# dmarcian

> dmarcian is an email authentication platform founded by Tim Draegen, the primary author of the DMARC specification, that ingests DMARC aggregate and failure reports, presents them as domain-by-domain sender analytics, and guides organizations through the deployment path from p=none to p=reject; it is an authentication monitoring product and does not warm mailboxes or test inbox placement.

- Category: Email Deliverability & Warming (https://saastracker.org/categories/email-deliverability)
- Website: https://dmarcian.com
- Starting price: $0 (Personal, non-business use), then $24 per month (Basic)
- Free plan: Personal covers up to two active domains, 1,250 DMARC-capable messages a month, and one month of data history, restricted to personal rather than business use.
- Free trial: 30 days on paid plans, no credit card required
- Founded: 2012, HQ: Brevard, North Carolina, United States, Ownership: Self-funded and privately held
- Profile last reviewed: 2026-08-22
- Canonical profile: https://saastracker.org/products/dmarcian

## Overview

dmarcian does the third job in this category: SPF, DKIM, and DMARC authentication monitoring. It does not touch inbox placement and it does not build sender reputation. Its function is to make visible the mail that claims to come from your domain, whether you sent it or not, and to turn that visibility into an enforced policy that stops other people sending as you.

The provenance matters more here than at most vendors. Tim Draegen was the primary author of the DMARC specification and founded dmarcian in 2012, years before the standard became a small business concern, and the company is self-funded rather than venture-backed. That shows up in the product as a bias toward correctness and education over slickness. The knowledge base is closer to a reference text than a marketing asset, and the platform is comfortable showing you the underlying mechanics rather than abstracting them away. A buyer who wants to genuinely understand what is happening to their email will learn more here than anywhere else in the category.

The pricing is where a small business has to think carefully. Basic at $24 a month covers two active domains, 100,000 DMARC-capable messages a month, three months of history, and one user, which is a good entry price and the plan most single-domain companies will sit on happily. The jump above that is steep: Plus at $240 a month for eight domains and a million messages, and Enterprise at $600 a month for fifteen domains. That structure targets organizations with real domain estates and budgets to match, and it means dmarcian is markedly more expensive than PowerDMARC, DMARCLY, or URIports at any domain count above two.

There is also a free Personal plan covering two domains and 1,250 messages a month, restricted to non-business use, and a thirty-day trial with no credit card on the paid plans. For a business with one sending domain and a genuine desire to get authentication right, the Basic plan plus dmarcian's documentation is one of the better deals in the field. For a business with a dozen domains, the arithmetic sends you elsewhere.

## How it works

1. You add a domain and dmarcian gives you a DMARC record to publish, with its reporting address in the rua tag. Publishing the record changes nothing about how your mail flows; it only asks receiving servers to send you reports on what they see.

2. Aggregate reports start arriving within a day or two from Google, Microsoft, Yahoo, and other receivers. dmarcian parses the XML and presents each sending source with its message volume and its SPF and DKIM alignment results, so you can see at a glance which of your vendors are configured correctly and which are not.

3. You then work the list. Legitimate senders get authorized in SPF and set up with DKIM signing at the vendor. Unrecognized sources get investigated, which is where organizations usually discover a marketing tool someone signed up for two years ago, or an outright spoofing operation.

4. As alignment approaches complete coverage of your legitimate mail, you tighten policy in steps: p=none for observation, p=quarantine with a rollout percentage, then p=reject. The platform's SPF and DKIM inspectors, BIMI inspector, and domain overview support each step, and higher tiers add forensic reporting and domain discovery for finding domains you forgot you owned.

## Best for

Organizations that want to deploy DMARC correctly rather than quickly, especially those with one or two sending domains, a person willing to learn the standard, and a preference for a self-funded specialist vendor over a venture-backed platform.

## Not the right fit for

- Anyone trying to fix cold email landing in spam; DMARC monitoring confirms authentication and says nothing about placement, and authenticated mail is filtered on reputation and content all the time.
- Buyers with more than two domains on a small budget; the jump from $24 to $240 a month is brutal, and DMARCLY or URIports will cover ten times the domains for less.
- Teams that want the vendor to do the work for them; dmarcian explains and instruments, but someone still has to configure DKIM at each sending vendor.
- Buyers who need API access or SSO at a modest price; both are Enterprise-tier features at $600 a month.
- People who want warming or reputation building; dmarcian has no such capability and never will, because it is not what the product is for.

## Features

### DMARC report analysis

The core: making the mail claiming to be from you visible and legible.

- **Aggregate report processing**: Parses rua reports from every receiver that sends them and renders per-source volume with SPF and DKIM alignment outcomes, in place of daily XML attachments.
- **Source categorization**: Groups sending infrastructure into recognizable services so you can tell your CRM from your invoicing platform from an unauthorized sender, rather than reading raw IP ranges.
- **Forensic reporting**: Per-message failure detail on the Plus and Enterprise tiers, useful for isolating a single misconfigured sender. Coverage is limited by the fact that most large receivers do not send failure reports.
- **Alignment diagnosis**: Separates SPF authentication from SPF alignment and DKIM signing from DKIM alignment, the distinctions that explain almost every confusing DMARC failure.
- **Data history by tier**: One month on Personal, three months on Basic, one year on Plus, and unlimited on Enterprise. Anything periodic in your sending needs at least three months to be visible.
- **Message volume allowances**: 1,250 DMARC-capable messages a month on Personal, 100,000 on Basic, one million on Plus, and five million on Enterprise, counting messages receivers reported rather than messages you sent.

### Record inspection and DNS tooling

Inspectors rather than hosted records: dmarcian shows you what is wrong and expects you to fix your own DNS.

- **SPF Surveyor**: Visualizes an SPF record as a tree of includes and lookups, which is how you find the ten DNS lookup overflow that silently breaks SPF on long-lived domains.
- **DKIM Inspector**: Checks published DKIM selectors and key validity so you can confirm a vendor's signing is actually working rather than assuming it from a setup wizard.
- **DMARC Inspector**: Validates the syntax and effect of a published DMARC record, including subdomain policy and percentage settings, before you rely on it.
- **BIMI Inspector**: Checks BIMI record validity for brands wanting a logo displayed in supporting inboxes. dmarcian does not host BIMI records for you, and most major providers additionally require a Verified Mark Certificate bought separately.
- **IP safelisting**: Enterprise-tier handling for known-good forwarding sources that break SPF but should not count against your compliance picture.
- **Domain discovery**: Enterprise-tier surfacing of domains associated with your organization that you may not have known were sending, which is the classic problem at any company older than a decade.

### Deployment to enforcement

The path to p=reject, treated as a project with stages rather than a switch.

- **Staged policy guidance**: Structured progression from p=none through p=quarantine with percentage rollout to p=reject, with alignment data as the evidence for readiness at each step.
- **Domain overview and status**: A per-domain view of current policy, compliance rate, and outstanding sources, which is the working list for a deployment project.
- **Subdomain tracking**: Handles subdomain sending separately, since a loose subdomain policy quietly undoes an enforced organizational one.
- **Deployment services**: dmarcian sells hands-on deployment help alongside the platform for organizations that want the project run rather than instrumented.

### Plans, access, and platform

Domains, users, and the features gated at the top.

- **Domain allowances**: Two active domains on Personal and Basic, eight on Plus, fifteen on Enterprise, and custom above that. Domain count, not features, is the main upgrade driver.
- **User seats**: One user on Basic, three on Plus, unlimited on Enterprise. A single-user cap is restrictive for any team where marketing and IT both need visibility.
- **API access**: Enterprise-only, so there is no supported automation path at a small business price.
- **SSO**: Also Enterprise-only, alongside IP safelisting and domain discovery.
- **Thirty-day trial**: No credit card required for a thirty-day trial of paid plans, which is longer than most competitors and long enough to see real report data.
- **Free Personal plan**: Two domains and 1,250 messages a month with one month of history, explicitly restricted to personal, non-business use.

## Use cases

- **IT generalist at a company that just failed a security review**: A customer's vendor questionnaire asked whether the domain enforces DMARC, and the honest answer was a p=none record published years ago and never revisited. Outcome: Basic at $24 a month collects reports, the sending source list is resolved over six weeks, and the domain reaches p=reject with a documented compliance history to show the next reviewer.
- **Consultant deploying DMARC for a client**: The client's SPF record has fourteen includes and nobody can say which vendors are still in use, and guessing risks breaking legitimate mail. Outcome: SPF Surveyor maps the record as a tree, aggregate reports show which includes are actually sending, and the record is rebuilt from evidence rather than from assumption.
- **Organization with a spoofing problem**: Customers are receiving invoice fraud emails that appear to come from the company's domain, and the company has no way to see the scale of it. Outcome: Reports quantify the spoofed volume by source, which is the evidence needed to justify enforcement internally, and p=reject stops the impersonated mail reaching recipients at DMARC-honoring receivers.
- **Marketer setting up BIMI**: The brand wants its logo displayed in supporting inboxes, which requires DMARC enforcement as a precondition. Outcome: dmarcian drives the domain to p=reject and its BIMI Inspector validates the record, after which the brand buys a Verified Mark Certificate separately from a certificate authority.

## Pricing

Freemium subscription tiered by active domains, monthly DMARC-capable message volume, data history, and user seats, with a custom tier above Enterprise.

- **Personal**: $0 per month. Up to 2 active domains; 1,250 DMARC-capable messages per month; 1 month of data history; Core monitoring and inspector tools. Explicitly for personal, non-business use, and the message cap is low enough that a small company will exceed it quickly.
- **Basic**: $24 per month ($240 per year). Up to 2 active domains; 100,000 messages per month; 3 months of data history; 1 user; SPF, DKIM, DMARC, and BIMI inspectors. The small business tier and a strong entry price, undercut only by PowerDMARC and URIports on domains per dollar.
- **Plus**: $240 per month ($2,388 per year). Up to 8 active domains; 1,000,000 messages per month; 1 year of data history; 3 users; Forensic reporting. A tenfold price jump from Basic for four times the domains; this is where dmarcian stops competing on price.
- **Enterprise**: $600 per month ($5,988 per year). Up to 15 active domains; 5,000,000 messages per month; Unlimited data history and users; API access and SSO; IP safelisting and domain discovery.
- **Custom**: Quoted custom. Domain estates beyond 15; Tailored volumes and terms; Deployment services available.

Billing notes:

- Annual billing is a modest discount on Basic and a larger one on Plus and Enterprise, roughly the equivalent of one to two free months.
- The active domain count, not message volume, is what pushes most buyers up a tier, and the Basic-to-Plus jump from $24 to $240 is the steepest step in the self-serve DMARC field.
- Message volume counts DMARC-capable messages that receivers reported on, which includes vendor mail sent on your behalf and mail spoofed by third parties, not just mail you deliberately sent.
- One user on Basic is a real constraint for teams; sharing a login is the usual workaround and is not a good one.
- API access and SSO are Enterprise features at $600 a month, so automation is not available at any small business price.
- Deployment services are sold separately for organizations that want the work done rather than instrumented.

Value assessment: Basic at $24 a month for two domains, 100,000 messages, and three months of history is fair value and comes with the best documentation in the category. Everything above Basic is expensive: $240 for eight domains is ten times DMARCLY's price for fifteen, and $600 for fifteen domains is hard to justify against URIports covering a hundred at $120. What you are paying the premium for is depth, provenance, and a self-funded vendor that has been doing only this since 2012, which is worth something to an organization treating DMARC as a security project rather than a compliance checkbox. For a one-domain small business, Basic is a good buy. Above two domains, price it against the field before committing.

## Strengths

- Founded by Tim Draegen, the primary author of the DMARC specification, which shows up as unusual rigor in how the platform explains authentication mechanics.
- Self-funded rather than venture-backed, with no pressure to pivot the product away from the standard it was built around.
- The SPF Surveyor, DKIM Inspector, DMARC Inspector, and BIMI Inspector are genuinely useful diagnostic tools, and the SPF tree view is the clearest way to find a ten-lookup overflow.
- Documentation and educational material closer to a reference text than marketing copy, which materially reduces the chance a first deployment stalls.
- A thirty-day trial with no credit card, long enough to collect real report data before deciding.
- Basic at $24 a month is a sensible entry price for a single-domain business.
- Deployment services available for organizations that want the project run rather than instrumented.

## Limitations

- The Basic-to-Plus price jump from $24 to $240 a month is severe, and eight domains at $240 is poor value against DMARCLY's fifteen at $69 or URIports' twenty-five at $30.
- One user on Basic makes the entry tier awkward for any team where more than one person needs visibility.
- No hosted SPF, DKIM, DMARC, or BIMI records; dmarcian inspects and diagnoses but expects you to manage your own DNS, which is harder when DNS access sits with an outsourced IT provider.
- API access and SSO are Enterprise-only at $600 a month.
- No inbox placement testing at all, so it cannot tell you whether mail landed in the inbox, promotions, or spam.
- No warming capability, so a new sending domain still needs a separate tool before carrying volume.
- Forensic reporting on Plus and Enterprise is constrained by receivers, since most large mailbox providers do not send failure reports regardless of what any vendor supports.

## Comparisons

- **dmarcian vs EasyDMARC**: EasyDMARC is the friendlier product with better vendor naming and SPF flattening built in, but charges $35.99 a month for two domains against dmarcian's $24. dmarcian is the more authoritative and better documented, and its inspectors are stronger diagnostic tools. Take EasyDMARC if you want the shortest path with the most hand-holding; take dmarcian if you want to understand what you are doing and are happy to manage your own DNS.
- **dmarcian vs PowerDMARC**: PowerDMARC gives five domains and a year of history for roughly $12 to $15 a month and hosts your SPF, DKIM, DMARC, BIMI, and MTA-STS records, which dmarcian does not do at any tier. dmarcian offers deeper analysis and better education. Choose PowerDMARC on price and DNS convenience; choose dmarcian when correctness and depth matter more than the monthly figure.
- **dmarcian vs DMARCLY**: DMARCLY covers fifteen domains at $69 a month where dmarcian's fifteen-domain tier is $600, and it includes Safe SPF for lookup remediation. dmarcian counters with far superior documentation, the specification author's provenance, and deployment services. Any multi-domain buyer on a budget should take DMARCLY; single-domain buyers who value depth should take dmarcian Basic.
- **dmarcian vs URIports**: URIports covers twenty-five domains at $30 a month and extends into browser-side CSP and certificate monitoring, making it the volume value option for technical operators. dmarcian is the specialist that will teach you the standard and help you deploy it. Take URIports for many domains and a technical owner; take dmarcian for one or two domains and a project that needs to be done properly.
- **dmarcian vs Red Sift OnDMARC**: Red Sift OnDMARC's $9 Express tier covers four domains with hosted SPF, DKIM, DMARC, MTA-STS, and BIMI services that dmarcian does not offer at any price, from a company with roughly $70M in funding. dmarcian answers with the specification author's provenance, the best documentation in the field, and no vendor dependency on your DNS. Take OnDMARC Express for capability per dollar; take dmarcian when you want to understand and own your own authentication.
- **dmarcian vs GlockApps**: GlockApps bundles DMARC analytics alongside seed-list placement testing and blacklist monitoring, which dmarcian does not attempt. dmarcian is far deeper on authentication and offers nothing on placement. If your question is where mail lands, GlockApps; if your question is who sends as your domain and how to stop them, dmarcian.

## Implementation

- Setup time: Under an hour to add a domain and publish a record. Reaching a defensible p=reject typically takes four to twelve weeks of calendar time, driven by how long it takes every legitimate sender to show up in a report and be fixed.
- Learning curve: Higher than the friendlier competitors, deliberately. dmarcian shows you the underlying mechanics rather than hiding them, which is slower at first and produces a better outcome. The documentation carries most of that load.
- Onboarding: Self-serve with a thirty-day no-card trial across paid plans. Paid deployment services are available for organizations that want the project run for them, which is a meaningful option for anyone without an internal owner.
- Migration: Moving from another DMARC vendor means repointing the rua tag in your DMARC record; historical report data does not transfer between platforms, so run both addresses in parallel for a few weeks if you need continuity. Because dmarcian does not host records, there is no delegation to unwind if you later leave, which is an underrated advantage.

## Platform, API & security

- Platforms: Web application, Public SPF, DKIM, DMARC, and BIMI inspector tools
- API: API access is an Enterprise-tier feature; Basic and Plus have no published programmatic access.
- Compliance: SOC 2, GDPR
- Data residency: Regional hosting arrangements are available for larger customers rather than as a self-serve option.
- SSO: Single sign-on is available on the Enterprise tier only.
- Security notes: DMARC aggregate reports contain sending IP addresses and authentication outcomes rather than message content. Forensic reports can include headers and, from some receivers, partial message content, so enabling ruf on a sensitive domain deserves deliberate thought. Because dmarcian does not host authentication records, your DNS zone remains the source of truth throughout.

## Support

- Channels: Email support, Paid deployment services, Account support on higher tiers
- Documentation: An unusually thorough knowledge base covering SPF, DKIM, DMARC, BIMI, and deployment methodology, widely cited as reference material outside the vendor's own customer base.
- Community: Long-standing presence in the email authentication community through the founder's involvement in the standard itself.

## Company

- Founded: 2012
- Founders: Tim Draegen
- Headquarters: Brevard, North Carolina, United States
- Ownership: Self-funded and privately held
- Employees: Not disclosed
- Funding: Self-funded; the company states it has no investor group and is not venture-backed.

Timeline:

- 2012: Founded by Tim Draegen, the primary author of the DMARC specification, to make DMARC deployment practical for organizations outside the largest mailbox providers.
- 2015: The SPF Surveyor and other public inspector tools become widely used reference utilities across the email authentication community.
- 2019: Expands the platform with forensic reporting and domain discovery for organizations with large, poorly documented domain estates.
- 2024: The Google and Yahoo bulk sender requirements make DMARC mandatory for high-volume senders, bringing a decade-old specialist product a much larger small business audience.
- 2026: Remains self-funded and specialist, competing on depth and provenance while cheaper multi-domain platforms take the volume end of the market.

## Integrations

DNS providers via published record changes, Google Workspace as a sending source, Microsoft 365 as a sending source, Marketing and transactional email vendors, categorized in reports, API access on the Enterprise tier, SSO on the Enterprise tier

## FAQ

### What is dmarcian?

dmarcian is an email authentication monitoring platform founded in 2012 by Tim Draegen, the primary author of the DMARC specification. It collects the DMARC aggregate reports that receiving mail servers generate about your domain, presents them as per-source analytics with SPF and DKIM alignment results, and guides you through deploying a policy from p=none to p=reject.

### Which of the three deliverability jobs does dmarcian do?

Authentication monitoring only. It does not warm mailboxes and it does not run inbox placement tests. If your outbound is landing in spam despite passing authentication, dmarcian will confirm that authentication is fine and offer nothing further; that problem belongs to a warming service or a placement tester.

### How much does dmarcian cost?

There is a free Personal plan for non-business use covering two domains and 1,250 messages a month. Basic is $24 a month for two active domains, 100,000 messages, three months of history, and one user. Plus is $240 a month for eight domains, a million messages, a year of history, three users, and forensic reporting. Enterprise is $600 a month for fifteen domains, five million messages, unlimited history and users, API access, and SSO.

### How many domains does each tier cover and what happens if I need more?

Two on Personal and Basic, eight on Plus, fifteen on Enterprise, and custom quoting above that. There is no published per-domain add-on price, so exceeding a tier means moving up, and the Basic-to-Plus step multiplies your bill by ten for four times the domains. Buyers with more than two domains should price DMARCLY and URIports before committing.

### Does dmarcian support hosted SPF, DKIM, and BIMI records?

No. dmarcian provides inspectors that diagnose SPF, DKIM, DMARC, and BIMI records, including an SPF tree view that reveals the ten DNS lookup overflow, but it does not host or manage those records on your behalf. You publish and maintain your own DNS. That is a drawback if DNS access is slow at your organization and an advantage if you would rather not create a vendor dependency. BIMI logo display at most providers also requires a Verified Mark Certificate bought separately.

### How does dmarcian get me to p=reject?

You publish p=none first so receivers report without acting. As aggregate reports arrive, you authorize each legitimate sender in SPF and enable DKIM signing at each vendor, using the inspectors to confirm each fix actually took effect. When your legitimate mail is aligning consistently, you move to p=quarantine, usually with a percentage rollout, then to p=reject. Four to twelve weeks is realistic, and the limiting factor is observing a full sending cycle rather than the tool.

### How are aggregate and forensic reports presented to a non-expert?

Aggregate reports become per-source rows with message counts and separate SPF and DKIM alignment outcomes, grouped into recognizable services. Forensic reports, available on Plus and Enterprise, show individual failing messages, though coverage is limited because most large mailbox providers do not send them at all. dmarcian leans toward showing the mechanics rather than abstracting them, which suits a reader willing to learn and frustrates one who is not.

### What does the message volume limit count?

It counts DMARC-capable messages that receiving servers reported on, meaning mail claiming to come from your domain. That includes everything your SaaS vendors send on your behalf, and it includes mail spoofed by other people, so a domain under active impersonation consumes allowance faster than its owner's own sending would suggest.

### Do I still need a warming tool or a placement tester?

If you send cold outbound or you are starting a new domain, yes. Authentication is a prerequisite for good placement, not a substitute for it. A typical stack is dmarcian for authentication, a warming service such as MailReach or TrulyInbox for new mailboxes, and a placement tester such as GlockApps or Unspam for evidence of where mail actually lands.

### Who owns dmarcian?

dmarcian is self-funded and privately held, founded in 2012 by Tim Draegen and headquartered in Brevard, North Carolina. The company states it has no investor group, which is unusual in a category dominated by venture-backed platforms.

## Editorial verdict

dmarcian is the specialist's choice in DMARC monitoring, and the provenance is not marketing: it was founded by the person who wrote the specification and has done nothing else since 2012. The inspectors are the best diagnostic tools in the category, the documentation is genuinely educational, and the thirty-day no-card trial plus $24 Basic plan make it an easy first purchase for a single-domain business that wants authentication done properly. The problem is everything above two domains. At $240 for eight and $600 for fifteen, dmarcian is priced for organizations with security budgets, not for small businesses with a domain estate, and DMARCLY, URIports, and PowerDMARC will each cover far more domains for far less. Buy Basic for one or two domains and a willing learner. Look elsewhere the moment your third domain arrives, and never buy it hoping to fix inbox placement.

---

Source: SaaSTracker (https://saastracker.org), an independent editorial project. This profile is compiled from public information, carries no peer reviews or paid placement, and was last reviewed 2026-08-22. Awards are judged on published criteria: https://saastracker.org/methodology