repeatedly.
- If you are not sure you ever set a password, choose "Email sign-in code" on the password screen.
- If your authenticator codes are rejected, contact support and we will help you re-enroll.