# DMARCguard > Email authentication platform monitoring DMARC, SPF, DKIM, BIMI, MTA-STS, TLS-RPT, ARC, DANE, ARF from one dashboard. SaaS at dmarcguard.io. Rated 4.9/5 on G2 (11 reviews). Complete site content in a single file: [llms-full.txt](https://dmarcguard.io/llms-full.txt) ## Docs - [API documentation](https://dmarcguard.io/docs/): Getting started, authentication, rate limits and the generated endpoint reference - [Getting started with the API](https://dmarcguard.io/docs/getting-started.md): Create an API key, make your first request and learn the conventions every endpoint follows. - [Authentication](https://dmarcguard.io/docs/authentication.md): How API keys are issued, scoped, bound to an organization and revoked, and what each 401 and 403 means. - [Rate limits](https://dmarcguard.io/docs/rate-limits.md): The hourly quota, the abuse controls in front of it, the headers that report them and how to pace a client. - [Single sign-on](https://dmarcguard.io/docs/sso.md): Connect your identity provider with OpenID Connect, verify your email domain, and decide whether password login stays available. - [Changelog](https://dmarcguard.io/docs/changelog.md): Dated changes to the API contract and the documentation. - [DMARCguard API v1](https://dmarcguard.io/docs/api/v1.md): Base URL, authentication, conventions, errors and the endpoint list - [Reports · API v1](https://dmarcguard.io/docs/api/v1/reports.md): Aggregate (RUA) reports as received, parsed and classified. - [Analytics · API v1](https://dmarcguard.io/docs/api/v1/analytics.md): Organization-wide and per-domain rollups computed by DMARCguard. - [Domains · API v1](https://dmarcguard.io/docs/api/v1/domains.md): The domains you monitor and their health. - [Sources · API v1](https://dmarcguard.io/docs/api/v1/sources.md): Who sends mail as your domains, and whether they should. - [Events · API v1](https://dmarcguard.io/docs/api/v1/events.md): Conditions that needed attention and whether they were acknowledged. - [API keys · API v1](https://dmarcguard.io/docs/api/v1/api-keys.md): How much of the hourly budget the organization's keys have used. - [Vocabulary · API v1](https://dmarcguard.io/docs/api/v1/vocabulary.md): The enumerations other responses use, keyed by category: verification states, severities, grades, policies and reputation. - [OpenAPI document (v1)](https://dmarcguard.io/docs/api/v1/openapi.json): Machine-readable OpenAPI 3.1 spec for the current API version - [API catalog](https://dmarcguard.io/.well-known/api-catalog): RFC 9727 linkset pointing at every API's OpenAPI document, documentation and status page - [Pricing](https://dmarcguard.io/pricing.md): Plans, features, and founding member discounts - [Tools](https://dmarcguard.io/tools.md): 50 free email authentication and DNS tools (no signup) - [Comparisons](https://dmarcguard.io/compare.md): Feature tables vs competitors - [Research](https://dmarcguard.io/research.md): Original email authentication studies - [Learn](https://dmarcguard.io/learn.md): Protocol and compliance explainers - [Blog](https://dmarcguard.io/blog.md): Troubleshooting guides and how-tos ## Learn - [DMARC Email Auth Guide \[2026\]](https://dmarcguard.io/learn/dmarc/): Learn how DMARC protects your domain from email spoofing. Covers DMARC records, policies (none/quarantine/reject), alignment, reporting, and SPF/DKIM. - [What Is SPF? How It Works, Provider Setup & Alignment \[2026\]](https://dmarcguard.io/learn/spf/): How SPF works, how to set it up for Google Workspace and Microsoft 365, how SPF alignment feeds DMARC, and how to fix common failures. - [What is DKIM? How DKIM Signatures & Records Work \[2026\]](https://dmarcguard.io/learn/dkim/): DKIM adds cryptographic signatures to emails, verifying sender identity and message integrity. Learn how it works, record examples, and key rotation. - [What Is ARC? Authenticated Received Chain \[2026\]](https://dmarcguard.io/learn/arc/): ARC (Authenticated Received Chain, RFC 8617) preserves email authentication through forwarding and mailing lists — and how it fixes DMARC failures. - [TLS-RPT SMTP TLS Reporting \[2026\]](https://dmarcguard.io/learn/tls-rpt/): TLS-RPT (RFC 8460) monitors SMTP TLS failures between mail servers. Learn how to set up your DNS record, read reports, and fix errors. - [What Is MTA-STS? DNS Record & Policy File \[2026\]](https://dmarcguard.io/learn/mta-sts/): Learn what MTA-STS is, how it prevents TLS downgrade attacks, and how to set up your DNS record and policy file. RFC 8461 guide with provider examples. - [What Is BIMI? Record Setup & DNS Examples \[2026\]](https://dmarcguard.io/learn/bimi/): BIMI puts your brand logo in the inbox once you reach DMARC enforcement. Learn how to create a BIMI record, VMC requirements, and which clients support BIMI. - [What Is DANE? TLSA Records & SMTP DANE \[2026\]](https://dmarcguard.io/learn/dane/): DANE binds your mail server's TLS certificate to DNS with DNSSEC and TLSA records. Learn how TLSA records work, DANE vs MTA-STS, and SMTP DANE setup. - [Abuse Reporting Format (ARF) for Email (RFC 5965) \[2026\]](https://dmarcguard.io/learn/arf/): ARF (Abuse Reporting Format, RFC 5965) is the format behind DMARC failure reports and feedback-loop complaints — and how to read one. - [PCI DSS 4.0 DMARC Requirement \[2026\]](https://dmarcguard.io/learn/pci-dss/): PCI DSS v4.0 Section 5.4.1 requires anti-phishing controls including DMARC, SPF, and DKIM. Learn what changed, compliance deadlines, and how to implement. - [Content Security Policy (CSP) Explained \[2026\]](https://dmarcguard.io/learn/csp/): What Content Security Policy is, how browsers enforce it, and how to configure, roll out, and debug one. With live examples. - [APRF: Aggregate Performance Reporting for Email \[2026\]](https://dmarcguard.io/learn/aprf/): APRF (Aggregate Performance Reporting) lets mailbox providers send DKIM signers daily inbox placement and engagement reports. Record, report format, setup. ## Tools Email Authentication (14 tools): - [DMARC Record Checker](https://dmarcguard.io/tools/dmarc-checker/): Validate your DMARC policy and get actionable recommendations. All checks run in your browser -- nothing is sent to our servers. - [DMARC Record Generator](https://dmarcguard.io/tools/dmarc-generator/): Build a valid DMARC TXT record with the right policy, reporting, and alignment settings. All generation runs in your browser — nothing is sent to our servers. - [DMARC Report Analyzer](https://dmarcguard.io/tools/dmarc-report-analyzer/): Free DMARC report analyzer — upload aggregate XML to visualize authentication results, identify your senders, and spot failures. Runs in your browser; no data leaves your device. - [DMARC Failure Diagnoser](https://dmarcguard.io/tools/dmarc-failure-diagnoser/): Seeing DMARC failures in your reports or bounce messages? Enter your domain and get the most likely causes ranked by impact — with the exact fix for each one. Covers missing record, p=none silent failure, SPF misalignment, DKIM gaps, and forwarding-induced breaks. - [SPF Record Checker](https://dmarcguard.io/tools/spf-checker/): Free SPF checker. Validate your SPF record against RFC 7208, parse every mechanism, count its DNS lookups, and catch PermError before receivers do. No signup. - [SPF Record Generator](https://dmarcguard.io/tools/spf-generator/): Build a valid SPF TXT record with provider presets, mechanism management, and live DNS lookup counting against the RFC 7208 limit. - [SPF Flattener](https://dmarcguard.io/tools/spf-flattener/): Recursively resolve SPF include chains, visualize the lookup tree, and generate a flattened record with all IPs — entirely in your browser. - [SPF Record Syntax Inspector](https://dmarcguard.io/tools/spf-syntax-inspector/): Paste an SPF record (or fetch one from a domain) and get a token-by-token breakdown — every mechanism, every qualifier, every modifier, mapped to its RFC 7208 section with plain-English meaning and the common pitfalls for each. - [SPF Macro Debugger](https://dmarcguard.io/tools/spf-macro-debugger/): Expand SPF macros — %{i}, %{s}, %{d}, %{l}, %{o}, %{h}, %{v}, %{p} — with your own evaluation context. See exactly what each macro expands to before publishing the record, and understand the per-IP and per-sender authorisation patterns most receivers never document. - [DKIM Record Checker](https://dmarcguard.io/tools/dkim-checker/): Free DKIM checker — look up your DKIM record by selector, validate the public key against RFC 8301, and check the signing algorithm. Instant results, no signup. - [DKIM Record Generator](https://dmarcguard.io/tools/dkim-generator/): Generate DKIM key pairs (RSA or Ed25519) and DNS TXT records entirely in your browser. Your private key never leaves your device. - [DKIM CNAME Validator](https://dmarcguard.io/tools/dkim-cname-validator/): Most ESPs publish DKIM keys via CNAME so they can rotate keys server-side. This tool walks the CNAME chain (loop-safe), resolves the terminal TXT, and validates the DKIM key against RFC 8301 — flagging dangling aliases, weak keys, and missing terminals. - [ARC Checker](https://dmarcguard.io/tools/arc-checker/): Check your domain's ARC readiness — DMARC enforcement, mail provider capabilities, and DKIM key availability at common ARC selectors. - [ARC Chain Analyzer](https://dmarcguard.io/tools/arc-chain-analyzer/): Parse and visualize Authenticated Received Chain (ARC) headers per RFC 8617. Validate chain integrity, inspect each hop, and diagnose forwarding issues. Transport Security (8 tools): - [TLS-RPT Record Checker](https://dmarcguard.io/tools/tls-rpt-checker/): Validate your TLS-RPT DNS record, check report destinations, and verify MTA-STS integration per RFC 8460. - [TLS-RPT Record Generator](https://dmarcguard.io/tools/tls-rpt-generator/): Generate a valid TLS-RPT DNS record with mailto and HTTPS report destinations per RFC 8460. - [TLS-RPT Report Analyzer](https://dmarcguard.io/tools/tls-report-analyzer/): Upload and analyze TLS-RPT JSON reports in your browser. Visualize TLS negotiation successes, failures, and policy compliance — no data leaves your device. - [MTA-STS Policy Checker](https://dmarcguard.io/tools/mta-sts-checker/): Validate your MTA-STS DNS record, fetch the policy file, and verify MX record alignment per RFC 8461. - [MTA-STS Policy Generator](https://dmarcguard.io/tools/mta-sts-generator/): Generate the DNS TXT record and policy file needed to deploy MTA-STS (RFC 8461). MX records are auto-populated from DNS. - [DANE/TLSA Record Checker](https://dmarcguard.io/tools/dane-checker/): Look up TLSA records, verify DNSSEC status, and validate DANE configuration for your mail server per RFC 6698 and RFC 7672. - [DANE/TLSA Record Generator](https://dmarcguard.io/tools/dane-generator/): Generate DANE TLSA records for your mail server. SHA-256/SHA-512 hashing with optional PEM parsing — all in your browser. - [CSP Validator](https://dmarcguard.io/tools/csp-validator/): Paste a Content-Security-Policy header and get a security grade, the exact weaknesses ranked by severity, and a paste-ready fix for each — plus a strict-policy generator and formatter. Everything runs in your browser. Brand & Reporting (7 tools): - [BIMI Record Checker](https://dmarcguard.io/tools/bimi-checker/): Verify your BIMI record, check SVG logo compliance, VMC authority, and DMARC enforcement prerequisites. - [BIMI Record Generator](https://dmarcguard.io/tools/bimi-generator/): Generate a valid BIMI DNS record with SVG logo URL and optional VMC certificate. All configuration stays in your browser. - [ARF / Forensic Report Checker](https://dmarcguard.io/tools/arf-checker/): Validate your DMARC forensic reporting — check ruf= destinations, external authorization, failure options, and provider compatibility. - [ARF Report Analyzer](https://dmarcguard.io/tools/arf-report-analyzer/): Parse ARF feedback reports (RFC 5965). Upload or paste an ARF email to extract feedback type, source IP, domain, and auth results — in your browser. - [APRF Record Checker](https://dmarcguard.io/tools/aprf-checker/): Check the APRF record mailbox providers find for your DKIM signing domain: which of the three record names answers, whether rua and sdi are valid, and whether every external report address is authorized. - [APRF Record Generator](https://dmarcguard.io/tools/aprf-generator/): Build the APRF TXT record that asks mailbox providers for daily inbox placement reports: pick every selector or one, add report addresses and an optional SDI header, and get the authorization record any external address needs. - [APRF Report Analyzer](https://dmarcguard.io/tools/aprf-report-analyzer/): Paste or upload an APRF performance report and read it: who sent it, which DKIM domain and selector it covers, and the inbox, unwanted and engagement counts for every segment, exactly as the mailbox provider reported them. Nothing leaves your browser. Compliance (11 tools): - [NIS2 Email Authentication Readiness Scorecard](https://dmarcguard.io/tools/nis2-readiness/): EU equivalent: check the same posture against NIS2 Article 21. - [BSI NIS2 E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/bsi-nis2/): Same scorecard, German auditor language, BSI-Grundschutz mapping. - [NIS2 Supplier Email-Auth Questionnaire](https://dmarcguard.io/tools/nis2-supplier-questionnaire/): Paste or upload a supplier list and get a NIS2 §21(2)(d) supply-chain readiness report in seconds. Each supplier's DMARC, SPF, and MTA-STS posture is scored and the gaps named in auditor language. Downloadable as CSV evidence. - [DORA ICT Email Control Mapper](https://dmarcguard.io/tools/dora-compliance/): Map your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture to DORA Articles 9, 10, and 11. Built for EU financial entities preparing for supervisor reviews under Regulation (EU) 2022/2554. - [DORA E-Mail-Sicherheitscheck](https://dmarcguard.io/tools/dora-de/): Für Finanzunternehmen: DORA Art. 9-11 statt NIS2-Allgemein. - [PCI DSS 4.0.1 § 5.4.1 Anti-Phishing Checker](https://dmarcguard.io/tools/pci-anti-phishing/): Requirement 5.4.1 has been mandatory since March 31, 2025. Check your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture against the QSA-facing rubric for PCI's anti-phishing automated mechanism. - [HIPAA Email Authentication Readiness](https://dmarcguard.io/tools/hipaa-email-readiness/): Check your domain against the HIPAA 164.312 Technical Safeguards: the email-authentication controls covered entities and business associates need before an OCR audit. - [Microsoft 550 5.7.515 Bulk Sender Diagnostic](https://dmarcguard.io/tools/microsoft-550-diagnostic/): Outlook routes non-compliant bulk-sender mail to Junk since 5 May 2025, and 550 5.7.515 rejections are documented for DMARC failures. Diagnose your domain against Microsoft's high-volume sender requirements and get the exact DNS records to publish. - [Gmail & Yahoo Bulk-Sender Readiness](https://dmarcguard.io/tools/gmail-yahoo-bulk-sender/): Same DNS posture, different inbox provider requirements. - [NCSC Mail Check Migration Tool](https://dmarcguard.io/tools/ncsc-mail-check-migration/): UK equivalent against the retired NCSC Mail Check MCSS B3 baseline. - [p=none Escape Plan — 4-Week DMARC Migration Wizard](https://dmarcguard.io/tools/pnone-escape-plan/): Stuck at p=none? Enter your domain to get a personalised four-week plan that walks you from monitoring to p=quarantine to p=reject — with the exact DNS record at every step and the criteria for advancing. General Lookups (10 tools): - [Domain Email Health Check](https://dmarcguard.io/tools/domain-health-check/): Run a comprehensive email authentication audit across all protocols. Get a weighted security score and actionable recommendations -- entirely from your browser. - [Email Header Analyzer](https://dmarcguard.io/tools/email-header-analyzer/): Free email header analyzer — paste raw headers to decode SPF, DKIM, and DMARC results, trace the delivery path, and check sender alignment, entirely in your browser. - [DNS Record Lookup](https://dmarcguard.io/tools/dns-lookup/): Query any DNS record type for any domain — A, AAAA, MX, TXT, NS, CNAME, and more. Client-side queries via Cloudflare's edge network. No signup required. - [MX Record Lookup](https://dmarcguard.io/tools/mx-lookup/): Free MX record lookup. Check any domain's mail servers, priority, and routing in your browser via Cloudflare DNS-over-HTTPS. No signup, instant results. - [CNAME Record Lookup](https://dmarcguard.io/tools/cname-lookup/): Free CNAME record lookup tool. Verify canonical names, alias targets, and DNS configuration in your browser via Cloudflare DoH. No signup, no ads. - [TXT Record Lookup](https://dmarcguard.io/tools/txt-lookup/): Free TXT record lookup tool. Verify SPF, DKIM, DMARC, domain ownership, and verification tokens in your browser via Cloudflare DoH. No signup. - [Reverse DNS Lookup](https://dmarcguard.io/tools/reverse-dns-lookup/): Free reverse DNS / PTR lookup tool. Resolve any IPv4 or IPv6 address back to its hostname in your browser via Cloudflare DoH. No signup, no ads. - [WHOIS Domain Lookup](https://dmarcguard.io/tools/whois-lookup/): Look up domain registration details via RDAP — registrar, dates, nameservers, and DNSSEC status. All queries run in your browser. - [Blacklist Check](https://dmarcguard.io/tools/blacklist-check/): Check if an IP address or domain is listed on major DNS blacklists. All queries run in your browser via DNS over HTTPS. - [Open Relay Tester](https://dmarcguard.io/tools/open-relay-tester/): A real open-relay test requires an SMTP probe — which browsers cannot perform. This tool runs the DNS-side posture check (MX, A/AAAA, PTR, FCrDNS, ISP-host heuristics) and renders the exact telnet sequence you run yourself to complete the SMTP-level verification. Full list at [/tools/](https://dmarcguard.io/tools/). ## Comparisons Vendor comparisons: - [DMARCguard vs Valimail](https://dmarcguard.io/compare/valimail/): Valimail publishes no price for any Enforce tier: Starter, Premium and Enterprise all read "Contact us for custom pricing", and the pricing page no longer lists Align. Valimail remains the enterprise DMARC leader; DMARCguard delivers broader protocol coverage including ARC and DANE at per-domain pricing, with full data portability and no DNS delegation lock-in. - [DMARCguard vs EasyDMARC](https://dmarcguard.io/compare/easydmarc/): EasyDMARC pricing starts at $44.99/mo for the 2-domain Plus plan, and its pricing page no longer lists a free plan, only a free trial. DMARCguard offers simpler pricing and broader protocol coverage — 7 protocols free, all 9 from Pro. - [DMARCguard vs dmarcian](https://dmarcguard.io/compare/dmarcian/): dmarcian pricing runs $24–$600/mo across volume-metered tiers with hard domain caps — and the Basic→Plus step is a 10x jump ($24→$240/mo). DMARCguard covers 9 protocols with transparent per-domain pricing that scales continuously. - [DMARCguard vs PowerDMARC](https://dmarcguard.io/compare/powerdmarc/): PowerDMARC pricing scales $8–$250/mo on the Basic plan by email volume, with Enterprise quote-only. DMARCguard matches its broad protocol coverage while adding ARC chain validation, single-pane multi-tenant management, and automatic sender identification. - [DMARCguard vs MXToolbox](https://dmarcguard.io/compare/mxtoolbox/): Looking for an MXToolbox alternative for continuous DMARC monitoring? MXToolbox built the internet's favorite free DNS toolbox, but Delivery Center costs $129/mo for 5 domains, caps DMARC history at 90 days, and its Plus tier is $399/mo. DMARCguard monitors 9 protocols with published per-domain pricing. - [DMARCguard vs Proofpoint](https://dmarcguard.io/compare/proofpoint/): Proofpoint Email Fraud Defense pairs hosted DMARC with genuinely unmatched threat intelligence — at enterprise prices published nowhere in USD. The only verifiable list prices are UK G-Cloud figures: £22,901/yr for a single sending domain. DMARCguard covers 9 protocols at a published per-domain price. - [DMARCguard vs Mimecast](https://dmarcguard.io/compare/mimecast/): Mimecast DMARC Analyzer 2.0 (January 2026) is a real upgrade — hosted SPF/DMARC/DKIM delegation and TLS-RPT reporting. But the price appears nowhere on mimecast.com, tiers by your domain's web-traffic profile, and renewals carry a contractual uplift. DMARCguard publishes one per-domain price. - [DMARCguard vs Barracuda](https://dmarcguard.io/compare/barracuda/): Barracuda folds DMARC reporting into its Email Protection bundles — priced per mailbox with 25-seat reseller minimums, guided setup but no automated enforcement, and five protocols missing entirely. DMARCguard prices per domain and monitors all 9 protocols. - [DMARCguard vs Red Sift](https://dmarcguard.io/compare/redsift/): Red Sift OnDMARC is a genuinely strong platform: Dynamic SPF, in-app VMC issuance, and support quality G2 reviewers consistently praise. But only one tier has a public price, aggregators still show conflicting older figures, and DANE sits outside the product. DMARCguard publishes one per-domain price and monitors the full stack. - [DMARCguard vs Sendmarc](https://dmarcguard.io/compare/sendmarc/): Searching for Sendmarc pricing turns up no published number: every paid tier is quote-only, the domain is the pricing unit, and no rate card exists anywhere. Sendmarc pairs hands-on onboarding with a mature MSP channel, and G2 reviewers reward that with a 4.9 average. DMARCguard puts the number first. - [DMARCguard vs Suped](https://dmarcguard.io/compare/suped/): Suped is the newest entrant in the DMARC space — launched mid-2025, transparently priced, and well-liked by its early reviewers. Its surface is DMARC, SPF, and DKIM monitoring plus hosted DMARC, SPF, and MTA-STS; BIMI, TLS-RPT, ARC, DANE, and ARF are absent. DMARCguard monitors all nine protocols. - [DMARCguard vs Skysnag](https://dmarcguard.io/compare/skysnag/): Skysnag pricing starts at $39/mo for Comply, and its autonomous enforcement is real - its reviewers confirm hands-off operation - but that automation starts at the $249/mo Protect tier. DMARCguard publishes per-domain pricing, with guided enforcement included in Pro. - [DMARCguard vs URIports](https://dmarcguard.io/compare/uriports/): URIports is the price-transparency leader in this category: five published terrain-named tiers from $1.25/mo plus a quote-only Enterprise plan, quotas counted in reports received, and processing that simply halts at quota instead of surprise-billing you. The trade-offs are a 90-day history ceiling, monitoring without hosted SPF or DMARC, and no SLA or certifications. DMARCguard picks up where monitoring stops. - [DMARCguard vs DMARCLY](https://dmarcguard.io/compare/dmarcly/): DMARCLY publishes flat, genuinely low prices — $17.99/mo entry and a 200-domain Enterprise tier at a flat $199/mo. The trade-offs sit elsewhere: 2 months of history on the entry tier, no free plan, email-only alerting, and an API locked to the top tier. DMARCguard pairs a published per-domain price with 1 year of history on Pro. - [DMARCguard vs DMARC Report](https://dmarcguard.io/compare/dmarcreport/): DMARC Report pricing runs from a free Core tier to $3,900/mo Ultimate, and it is the most-reviewed DMARC product on G2 — 4.8/5 across 471 reviews — with a mature REST API and SOC 2 Type II. The evaluation questions are the 5/10/25 domain caps on paid tiers, and which protocol unlocks at which tier. Here is the full map. - [DMARCguard vs Mailhardener](https://dmarcguard.io/compare/mailhardener/): Mailhardener earns real respect: EUR-native flat pricing, DANE and hosted MTA-STS depth most vendors skip, and SSO with 2FA on every tier — Free included. What it leaves out, by design, is the layer after detection: guided remediation, blocklist monitoring, webhook alerting, and an entry-tier API. That layer is the comparison. - [DMARCguard vs Fraudmarc](https://dmarcguard.io/compare/fraudmarc/): Fraudmarc pairs hosted DMARC report analysis with deep, dedicated SPF flattening - two productized lines, one SLA-backed - plus an Apache-2.0 Community Edition you can run in your own AWS. The trade-off is scope: DMARC and SPF are the whole product, where DMARCguard productizes nine protocols under one published per-domain price. - [DMARCguard vs DMARC Advisor](https://dmarcguard.io/compare/dmarcadvisor/): DMARC Advisor is a genuinely EU-operated platform: a Dutch entity since 2013, EU data hosting, and hands-on support in four languages. Two structural facts shape any 2026 evaluation: the legacy DMARC Advisor Platform retires on June 30, 2026 in favor of the company's new DMARC Manager platform, and a court-ordered geofence limits service to Europe and Africa. Here is the factual comparison. Head-to-head comparisons, compared on published pricing and features: - [PowerDMARC vs Valimail: 2026 Pricing Compared](https://dmarcguard.io/compare/powerdmarc-vs-valimail/): PowerDMARC publishes $8–$250/mo volume pricing; Valimail Enforce is quote-only, no public price. Features, free tiers and pricing compared. - [EasyDMARC vs PowerDMARC: Which Fits in 2026?](https://dmarcguard.io/compare/easydmarc-vs-powerdmarc/): EasyDMARC Plus starts at $44.99/mo with 2 domains; PowerDMARC Basic scales $8–$250/mo with 5. Features, free options and pricing compared. - [dmarcian vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/dmarcian-vs-easydmarc/): dmarcian Basic is $24/mo, metering legitimate mail only; EasyDMARC Plus is $44.99/mo with managed hosting. Features and pricing compared. - [dmarcian vs Valimail: Published vs Quote-Only](https://dmarcguard.io/compare/dmarcian-vs-valimail/): dmarcian publishes $24–$600/mo tiers; Valimail Enforce is quote-only with no public price. Automation, features and free tiers compared. - [PowerDMARC vs dmarcian: 2026 Comparison](https://dmarcguard.io/compare/powerdmarc-vs-dmarcian/): PowerDMARC hosts your records with plans from $8–$250/mo; dmarcian is reporting-first from $24/mo, metering legitimate mail only. Compared with sources. - [Valimail vs EasyDMARC: 2026 Comparison](https://dmarcguard.io/compare/valimail-vs-easydmarc/): EasyDMARC publishes $44.99–$89.99/mo plans; Valimail Enforce is quote-only with no public price. Automation, free tiers and features compared. - [DMARC Report vs Valimail: The Affordable Alternative?](https://dmarcguard.io/compare/dmarcreport-vs-valimail/): DMARC Report publishes plans from $25/mo; Valimail Enforce is quote-only with no public price. Pricing, free tiers and features compared. - [DMARCLY vs dmarcian: 2026 Pricing Compared](https://dmarcguard.io/compare/dmarcly-vs-dmarcian/): DMARCLY publishes flat tiers from $17.99/mo; dmarcian meters legitimate mail from $24/mo with a 10x Basic-to-Plus jump. Pricing and features compared. - [MXToolbox vs dmarcian: DMARC Compared (2026)](https://dmarcguard.io/compare/mxtoolbox-vs-dmarcian/): MXToolbox Delivery Center runs $129–$399/mo with a 90-day DMARC history cap; dmarcian publishes $24–$600/mo tiers. Features and pricing compared. ## Research - [State of Email Authentication 2026](https://dmarcguard.io/research/email-authentication/): 7 in 10 domains have no DMARC protection — largest email security study with 5.5 million domains - [SPF Supply Chain 2026: Email Sender Market Share](https://dmarcguard.io/research/spf-supply-chain/): Microsoft 365 and Google Workspace appear in 33% of all SPF records — first-ever email sender market share by SPF include ## Blog 51 guides on DMARC, SPF, DKIM, and email authentication troubleshooting, newest first. Every post also has a markdown twin at the same path (e.g. `/blog/.md`). - [Content Security Policy Examples by Stack](https://dmarcguard.io/blog/csp-header-examples/): Content Security Policy examples for nginx, Cloudflare, and Next.js — plus the add_header trap that silently drops your header. Grade yours free. - [DMARC rua Tag: Are Reports Reaching You?](https://dmarcguard.io/blog/dmarc-rua-collection/): The DMARC rua tag decides whether you get aggregate reports at all. Where to point it, the _report._dmarc record, and why reports stop. Check yours free. - [How to Decode Email Headers: Read the ARC Set](https://dmarcguard.io/blog/read-email-headers/): Decode email headers line by line: trace the Received chain, find your trust boundary, and read the ARC set. Walk one real dump, then analyze yours. - [Free vs Paid DMARC Monitoring: When Each Makes Sense](https://dmarcguard.io/blog/free-vs-paid-dmarc-monitoring/): Free DMARC monitoring is often enough — and sometimes it isn't. Real free-tier caps, real paid prices, contract fine print, and a decision table to pick well. - [BIMI DMARC Requirements: The Policy Your Logo Needs](https://dmarcguard.io/blog/bimi-dmarc-requirements/): BIMI requires DMARC at enforcement: p=quarantine or reject, pct=100, sp not none. See the exact requirements and fix bimi=skipped insufficient dmarc. - [DMARC Aggregate Report: Anatomy, Senders, RFC 9990](https://dmarcguard.io/blog/dmarc-aggregate-report/): What a DMARC aggregate report is, who sends the XML and how often, an annotated sample file, and what RFC 9990 changed. Analyze yours free. - [TLSA Mismatch: Debug a DANE 3 1 1 Failure with OpenSSL](https://dmarcguard.io/blog/tlsa-mismatch-troubleshooting/): A DANE TLSA 3 1 1 mismatch means the published hash no longer matches the served key. Compute the hash with OpenSSL, isolate the root cause, and fix it fast. - [Google Workspace SPF Record: What Docs Don't Tell You](https://dmarcguard.io/blog/google-workspace-spf-record/): The exact Google Workspace SPF record to publish, third-party sender combos, the DNS lookup math, and ~all vs -all under RFC 7208. - [DNS Authentication DMARC Fail: The Mimecast Fix](https://dmarcguard.io/blog/dmarc-fail-mimecast-fix/): "DNS Authentication: DMARC Fail" is Mimecast's inbound hold verdict. Decode the string, read the headers, and fix it as admin or sender. - [Best DMARC Reporting Tools in 2026: 9 Compared by Depth](https://dmarcguard.io/blog/best-dmarc-reporting-tools/): Compare 9 DMARC reporting tools on RUF parsing, source naming, retention, and export — with dated, source-linked pricing. Find the depth your rollout needs. - [Fix "MTA-STS Policy Is Missing: STSFetchResult.NONE"](https://dmarcguard.io/blog/mta-sts-policy-missing-fix/): Seeing "MTA-STS policy is missing: STSFetchResult.NONE"? Diagnose it in 3 stages — DNS TXT record, HTTPS policy fetch, TLS cert — with copy-paste commands. - [SPF Record Syntax Guide: RFC 7208 Rules & Macros](https://dmarcguard.io/blog/spf-record-syntax/): Every SPF record syntax element in one place — mechanisms, qualifiers, modifiers, and macros — with RFC 7208 section cites and real record examples. - [TLSA Record Setup: Generate & Fix the 3 1 1 Hash](https://dmarcguard.io/blog/tlsa-record-setup/): Generate a TLSA record with OpenSSL, publish it, then fix the common DANE 3 1 1 mismatch. Copy-paste commands plus a free TLSA record checker. Step by step. - [DMARC Subdomain Policy: sp= and np= Explained](https://dmarcguard.io/blog/dmarc-subdomain-policy/): DMARC subdomain policy sets how subdomains inherit p=, sp=, and np=. See the DMARCbis tree walk, sp= vs np=, and how to stop non-existent-subdomain spoofing. - [PCI DSS DMARC Requirement: What 5.4.1 Actually Says](https://dmarcguard.io/blog/pci-dss/): PCI DSS v4.0.1 Section 5.4.1 mandates anti-phishing controls — and names DMARC, SPF, and DKIM as examples, not requirements. See what your auditors expect. - [Best Free DMARC Tools in 2026: Checkers & Analyzers](https://dmarcguard.io/blog/best-free-dmarc-tools/): Compare every genuinely free DMARC tool: no-signup checkers, free DMARC analyzers, and free monitoring tiers, with real limits and when to upgrade. - [Valimail Alternative: Transparent Pricing, No Demo Gate](https://dmarcguard.io/blog/valimail-alternative/): Looking for a Valimail alternative? Compare transparent per-domain pricing, self-serve signup with no demo gate, and 9-protocol DMARC coverage. Check free. - [PowerDMARC Alternative: Experience Over Feature Count](https://dmarcguard.io/blog/powerdmarc-alternative/): Weighing a PowerDMARC alternative? Compare real pricing ($8–$250/mo), protocol coverage, honest reviews, and a zero-gap migration path before you switch. - [How to Set Up DKIM: Selectors, Keys & Records (2026)](https://dmarcguard.io/blog/dkim-setup-guide/): Set up DKIM the right way: how signing works, choosing 2048-bit keys, finding your selector, and publishing the record. A 2026 guide — check yours free. - [How to Set Up BIMI (and Why 28% of Records Break)](https://dmarcguard.io/blog/bimi-record-setup/): BIMI puts your logo in the inbox — but 28% of records break. Here's how to set up BIMI: the DNS TXT record, SVG Tiny PS logo, and VMC vs CMC. Check yours free. - [Email Provider Market Share 2026: Who Sends the Mail](https://dmarcguard.io/blog/email-provider-market-share/): Microsoft 365 = 19.6%, Google Workspace = 13.6% of 3.08M SPF-enabled domains (DMARCguard scan, Mar 2026). The 2026 email provider market share, sourced. - [DORA Compliance for Email: Map DMARC to Art. 9-11](https://dmarcguard.io/blog/dora-email-authentication/): DORA compliance for email, mapped to Articles 9, 10 and 11. How DMARC, SPF, MTA-STS and TLS-RPT meet the regulation's data-in-transit duties. - [MTA-STS vs DANE: Verdict by Scenario (2026 Data)](https://dmarcguard.io/blog/mta-sts-vs-dane/): Only 0.3% of 5.5M domains publish MTA-STS; 0.0% publish DANE. Get the per-scenario verdict, RFC 8461 vs 7672, Microsoft's connector modes, and NIS2 fit. - [Email Deliverability Monitoring: 7 Signals to Track](https://dmarcguard.io/blog/email-deliverability-monitoring/): Email deliverability monitoring: the protocol signals that predict spam-folder placement, the metrics to track, and the tools that surface each one. - [Does HIPAA Require DMARC? §164.312 Email Auth Mapping \[2026\]](https://dmarcguard.io/blog/hipaa-email-authentication/): Does HIPAA require DMARC? Not by name. How §164.312 technical safeguards map to DMARC, SPF, DKIM, MTA-STS, TLS-RPT — plus the Dec 2024 NPRM. - [How to Create a DMARC Record: Tags, Examples & Setup](https://dmarcguard.io/blog/how-to-create-dmarc-record/): How to create a DMARC record step by step — tags, syntax, real examples, and the p=none → p=reject rollout. Verify it with a free DMARC checker. - [DMARC Adoption Rate 2026: The 12.8% Enforcement Gap](https://dmarcguard.io/blog/dmarc-enforcement-gap/): 30.4% of 5.5 million domains have DMARC; only 12.8% enforce p=quarantine or p=reject. The 2026 enforcement gap, with sources. Run a free check. - [DMARC for Google Workspace: Step-by-Step Setup \[2026\]](https://dmarcguard.io/blog/dmarc-google-workspace-setup/): Set up DMARC for Google Workspace step-by-step: the exact TXT record, where to publish it, and the p=none to reject rollout. 2026 guide. - [Why Are My Emails Going to Spam? Authentication-First Fix](https://dmarcguard.io/blog/emails-going-to-spam/): Emails landing in spam? 40.8% of 5.5M scanned domains have no email authentication. Use this authentication-first checklist to get back in the inbox. - [NIS2 Email Security: Article 21 → DMARC, MTA-STS, DANE](https://dmarcguard.io/blog/nis2-email-security/): NIS2 compliance: map Article 21(2) to email auth — DMARC, SPF, MTA-STS, DANE, TLS-RPT. The control map, copy-paste DNS checks, and a 2026 readiness plan. - [RFC 9989 DMARC: What Changed From RFC 7489](https://dmarcguard.io/blog/dmarc-rfc-9989-9990-9991/): RFC 9989 replaces RFC 7489 as DMARC's Standards-Track spec (May 2026). What changed: the RFC 9990 aggregate / 9991 failure split, tree walk, pct removed. - [Best DMARC Monitoring Tools in 2026: 6 Compared](https://dmarcguard.io/blog/best-dmarc-monitoring-tools/): Honest comparison of 6 DMARC monitoring tools in 2026: protocol coverage, pricing, free-tier limits, MSP fit. Pick the right one. - [Best dmarcian Alternatives in 2026: Pricing & Protocols](https://dmarcguard.io/blog/dmarcian-alternative/): Comparing the best dmarcian alternatives in 2026. Protocol coverage, pricing, free tiers, switcher quotes, and a step-by-step migration guide. - [How to Read a DMARC Aggregate Report (XML Made Simple)](https://dmarcguard.io/blog/how-to-read-dmarc-report/): Read DMARC aggregate reports field by field. Annotated XML, Google vs Microsoft variants, and a live drawer demo. Free analyzer inside. - [MTA-STS Example: Working Policy File & DNS Record \[2026\]](https://dmarcguard.io/blog/mta-sts-example/): Copy-paste a working MTA-STS DNS record and policy file. RFC 8461 examples for Google Workspace, Microsoft 365, and Postfix, plus mode progression. - [DMARC for MSPs: The Independent Operator's Guide (2026)](https://dmarcguard.io/blog/dmarc-for-msps/): Vendor-neutral DMARC guide for MSPs: wholesale pricing, multi-tenant ops, PSA integrations, and ROI math — without the partner-program pitch. - [TLS-RPT Reports: SMTP TLS Reporting Explained (RFC 8460)](https://dmarcguard.io/blog/tls-rpt-report/): TLS-RPT reports tell you when SMTP TLS fails between mail servers. See an annotated RFC 8460 JSON example, every result type, and how to set it up. - [What Is ARF in Email? Abuse Reporting Format](https://dmarcguard.io/blog/what-is-arf/): ARF (Abuse Reporting Format, RFC 5965) is the standard for DMARC forensic reports and email feedback loops. Annotated sample inside. - [DKIM2 Explained: The 2026 Successor to ARC and DKIM](https://dmarcguard.io/blog/arc-to-dkim2-future/): DKIM2 is the IETF's per-hop chained-signature successor to ARC and DKIM. Eight active drafts, six contested questions, and what admins track in 2026. - [ARC Email Authentication: Forwarded Mail in 2026](https://dmarcguard.io/blog/arc-email-authentication/): ARC email authentication carries SPF, DKIM, and DMARC verdicts across forwarding hops. Real headers, cv=fail debugging, trusted-sealer fixes, IETF status. - [Does Outlook Require DMARC? Yes, Since May 2025](https://dmarcguard.io/blog/microsoft-dmarc-enforcement/): Yes — Microsoft has required DMARC for Outlook senders since May 5, 2025. Set up DMARC for Microsoft 365 step by step with DNS examples. - [Google, Yahoo & Microsoft DMARC Requirements](https://dmarcguard.io/blog/google-yahoo-dmarc-requirements/): Google, Yahoo, and Microsoft now require DMARC for bulk senders — including Gmail's 2025 SMTP rejection escalation. See the full compliance checklist. - [DMARC Fails on Forwarded Emails: Why ARC Is the Fix](https://dmarcguard.io/blog/dmarc-forwarding-arc-fix/): Forwarded emails fail DMARC because SPF breaks in transit. See why, when DKIM survives, and how ARC seals the chain across every forwarding hop. - [MXToolbox Alternatives: Free DMARC Tools Compared (2026)](https://dmarcguard.io/blog/mxtoolbox-alternative/): MXToolbox SuperTool covers lookups but stops at DMARC monitoring. Compare free alternatives — DMARCguard, EasyDMARC, dmarcian, PowerDMARC — on pricing. - [SPF Flattening: Fix Too Many DNS Lookups (2026)](https://dmarcguard.io/blog/spf-too-many-dns-lookups/): 148,655 domains exceed the SPF 10-lookup limit. Learn what SPF flattening is, when to use it, 4 safer alternatives, and step-by-step fixes. Check free. - [SPF Softfail vs Hardfail: Which to Use?](https://dmarcguard.io/blog/spf-softfail-vs-hardfail/): 53.6% of domains use SPF softfail, 40.2% use hardfail. Learn how each qualifier works, how DMARC changes the equation, and which to choose. Check your SPF free. - [SPF PermError: How to Find and Fix It (2026 Guide)](https://dmarcguard.io/blog/spf-permerror-fix/): SPF PermError breaks DMARC alignment and kills deliverability. Learn the 5 causes, step-by-step fixes, and platform-specific examples. Check your SPF free. - [DKIM Fail: How to Fix Alignment and Verification Errors](https://dmarcguard.io/blog/dkim-alignment-failure-fix/): DKIM failing? Learn why DKIM alignment breaks, how to fix body hash errors, and how to configure third-party senders. Step-by-step guide with CLI commands. - [DMARC Quarantine/Reject Policy Not Enabled: Fix It](https://dmarcguard.io/blog/dmarc-policy-not-enabled-fix/): See 'DMARC quarantine/reject policy not enabled'? Learn what it means and how to fix it step by step for any DNS provider. Free checker included. - [EasyDMARC Alternatives: Why Teams Switch in 2026](https://dmarcguard.io/blog/easydmarc-alternative/): EasyDMARC's Plus plan runs $44.99/mo, with TLS-RPT and MTA-STS gated to Premium. Compare alternatives on pricing, protocols, and free tiers. - [DMARC Fail: 7 Causes & How to Fix Each (2026 Guide)](https://dmarcguard.io/blog/dmarc-failed-how-to-fix/): DMARC failed? Fix it fast: 7 causes (SPF/DKIM misalignment, third-party senders, forwarding) with diagnose steps, fixes, and a free DMARC checker. ## About - [About DMARCguard](https://dmarcguard.io/about/): Why DMARCguard exists -- our beliefs on RFC correctness, actionable insights, and email auth tools that tell you what to do. - [Meysam Azad, Founder & Engineer](https://dmarcguard.io/authors/meysam-azad/): Meysam Azad is the founder and engineer of DMARCguard. He started the open-source parse-dmarc tool, then built the email-authentication platform that grew out of it. ## Optional - [RSS Feed](https://dmarcguard.io/rss.xml) - [Privacy Policy](https://dmarcguard.io/privacy/) - [Terms of Service](https://dmarcguard.io/terms/) - [Sub-processors](https://dmarcguard.io/subprocessors/)