DMARC monitoring for MSPs

If you monitor DMARC for 10 or more client domains, this page is for you.

No per-domain renewal cycle. No tenant account required for every client. When a client leaves, the domain drops out. Nothing to unwind, nothing to migrate.

What DMARCit does for the MSP

Three scenes an MSP actually walks through, not a feature list.

Scene one: a new client onboards with p=none on four domains. They handed you the DNS credentials Friday. Monday you want the aggregate rua reports flowing so you can see who is sending as them before anyone changes a policy. In DMARCit you add the four domains to your account, point rua at the reporting mailbox, and watch the first 48 hours of data come in. No purchase order for a new tenant. No SSO provisioning. The four domains are line items under your account and you monitor them the same way you monitor the other 30.

Scene two: a client asks for a compliance report for their SOC 2 audit. The auditor wants evidence that DMARC monitoring is in place and that legitimate senders are catalogued. Pull the last 90 days of aggregate data for that one domain, export the alignment-rate trend, hand over the source-marking list showing which senders are approved. The auditor sees what a monitoring program looks like without needing a login to a tenant portal.

Scene three: a client offboards. They switched to an in-house IT team, or they moved to another provider. You want to hand them their data and stop paying for their domain the same billing cycle. In DMARCit that is deleting the domain from your account. There is no client-side account for them to reclaim, no billing entity you have to migrate over, no shared-tenant data you need to disentangle. The domain drops out, the reports stop, the bill adjusts on the next cycle.

Multi-domain math

DMARCit tiers, from the live pricing page. Numbers, not adjectives.

  • Starter, $19/month, 1 domain. Only useful if you are still evaluating on a single test domain of your own.
  • Pro, $49/month, 5 domains. Fits an MSP that is running DMARC monitoring for a handful of clients as a pilot service.
  • Team, $149/month, 25 domains. The tier most working MSPs will sit on.

Margin math you can walk through. Assume you bill a client $50 per month per domain for email deliverability monitoring. Your cost basis per client domain looks like this:

  • 5 client domains on Pro ($49/mo): $9.80 per domain per month in tool cost. At $50/mo billed to clients, roughly $40 gross per domain, roughly 80% gross margin.
  • 20 client domains on Team ($149/mo): $7.45 per domain per month in tool cost. Roughly $42.55 gross per domain, roughly 85% gross margin.

For a first client domain, done-for-you setup is $499 for one sending domain: I inventory its senders, stage the SPF, DKIM, and DMARC changes with approval before each one, and monitor it for at least 30 days. Rolling out across many client domains is quoted separately.

The math gets better the more clients you add, because the tier steps do not punish scale. That is the wedge.

The no-renewal wedge in MSP context

The common pricing pattern in this category is a per-domain annual license or a per-tenant seat that renews every year. When your client leaves you, that per-client cost keeps billing until the renewal date, or you eat a mid-term cancellation loss.

DMARCit does not punish you when a client leaves. There is no per-domain renewal calendar to reconcile. There is no tenant account to migrate. If a client offboards on the 15th, you remove the domain, and the tier math adjusts on the next monthly cycle. If you drop from 22 client domains to 18, you stay on Team and pay the same $149. If you drop from 26 to 19, you can downgrade a tier the next month. Month-to-month billing is intentional here.

Who DMARCit isn't for.

Running 50+ client domains on white-label, PSA-ticketed workflows? DMARCit isn't your platform. For MSPs at 5-50 domains, here's the trade:

  • No white-label mode. Reports and the dashboard show DMARCit branding. If your client-facing service requires a branded portal with your MSP name and logo, DMARCit is not the tool for that scene today.
  • No ConnectWise, Autotask, or Halo PSA integration. Ticket creation from DMARC alerts is manual. If your operations depend on alerts landing as tickets in your PSA, you will be copying and pasting.

No lock-in cuts both ways: outgrow us, export everything, leave in an afternoon.

How to try it

Run one of your client's aggregate reports through the browser-side parser. Nothing uploads. You will see whether the tool names the senders you already recognize and whether the next-action text matches the fix you would write yourself.

Add your client domains and you see each one's SPF, DKIM, and DMARC exposure the same day, before the first aggregate report lands.

  • Report parser: drop in a rua XML or gzipped report. Zero account. Zero upload.
  • Pricing and signup: our pricing page. Seven-day trial, no card required.

Start with one client domain

Check a client's domain now, no account. If what it finds matches what you would have found by hand, add the rest of the book on a seven-day trial and see the whole estate in one list.

Check your client domainsStart a seven-day trial, no card

Pages written for your clients

If much of your book sits in one regulated vertical, these pages are written for the client side of the conversation: what their regulator or trade framework does and doesn't say about email, and where DMARC fits. Send them before the kickoff call.