# DMARCguard > Email authentication platform monitoring DMARC, SPF, DKIM, BIMI, MTA-STS, TLS-RPT, ARC, DANE, ARF from one dashboard. SaaS at dmarcguard.io. Rated 4.9/5 on G2 (10 reviews). Complete site content in a single file: [llms-full.txt](https://dmarcguard.io/llms-full.txt) ## Docs - [API documentation](https://dmarcguard.io/docs/): Getting started, authentication, rate limits and the generated endpoint reference - [Getting started with the API](https://dmarcguard.io/docs/getting-started.md): Create an API key, make your first request and learn the conventions every endpoint follows. - [Authentication](https://dmarcguard.io/docs/authentication.md): How API keys are issued, scoped, bound to an organization and revoked, and what each 401 and 403 means. - [Rate limits](https://dmarcguard.io/docs/rate-limits.md): The hourly quota, the abuse controls in front of it, the headers that report them and how to pace a client. - [Single sign-on](https://dmarcguard.io/docs/sso.md): Connect your identity provider with OpenID Connect, verify your email domain, and decide whether password login stays available. - [Changelog](https://dmarcguard.io/docs/changelog.md): Dated changes to the API contract and the documentation. - [DMARCguard API v1](https://dmarcguard.io/docs/api/v1.md): Base URL, authentication, conventions, errors and the endpoint list - [Reports · API v1](https://dmarcguard.io/docs/api/v1/reports.md): Aggregate (RUA) reports as received, parsed and classified. - [Analytics · API v1](https://dmarcguard.io/docs/api/v1/analytics.md): Organization-wide and per-domain rollups computed by DMARCguard. - [Domains · API v1](https://dmarcguard.io/docs/api/v1/domains.md): The domains you monitor and their health. - [Sources · API v1](https://dmarcguard.io/docs/api/v1/sources.md): Who sends mail as your domains, and whether they should. - [Events · API v1](https://dmarcguard.io/docs/api/v1/events.md): Conditions that needed attention and whether they were acknowledged. - [API keys · API v1](https://dmarcguard.io/docs/api/v1/api-keys.md): How much of the hourly budget the organization's keys have used. - [Vocabulary · API v1](https://dmarcguard.io/docs/api/v1/vocabulary.md): The enumerations other responses use, keyed by category: verification states, severities, grades, policies and reputation. - [OpenAPI document (v1)](https://dmarcguard.io/docs/api/v1/openapi.json): Machine-readable OpenAPI 3.1 spec for the current API version - [API catalog](https://dmarcguard.io/.well-known/api-catalog): RFC 9727 linkset pointing at every API's OpenAPI document, documentation and status page - [Pricing](https://dmarcguard.io/pricing.md): Plans, features, and founding member discounts - [Tools](https://dmarcguard.io/tools.md): 47 free email authentication and DNS tools (no signup) - [Comparisons](https://dmarcguard.io/compare.md): Feature tables vs competitors - [Research](https://dmarcguard.io/research.md): Original email authentication studies - [Learn](https://dmarcguard.io/learn.md): Protocol and compliance explainers - [Blog](https://dmarcguard.io/blog.md): Troubleshooting guides and how-tos ## Learn - [DMARC Email Auth Guide \[2026\]](https://dmarcguard.io/learn/dmarc/): Learn how DMARC protects your domain from email spoofing. Covers DMARC records, policies (none/quarantine/reject), alignment, reporting, and SPF/DKIM. - [What Is SPF? How It Works, Provider Setup & Alignment \[2026\]](https://dmarcguard.io/learn/spf/): How SPF works, how to set it up for Google Workspace and Microsoft 365, how SPF alignment feeds DMARC, and how to fix common failures. - [What is DKIM? How DKIM Signatures & Records Work \[2026\]](https://dmarcguard.io/learn/dkim/): DKIM adds cryptographic signatures to emails, verifying sender identity and message integrity. Learn how it works, record examples, and key rotation. - [What Is ARC? Authenticated Received Chain \[2026\]](https://dmarcguard.io/learn/arc/): ARC (Authenticated Received Chain, RFC 8617) preserves email authentication through forwarding and mailing lists — and how it fixes DMARC failures. - [TLS-RPT SMTP TLS Reporting \[2026\]](https://dmarcguard.io/learn/tls-rpt/): TLS-RPT (RFC 8460) monitors SMTP TLS failures between mail servers. Learn how to set up your DNS record, read reports, and fix errors. - [What Is MTA-STS? DNS Record & Policy File \[2026\]](https://dmarcguard.io/learn/mta-sts/): Learn what MTA-STS is, how it prevents TLS downgrade attacks, and how to set up your DNS record and policy file. RFC 8461 guide with provider examples. - [What Is BIMI? Record Setup & DNS Examples \[2026\]](https://dmarcguard.io/learn/bimi/): BIMI puts your brand logo in the inbox once you reach DMARC enforcement. Learn how to create a BIMI record, VMC requirements, and which clients support BIMI. - [What Is DANE? TLSA Records & SMTP DANE \[2026\]](https://dmarcguard.io/learn/dane/): DANE binds your mail server's TLS certificate to DNS with DNSSEC and TLSA records. Learn how TLSA records work, DANE vs MTA-STS, and SMTP DANE setup. - [Abuse Reporting Format (ARF) for Email (RFC 5965) \[2026\]](https://dmarcguard.io/learn/arf/): ARF (Abuse Reporting Format, RFC 5965) is the format behind DMARC failure reports and feedback-loop complaints — and how to read one. - [PCI DSS 4.0 DMARC Requirement \[2026\]](https://dmarcguard.io/learn/pci-dss/): PCI DSS v4.0 Section 5.4.1 requires anti-phishing controls including DMARC, SPF, and DKIM. Learn what changed, compliance deadlines, and how to implement. - [Content Security Policy (CSP) Explained \[2026\]](https://dmarcguard.io/learn/csp/): What Content Security Policy is, how browsers enforce it, and how to configure, roll out, and debug one. With live examples. ## Tools Email Authentication (14 tools): - [DMARC Record Checker](https://dmarcguard.io/tools/dmarc-checker/): Validate your DMARC policy and get actionable recommendations. All checks run in your browser -- nothing is sent to our servers. - [DMARC Record Generator](https://dmarcguard.io/tools/dmarc-generator/): Build a valid DMARC TXT record with the right policy, reporting, and alignment settings. All generation runs in your browser — nothing is sent to our servers. - [DMARC Report Analyzer](https://dmarcguard.io/tools/dmarc-report-analyzer/): Free DMARC report analyzer — upload aggregate XML to visualize authentication results, identify your senders, and spot failures. Runs in your browser; no data leaves your device. - [DMARC Failure Diagnoser](https://dmarcguard.io/tools/dmarc-failure-diagnoser/): Seeing DMARC failures in your reports or bounce messages? Enter your domain and get the most likely causes ranked by impact — with the exact fix for each one. Covers missing record, p=none silent failure, SPF misalignment, DKIM gaps, and forwarding-induced breaks. - [SPF Record Checker](https://dmarcguard.io/tools/spf-checker/): Free SPF checker. Validate your SPF record against RFC 7208, parse every mechanism, count its DNS lookups, and catch PermError before receivers do. No signup. - [SPF Record Generator](https://dmarcguard.io/tools/spf-generator/): Build a valid SPF TXT record with provider presets, mechanism management, and live DNS lookup counting against the RFC 7208 limit. - [SPF Flattener](https://dmarcguard.io/tools/spf-flattener/): Recursively resolve SPF include chains, visualize the lookup tree, and generate a flattened record with all IPs — entirely in your browser. - [SPF Record Syntax Inspector](https://dmarcguard.io/tools/spf-syntax-inspector/): Paste an SPF record (or fetch one from a domain) and get a token-by-token breakdown — every mechanism, every qualifier, every modifier, mapped to its RFC 7208 section with plain-English meaning and the common pitfalls for each. - [SPF Macro Debugger](https://dmarcguard.io/tools/spf-macro-debugger/): Expand SPF macros — %{i}, %{s}, %{d}, %{l}, %{o}, %{h}, %{v}, %{p} — with your own evaluation context. See exactly what each macro expands to before publishing the record, and understand the per-IP and per-sender authorisation patterns most receivers never document. - [DKIM Record Checker](https://dmarcguard.io/tools/dkim-checker/): Free DKIM checker — look up your DKIM record by selector, validate the public key against RFC 8301, and check the signing algorithm. Instant results, no signup. - [DKIM Record Generator](https://dmarcguard.io/tools/dkim-generator/): Generate DKIM key pairs (RSA or Ed25519) and DNS TXT records entirely in your browser. Your private key never leaves your device. - [DKIM CNAME Validator](https://dmarcguard.io/tools/dkim-cname-validator/): Most ESPs publish DKIM keys via CNAME so they can rotate keys server-side. This tool walks the CNAME chain (loop-safe), resolves the terminal TXT, and validates the DKIM key against RFC 8301 — flagging dangling aliases, weak keys, and missing terminals. - [ARC Readiness Checker](https://dmarcguard.io/tools/arc-checker/): Check your domain's ARC readiness — DMARC enforcement, mail provider capabilities, and DKIM key availability at common ARC selectors. - [ARC Chain Analyzer](https://dmarcguard.io/tools/arc-chain-analyzer/): Parse and visualize Authenticated Received Chain (ARC) headers per RFC 8617. Validate chain integrity, inspect each hop, and diagnose forwarding issues. Transport Security (8 tools): - [TLS-RPT Record Checker](https://dmarcguard.io/tools/tls-rpt-checker/): Validate your TLS-RPT DNS record, check report destinations, and verify MTA-STS integration per RFC 8460. - [TLS-RPT Record Generator](https://dmarcguard.io/tools/tls-rpt-generator/): Generate a valid TLS-RPT DNS record with mailto and HTTPS report destinations per RFC 8460. - [TLS-RPT Report Analyzer](https://dmarcguard.io/tools/tls-report-analyzer/): Upload and analyze TLS-RPT JSON reports in your browser. Visualize TLS negotiation successes, failures, and policy compliance — no data leaves your device. - [MTA-STS Policy Checker](https://dmarcguard.io/tools/mta-sts-checker/): Validate your MTA-STS DNS record, fetch the policy file, and verify MX record alignment per RFC 8461. - [MTA-STS Policy Generator](https://dmarcguard.io/tools/mta-sts-generator/): Generate the DNS TXT record and policy file needed to deploy MTA-STS (RFC 8461). MX records are auto-populated from DNS. - [DANE/TLSA Record Checker](https://dmarcguard.io/tools/dane-checker/): Look up TLSA records, verify DNSSEC status, and validate DANE configuration for your mail server per RFC 6698 and RFC 7672. - [DANE/TLSA Record Generator](https://dmarcguard.io/tools/dane-generator/): Generate DANE TLSA records for your mail server. SHA-256/SHA-512 hashing with optional PEM parsing — all in your browser. - [CSP Validator](https://dmarcguard.io/tools/csp-validator/): Paste a Content-Security-Policy header and get a security grade, the exact weaknesses ranked by severity, and a paste-ready fix for each — plus a strict-policy generator and formatter. Everything runs in your browser. Brand & Reporting (4 tools): - [BIMI Record Checker](https://dmarcguard.io/tools/bimi-checker/): Verify your BIMI record, check SVG logo compliance, VMC authority, and DMARC enforcement prerequisites. - [BIMI Record Generator](https://dmarcguard.io/tools/bimi-generator/): Generate a valid BIMI DNS record with SVG logo URL and optional VMC certificate. All configuration stays in your browser. - [ARF / Forensic Report Checker](https://dmarcguard.io/tools/arf-checker/): Validate your DMARC forensic reporting — check ruf= destinations, external authorization, failure options, and provider compatibility. - [ARF Report Analyzer](https://dmarcguard.io/tools/arf-report-analyzer/): Parse ARF feedback reports (RFC 5965). Upload or paste an ARF email to extract feedback type, source IP, domain, and auth results — in your browser. Compliance (11 tools): - [NIS2 Email Authentication Readiness Scorecard](https://dmarcguard.io/tools/nis2-readiness/): EU equivalent: check the same posture against NIS2 Article 21. - [BSI NIS2 E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/bsi-nis2/): Same scorecard, German auditor language, BSI-Grundschutz mapping. - [NIS2 Supplier Email-Auth Questionnaire](https://dmarcguard.io/tools/nis2-supplier-questionnaire/): Paste or upload a supplier list and get a NIS2 §21(2)(d) supply-chain readiness report in seconds. Each supplier's DMARC, SPF, and MTA-STS posture is scored and the gaps named in auditor language. Downloadable as CSV evidence. - [DORA ICT Email Control Mapper](https://dmarcguard.io/tools/dora-compliance/): Map your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture to DORA Articles 9, 10, and 11. Built for EU financial entities preparing for supervisor reviews under Regulation (EU) 2022/2554. - [DORA E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/dora-de/): Für Finanzunternehmen: DORA Art. 9-11 statt NIS2-Allgemein. - [PCI DSS 4.0.1 § 5.4.1 Anti-Phishing Checker](https://dmarcguard.io/tools/pci-anti-phishing/): Requirement 5.4.1 has been mandatory since March 31, 2025. Check your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture against the QSA-facing rubric for PCI's anti-phishing automated mechanism. - [HIPAA Email Authentication Readiness](https://dmarcguard.io/tools/hipaa-email-readiness/): Check your domain against the HIPAA 164.312 Technical Safeguards: the email-authentication controls covered entities and business associates need before an OCR audit. - [Microsoft 550 5.7.515 Bulk Sender Diagnostic](https://dmarcguard.io/tools/microsoft-550-diagnostic/): Outlook routes non-compliant bulk-sender mail to Junk since 5 May 2025, and 550 5.7.515 rejections are documented for DMARC failures. Diagnose your domain against Microsoft's high-volume sender requirements and get the exact DNS records to publish. - [Gmail & Yahoo Bulk-Sender Readiness](https://dmarcguard.io/tools/gmail-yahoo-bulk-sender/): Same DNS posture, different inbox provider requirements. - [NCSC Mail Check Migration Tool](https://dmarcguard.io/tools/ncsc-mail-check-migration/): UK equivalent against the retired NCSC Mail Check MCSS B3 baseline. - [p=none Escape Plan — 4-Week DMARC Migration Wizard](https://dmarcguard.io/tools/pnone-escape-plan/): Stuck at p=none? Enter your domain to get a personalised four-week plan that walks you from monitoring to p=quarantine to p=reject — with the exact DNS record at every step and the criteria for advancing. General Lookups (10 tools): - [Domain Email Health Check](https://dmarcguard.io/tools/domain-health-check/): Run a comprehensive email authentication audit across all protocols. Get a weighted security score and actionable recommendations -- entirely from your browser. - [Email Header Analyzer](https://dmarcguard.io/tools/email-header-analyzer/): Free email header analyzer — paste raw headers to decode SPF, DKIM, and DMARC results, trace the delivery path, and check sender alignment, entirely in your browser. - [DNS Record Lookup](https://dmarcguard.io/tools/dns-lookup/): Query any DNS record type for any domain — A, AAAA, MX, TXT, NS, CNAME, and more. Client-side queries via Cloudflare's edge network. No signup required. - [MX Record Lookup](https://dmarcguard.io/tools/mx-lookup/): Free MX record lookup. Check any domain's mail servers, priority, and routing in your browser via Cloudflare DNS-over-HTTPS. No signup, instant results. - [CNAME Record Lookup](https://dmarcguard.io/tools/cname-lookup/): Free CNAME record lookup tool. Verify canonical names, alias targets, and DNS configuration in your browser via Cloudflare DoH. No signup, no ads. - [TXT Record Lookup](https://dmarcguard.io/tools/txt-lookup/): Free TXT record lookup tool. Verify SPF, DKIM, DMARC, domain ownership, and verification tokens in your browser via Cloudflare DoH. No signup. - [Reverse DNS Lookup](https://dmarcguard.io/tools/reverse-dns-lookup/): Free reverse DNS / PTR lookup tool. Resolve any IPv4 or IPv6 address back to its hostname in your browser via Cloudflare DoH. No signup, no ads. - [WHOIS Domain Lookup](https://dmarcguard.io/tools/whois-lookup/): Look up domain registration details via RDAP — registrar, dates, nameservers, and DNSSEC status. All queries run in your browser. - [Blacklist Check](https://dmarcguard.io/tools/blacklist-check/): Check if an IP address or domain is listed on major DNS blacklists. All queries run in your browser via DNS over HTTPS. - [Open Relay Tester](https://dmarcguard.io/tools/open-relay-tester/): A real open-relay test requires an SMTP probe — which browsers cannot perform. This tool runs the DNS-side posture check (MX, A/AAAA, PTR, FCrDNS, ISP-host heuristics) and renders the exact telnet sequence you run yourself to complete the SMTP-level verification. Full list at [/tools/](https://dmarcguard.io/tools/). ## Comparisons Vendor comparisons: - [DMARCguard vs Valimail](https://dmarcguard.io/compare/valimail/): Valimail pricing starts at $5,000/year for Enforce Starter (annual-only), and the Align tier was retired after the September 2025 DigiCert acquisition — leaving a $0-to-$5,000 gap between free Monitor and the first paid plan. Valimail remains the enterprise DMARC leader; DMARCguard delivers broader protocol coverage including ARC and DANE at per-domain pricing, with full data portability and no DNS delegation lock-in. - [DMARCguard vs EasyDMARC](https://dmarcguard.io/compare/easydmarc/): EasyDMARC pricing starts at $44.99/mo for the 2-domain Plus plan; around 2024 the free tier was reduced to 1 domain, 1,000 emails/month, and 14 days of history. DMARCguard offers simpler pricing and broader protocol coverage — 7 protocols free, all 9 from Pro. - [DMARCguard vs dmarcian](https://dmarcguard.io/compare/dmarcian/): dmarcian pricing runs $24–$600/mo across volume-metered tiers with hard domain caps — and the Basic→Plus step is a 10x jump ($24→$240/mo). DMARCguard covers 9 protocols with transparent per-domain pricing that scales continuously. - [DMARCguard vs PowerDMARC](https://dmarcguard.io/compare/powerdmarc/): PowerDMARC pricing scales $8–$250/mo on the Basic plan by email volume, with Enterprise quote-only. DMARCguard matches its broad protocol coverage while adding ARC chain validation, single-pane multi-tenant management, and automatic sender identification. - [DMARCguard vs MXToolbox](https://dmarcguard.io/compare/mxtoolbox/): Looking for an MXToolbox alternative for continuous DMARC monitoring? MXToolbox built the internet's favorite free DNS toolbox, but Delivery Center costs $129/mo for 5 domains, caps DMARC history at 90 days, and has no public pricing page — the price surfaces only on its upgrade pages. DMARCguard monitors 9 protocols with published per-domain pricing. - [DMARCguard vs Proofpoint](https://dmarcguard.io/compare/proofpoint/): Proofpoint Email Fraud Defense pairs hosted DMARC with genuinely unmatched threat intelligence — at enterprise prices published nowhere in USD. The only verifiable list prices are UK G-Cloud figures: £22,901/yr for a single sending domain. DMARCguard covers 9 protocols at a published per-domain price. - [DMARCguard vs Mimecast](https://dmarcguard.io/compare/mimecast/): Mimecast DMARC Analyzer 2.0 (January 2026) is a real upgrade — hosted SPF/DMARC/DKIM delegation and TLS-RPT reporting. But the price appears nowhere on mimecast.com, tiers by your domain's web-traffic profile, and renewals carry a contractual uplift. DMARCguard publishes one per-domain price. - [DMARCguard vs Barracuda](https://dmarcguard.io/compare/barracuda/): Barracuda folds DMARC reporting into its Email Protection bundles — priced per mailbox with 25-seat reseller minimums, guided setup but no automated enforcement, and five protocols missing entirely. DMARCguard prices per domain and monitors all 9 protocols. - [DMARCguard vs Red Sift](https://dmarcguard.io/compare/redsift/): Red Sift OnDMARC is a genuinely strong platform: Dynamic SPF, in-app VMC issuance, and support quality G2 reviewers consistently praise. But only one tier has a public price, aggregators still show conflicting older figures, and DANE sits outside the product. DMARCguard publishes one per-domain price and monitors the full stack. - [DMARCguard vs Sendmarc](https://dmarcguard.io/compare/sendmarc/): Searching for Sendmarc pricing turns up no published number: every paid tier is quote-only, the domain is the pricing unit, and no rate card exists anywhere. Sendmarc pairs hands-on onboarding with a mature MSP channel, and G2 reviewers reward that with a 4.9 average. DMARCguard puts the number first. - [DMARCguard vs Suped](https://dmarcguard.io/compare/suped/): Suped is the newest entrant in the DMARC space — launched mid-2025, transparently priced, and well-liked by its early reviewers. Its surface is DMARC, SPF, and DKIM monitoring plus hosted DMARC, SPF, and MTA-STS; BIMI, TLS-RPT, ARC, DANE, and ARF are absent. DMARCguard monitors all nine protocols. - [DMARCguard vs Skysnag](https://dmarcguard.io/compare/skysnag/): Skysnag pricing starts at $39/mo for Comply, and its autonomous enforcement is real - its reviewers confirm hands-off operation - but that automation starts at the $249/mo Protect tier. DMARCguard publishes per-domain pricing, with guided enforcement included in Pro. - [DMARCguard vs URIports](https://dmarcguard.io/compare/uriports/): URIports is the price-transparency leader in this category: five published terrain-named tiers from $1.25/mo plus a quote-only Enterprise plan, quotas counted in reports received, and processing that simply halts at quota instead of surprise-billing you. The trade-offs are a 90-day history ceiling, monitoring without hosted SPF or DMARC, and no SLA or certifications. DMARCguard picks up where monitoring stops. - [DMARCguard vs DMARCLY](https://dmarcguard.io/compare/dmarcly/): DMARCLY publishes flat, genuinely low prices — $17.99/mo entry and a 200-domain Enterprise tier at a flat $199/mo. The trade-offs sit elsewhere: 2 months of history on the entry tier, no free plan, email-only alerting, and an API locked to the top tier. DMARCguard pairs a published per-domain price with 1 year of history on Pro. - [DMARCguard vs DMARC Report](https://dmarcguard.io/compare/dmarcreport/): DMARC Report pricing runs from a free Core tier to $3,900/mo Ultimate, and it is the most-reviewed DMARC product on G2 — 4.8/5 across 471 reviews — with a mature REST API and SOC 2 Type II. The evaluation questions are the 5/10/25 domain caps on paid tiers, and which protocol unlocks at which tier. Here is the full map. - [DMARCguard vs Mailhardener](https://dmarcguard.io/compare/mailhardener/): Mailhardener earns real respect: EUR-native flat pricing, DANE and hosted MTA-STS depth most vendors skip, and SSO with 2FA on every tier — Free included. What it leaves out, by design, is the layer after detection: guided remediation, blocklist monitoring, webhook alerting, and an entry-tier API. That layer is the comparison. - [DMARCguard vs Fraudmarc](https://dmarcguard.io/compare/fraudmarc/): Fraudmarc pairs hosted DMARC report analysis with deep, dedicated SPF flattening - two productized lines, one SLA-backed - plus an Apache-2.0 Community Edition you can run in your own AWS. The trade-off is scope: DMARC and SPF are the whole product, where DMARCguard productizes nine protocols under one published per-domain price. - [DMARCguard vs DMARC Advisor](https://dmarcguard.io/compare/dmarcadvisor/): DMARC Advisor is a genuinely EU-operated platform: a Dutch entity since 2013, EU data hosting, and hands-on support in four languages. Two structural facts shape any 2026 evaluation: the legacy DMARC Advisor Platform retires on June 30, 2026 in favor of the company's new DMARC Manager platform, and a court-ordered geofence limits service to Europe and Africa. Here is the factual comparison. Head-to-head comparisons, compared on published pricing and features: - [PowerDMARC vs Valimail: 2026 Pricing Compared](https://dmarcguard.io/compare/powerdmarc-vs-valimail/): PowerDMARC publishes $8–$250/mo volume pricing; Valimail Enforce starts at $5,000/year, annual-only. Features, free tiers, and pricing compared. Updated July 2026. - [EasyDMARC vs PowerDMARC: Which Fits in 2026?](https://dmarcguard.io/compare/easydmarc-vs-powerdmarc/): EasyDMARC Plus starts at $44.99/mo with 2 domains; PowerDMARC Basic scales $8–$250/mo with 5. Features, free tiers, and pricing compared. Updated July 2026. - [dmarcian vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/dmarcian-vs-easydmarc/): dmarcian Basic is $24/mo, metering legitimate mail only; EasyDMARC Plus is $44.99/mo with managed hosting. Features and pricing compared. Updated July 2026. - [dmarcian vs Valimail: Pricing Gap Explained](https://dmarcguard.io/compare/dmarcian-vs-valimail/): dmarcian publishes $24–$600/mo tiers; Valimail's one public price is $5,000/yr Enforce Starter. Automation, features, and free tiers compared. Updated July 2026. - [PowerDMARC vs dmarcian: 2026 Comparison](https://dmarcguard.io/compare/powerdmarc-vs-dmarcian/): PowerDMARC hosts your records with plans from $8–$250/mo; dmarcian is reporting-first from $24/mo, metering legitimate mail only. Compared with sources. Updated July 2026. - [Valimail vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/valimail-vs-easydmarc/): Valimail's one public price is $5,000/yr, annual-only; EasyDMARC publishes $44.99–$89.99/mo plans. Automation, free tiers, and features compared. Updated July 2026. - [DMARC Report vs Valimail: The Affordable Alternative?](https://dmarcguard.io/compare/dmarcreport-vs-valimail/): DMARC Report publishes plans from $25/mo; Valimail's one public price is $5,000/yr Enforce Starter, annual-only. Pricing, free tiers, and features compared. Updated July 2026. - [DMARCLY vs dmarcian: 2026 Pricing Compared](https://dmarcguard.io/compare/dmarcly-vs-dmarcian/): DMARCLY publishes flat tiers from $17.99/mo; dmarcian meters legitimate mail from $24/mo with a 10x Basic-to-Plus jump. Pricing and features compared. - [MXToolbox vs dmarcian: DMARC Compared (2026)](https://dmarcguard.io/compare/mxtoolbox-vs-dmarcian/): MXToolbox Delivery Center runs $129–$399/mo with a 90-day DMARC history cap; dmarcian publishes $24–$600/mo tiers. Features and pricing compared side by side. ## Research - [State of Email Authentication 2026](https://dmarcguard.io/research/email-authentication/): 7 in 10 domains have no DMARC protection — largest email security study with 5.5 million domains - [SPF Supply Chain 2026: Email Sender Market Share](https://dmarcguard.io/research/spf-supply-chain/): Microsoft 365 and Google Workspace appear in 33% of all SPF records — first-ever email sender market share by SPF include ## Blog 51 guides on DMARC, SPF, DKIM, and email authentication troubleshooting, newest first. Every post also has a markdown twin at the same path (e.g. `/blog/.md`). - [Content Security Policy Examples by Stack](https://dmarcguard.io/blog/csp-header-examples/): Content Security Policy examples for nginx, Cloudflare, and Next.js — plus the add_header trap that silently drops your header. Grade yours free. - [DMARC rua Tag: Are Reports Reaching You?](https://dmarcguard.io/blog/dmarc-rua-collection/): The DMARC rua tag decides whether you get aggregate reports at all. Where to point it, the _report._dmarc record, and why reports stop. Check yours free. - [How to Decode Email Headers: Read the ARC Set](https://dmarcguard.io/blog/read-email-headers/): Decode email headers line by line: trace the Received chain, find your trust boundary, and read the ARC set. Walk one real dump, then analyze yours. - [Free vs Paid DMARC Monitoring: When Each Makes Sense](https://dmarcguard.io/blog/free-vs-paid-dmarc-monitoring/): Free DMARC monitoring is often enough — and sometimes it isn't. Real free-tier caps, real paid prices, contract fine print, and a decision table to pick well. - [BIMI DMARC Requirements: The Policy Your Logo Needs](https://dmarcguard.io/blog/bimi-dmarc-requirements/): BIMI requires DMARC at enforcement: p=quarantine or reject, pct=100, sp not none. See the exact requirements and fix bimi=skipped insufficient dmarc. - [DMARC Aggregate Report: Anatomy, Senders, RFC 9990](https://dmarcguard.io/blog/dmarc-aggregate-report/): What a DMARC aggregate report is, who sends the XML and how often, an annotated sample file, and what RFC 9990 changed. Analyze yours free. - [TLSA Mismatch: Debug a DANE 3 1 1 Failure with OpenSSL](https://dmarcguard.io/blog/tlsa-mismatch-troubleshooting/): A DANE TLSA 3 1 1 mismatch means the published hash no longer matches the served key. Compute the hash with OpenSSL, isolate the root cause, and fix it fast. - [Google Workspace SPF Record: What Docs Don't Tell You](https://dmarcguard.io/blog/google-workspace-spf-record/): The exact Google Workspace SPF record to publish, third-party sender combos, the DNS lookup math, and ~all vs -all under RFC 7208. - [DNS Authentication DMARC Fail: The Mimecast Fix](https://dmarcguard.io/blog/dmarc-fail-mimecast-fix/): "DNS Authentication: DMARC Fail" is Mimecast's inbound hold verdict. Decode the string, read the headers, and fix it as admin or sender. - [Best DMARC Reporting Tools in 2026: 9 Compared by Depth](https://dmarcguard.io/blog/best-dmarc-reporting-tools/): Compare 9 DMARC reporting tools on RUF parsing, source naming, retention, and export — with dated, source-linked pricing. Find the depth your rollout needs. - [Fix "MTA-STS Policy Is Missing: STSFetchResult.NONE"](https://dmarcguard.io/blog/mta-sts-policy-missing-fix/): Seeing "MTA-STS policy is missing: STSFetchResult.NONE"? Diagnose it in 3 stages — DNS TXT record, HTTPS policy fetch, TLS cert — with copy-paste commands. - [SPF Record Syntax Guide: RFC 7208 Rules & Macros](https://dmarcguard.io/blog/spf-record-syntax/): Every SPF record syntax element in one place — mechanisms, qualifiers, modifiers, and macros — with RFC 7208 section cites and real record examples. - [TLSA Record Setup: Generate & Fix the 3 1 1 Hash](https://dmarcguard.io/blog/tlsa-record-setup/): Generate a TLSA record with OpenSSL, publish it, then fix the common DANE 3 1 1 mismatch. Copy-paste commands plus a free TLSA record checker. Step by step. - [DMARC Subdomain Policy: sp= and np= Explained](https://dmarcguard.io/blog/dmarc-subdomain-policy/): DMARC subdomain policy sets how subdomains inherit p=, sp=, and np=. See the DMARCbis tree walk, sp= vs np=, and how to stop non-existent-subdomain spoofing. - [PCI DSS DMARC Requirement: What 5.4.1 Actually Says](https://dmarcguard.io/blog/pci-dss/): PCI DSS v4.0.1 Section 5.4.1 mandates anti-phishing controls — and names DMARC, SPF, and DKIM as examples, not requirements. See what your auditors expect. - [Best Free DMARC Tools in 2026: Checkers & Analyzers](https://dmarcguard.io/blog/best-free-dmarc-tools/): Compare every genuinely free DMARC tool: no-signup checkers, free DMARC analyzers, and free monitoring tiers, with real limits and when to upgrade. - [Valimail Alternative: Transparent Pricing, No Demo Gate](https://dmarcguard.io/blog/valimail-alternative/): Looking for a Valimail alternative? Compare transparent per-domain pricing, self-serve signup with no demo gate, and 9-protocol DMARC coverage. Check free. - [PowerDMARC Alternative: Experience Over Feature Count](https://dmarcguard.io/blog/powerdmarc-alternative/): Weighing a PowerDMARC alternative? Compare real pricing ($8–$250/mo), protocol coverage, honest reviews, and a zero-gap migration path before you switch. - [How to Set Up DKIM: Selectors, Keys & Records (2026)](https://dmarcguard.io/blog/dkim-setup-guide/): Set up DKIM the right way: how signing works, choosing 2048-bit keys, finding your selector, and publishing the record. A 2026 guide — check yours free. - [How to Set Up BIMI (and Why 28% of Records Break)](https://dmarcguard.io/blog/bimi-record-setup/): BIMI puts your logo in the inbox — but 28% of records break. Here's how to set up BIMI: the DNS TXT record, SVG Tiny PS logo, and VMC vs CMC. Check yours free. - [Email Provider Market Share 2026: Who Sends the Mail](https://dmarcguard.io/blog/email-provider-market-share/): Microsoft 365 = 19.6%, Google Workspace = 13.6% of 3.08M SPF-enabled domains (DMARCguard scan, Mar 2026). The 2026 email provider market share, sourced. - [DORA Compliance for Email: Map DMARC to Art. 9-11](https://dmarcguard.io/blog/dora-email-authentication/): DORA compliance for email, mapped to Articles 9, 10 and 11. How DMARC, SPF, MTA-STS and TLS-RPT meet the regulation's data-in-transit duties. - [MTA-STS vs DANE: Verdict by Scenario (2026 Data)](https://dmarcguard.io/blog/mta-sts-vs-dane/): Only 0.3% of 5.5M domains publish MTA-STS; 0.0% publish DANE. Get the per-scenario verdict, RFC 8461 vs 7672, Microsoft's connector modes, and NIS2 fit. - [Email Deliverability Monitoring: 7 Signals to Track](https://dmarcguard.io/blog/email-deliverability-monitoring/): Email deliverability monitoring: the protocol signals that predict spam-folder placement, the metrics to track, and the tools that surface each one. - [Does HIPAA Require DMARC? §164.312 Email Auth Mapping \[2026\]](https://dmarcguard.io/blog/hipaa-email-authentication/): Does HIPAA require DMARC? Not by name. How §164.312 technical safeguards map to DMARC, SPF, DKIM, MTA-STS, TLS-RPT — plus the Dec 2024 NPRM. - [How to Create a DMARC Record: Tags, Examples & Setup](https://dmarcguard.io/blog/how-to-create-dmarc-record/): How to create a DMARC record step by step — tags, syntax, real examples, and the p=none → p=reject rollout. Verify it with a free DMARC checker. - [DMARC Adoption Rate 2026: The 12.8% Enforcement Gap](https://dmarcguard.io/blog/dmarc-enforcement-gap/): 30.4% of 5.5 million domains have DMARC; only 12.8% enforce p=quarantine or p=reject. The 2026 enforcement gap, with sources. Run a free check. - [DMARC for Google Workspace: Step-by-Step Setup \[2026\]](https://dmarcguard.io/blog/dmarc-google-workspace-setup/): Set up DMARC for Google Workspace step-by-step: the exact TXT record, where to publish it, and the p=none to reject rollout. 2026 guide. - [Why Are My Emails Going to Spam? Authentication-First Fix](https://dmarcguard.io/blog/emails-going-to-spam/): Emails landing in spam? 40.8% of 5.5M scanned domains have no email authentication. Use this authentication-first checklist to get back in the inbox. - [NIS2 Email Security: Article 21 → DMARC, MTA-STS, DANE](https://dmarcguard.io/blog/nis2-email-security/): NIS2 compliance: map Article 21(2) to email auth — DMARC, SPF, MTA-STS, DANE, TLS-RPT. The control map, copy-paste DNS checks, and a 2026 readiness plan. - [RFC 9989 DMARC: What Changed From RFC 7489](https://dmarcguard.io/blog/dmarc-rfc-9989-9990-9991/): RFC 9989 replaces RFC 7489 as DMARC's Standards-Track spec (May 2026). What changed: the RFC 9990 aggregate / 9991 failure split, tree walk, pct removed. - [Best DMARC Monitoring Tools in 2026: 6 Compared](https://dmarcguard.io/blog/best-dmarc-monitoring-tools/): Honest comparison of 6 DMARC monitoring tools in 2026: protocol coverage, pricing verified May 2026, free-tier limits, MSP fit. Pick the right one. - [dmarcian Alternative: 9 Protocols vs 3 (2026 Comparison)](https://dmarcguard.io/blog/dmarcian-alternative/): Comparing the best dmarcian alternatives in 2026. Protocol coverage (9 vs 3), pricing, free tiers, switcher quotes, and a step-by-step migration guide. - [How to Read a DMARC Aggregate Report (XML Made Simple)](https://dmarcguard.io/blog/how-to-read-dmarc-report/): Read DMARC aggregate reports field by field. Annotated XML, Google vs Microsoft variants, and a live drawer demo. Free analyzer inside. - [MTA-STS Example: Working Policy File & DNS Record \[2026\]](https://dmarcguard.io/blog/mta-sts-example/): Copy-paste a working MTA-STS DNS record and policy file. RFC 8461 examples for Google Workspace, Microsoft 365, and Postfix, plus mode progression. - [DMARC for MSPs: The Independent Operator's Guide (2026)](https://dmarcguard.io/blog/dmarc-for-msps/): Vendor-neutral DMARC guide for MSPs: wholesale pricing, multi-tenant ops, PSA integrations, and ROI math — without the partner-program pitch. - [TLS-RPT Reports: SMTP TLS Reporting Explained (RFC 8460)](https://dmarcguard.io/blog/tls-rpt-report/): TLS-RPT reports tell you when SMTP TLS fails between mail servers. See an annotated RFC 8460 JSON example, every result type, and how to set it up. - [What Is ARF in Email? Abuse Reporting Format](https://dmarcguard.io/blog/what-is-arf/): ARF (Abuse Reporting Format, RFC 5965) is the standard for DMARC forensic reports and email feedback loops. Annotated sample inside. - [DKIM2 Explained: The 2026 Successor to ARC and DKIM](https://dmarcguard.io/blog/arc-to-dkim2-future/): DKIM2 is the IETF's per-hop chained-signature successor to ARC and DKIM. Eight active drafts, five contested questions, and what admins track in 2026. - [ARC Email Authentication: Forwarded Mail in 2026](https://dmarcguard.io/blog/arc-email-authentication/): ARC email authentication carries SPF, DKIM, and DMARC verdicts across forwarding hops. Real headers, cv=fail debugging, trusted-sealer fixes, IETF status. - [Does Outlook Require DMARC? Yes, Since May 2025](https://dmarcguard.io/blog/microsoft-dmarc-enforcement/): Yes — Microsoft has required DMARC for Outlook senders since May 5, 2025. Set up DMARC for Microsoft 365 step by step with DNS examples. - [Google, Yahoo & Microsoft DMARC Requirements](https://dmarcguard.io/blog/google-yahoo-dmarc-requirements/): Google, Yahoo, and Microsoft now require DMARC for bulk senders — including Gmail's 2025 SMTP rejection escalation. See the full compliance checklist. - [DMARC Fails on Forwarded Emails: Why ARC Is the Fix](https://dmarcguard.io/blog/dmarc-forwarding-arc-fix/): Forwarded emails fail DMARC because SPF breaks in transit. See why, when DKIM survives, and how ARC seals the chain across every forwarding hop. - [MXToolbox Alternatives: Free DMARC Tools Compared (2026)](https://dmarcguard.io/blog/mxtoolbox-alternative/): MXToolbox SuperTool covers lookups but stops at DMARC monitoring. Compare free alternatives — DMARCguard, EasyDMARC, dmarcian, PowerDMARC — on pricing. - [SPF Flattening: Fix Too Many DNS Lookups (2026)](https://dmarcguard.io/blog/spf-too-many-dns-lookups/): 148,655 domains exceed the SPF 10-lookup limit. Learn what SPF flattening is, when to use it, 4 safer alternatives, and step-by-step fixes. Check free. - [SPF Softfail vs Hardfail: Which to Use?](https://dmarcguard.io/blog/spf-softfail-vs-hardfail/): 53.6% of domains use SPF softfail, 40.2% use hardfail. Learn how each qualifier works, how DMARC changes the equation, and which to choose. Check your SPF free. - [SPF PermError: How to Find and Fix It (2026 Guide)](https://dmarcguard.io/blog/spf-permerror-fix/): SPF PermError breaks DMARC alignment and kills deliverability. Learn the 5 causes, step-by-step fixes, and platform-specific examples. Check your SPF free. - [DKIM Fail: How to Fix Alignment and Verification Errors](https://dmarcguard.io/blog/dkim-alignment-failure-fix/): DKIM failing? Learn why DKIM alignment breaks, how to fix body hash errors, and how to configure third-party senders. Step-by-step guide with CLI commands. - [DMARC Quarantine/Reject Policy Not Enabled: Fix It](https://dmarcguard.io/blog/dmarc-policy-not-enabled-fix/): See 'DMARC quarantine/reject policy not enabled'? Learn what it means and how to fix it step by step for any DNS provider. Free checker included. - [EasyDMARC Alternative: Why Teams Are Switching in 2026](https://dmarcguard.io/blog/easydmarc-alternative/): EasyDMARC's Plus plan runs $44.99/mo, with TLS-RPT and MTA-STS gated to Premium. Compare alternatives on pricing, protocols, and free tiers. - [DMARC Fail: 7 Causes & How to Fix Each (2026 Guide)](https://dmarcguard.io/blog/dmarc-failed-how-to-fix/): DMARC failed? Fix it fast: 7 causes (SPF/DKIM misalignment, third-party senders, forwarding) with diagnose steps, fixes, and a free DMARC checker. ## About - [About DMARCguard](https://dmarcguard.io/about/): Why DMARCguard exists -- our beliefs on RFC correctness, actionable insights, and email auth tools that tell you what to do. - [Meysam Azad, Founder & Engineer](https://dmarcguard.io/authors/meysam-azad/): Meysam Azad is the founder and engineer of DMARCguard. He started the open-source parse-dmarc tool, then built the email-authentication platform that grew out of it. ## Optional - [RSS Feed](https://dmarcguard.io/rss.xml) - [Privacy Policy](https://dmarcguard.io/privacy/) - [Terms of Service](https://dmarcguard.io/terms/) - [Sub-processors](https://dmarcguard.io/subprocessors/)