Red Sift OnDMARC
Enterprise-grade DMARC with a $9 self-serve tier bolted underneath it
Red Sift OnDMARC is an email authentication platform that ingests DMARC aggregate and forensic reports, provides dynamic hosted SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI services, and guides organizations to an enforced p=reject policy; it is an authentication monitoring product from a venture-backed cybersecurity vendor, and it does not warm mailboxes or run seed-list inbox placement tests.
Overview
OnDMARC does the third job in this category, SPF, DKIM, and DMARC authentication monitoring, and it comes from a different place than the small specialists that dominate the small business end of the market. Red Sift is a London cybersecurity company founded in 2015 by Rahul Powar and Randal Pinto that raised a $54M Series B led by Highland Europe in 2022, bringing total funding to roughly $70M, and OnDMARC is one product in a broader email security and brand protection platform.
That heritage shows in both directions. On the capability side, OnDMARC is unusually complete: every tier supports dynamic hosted services for DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI, forensic reporting is standard rather than a mid-tier unlock, and the Investigate tool gives instant diagnostics of a domain's authentication posture. On the commercial side, the product is clearly built for organizations with procurement departments: Essentials, Enterprise, and Premier are all custom-quoted, and only the entry Express plan carries a published price.
Express is the reason a small business should care. At $9 a month billed annually it covers up to four domains, up to a million monthly emails, and thirty days of data history, with self-serve signup and a free trial requiring no credit card. Four domains for $9 undercuts EasyDMARC's four domains at $71.99 by a wide margin, and a million-email allowance is far above what any small sender will generate. The thirty-day history is the real constraint, and it is a meaningful one, since diagnosing anything with a monthly or quarterly rhythm needs a longer window.
The honest caution is the shape of the ladder. If four domains and thirty days of history stop being enough, the next step is not a published upgrade but a sales conversation, and the plans above Express are priced for organizations with twenty-five to fifty sender domains. A growing small business will hit that wall and find DMARCLY or URIports offer a published path where Red Sift offers a quote. Buy Express for what it is, an unusually capable entry tier subsidized by an enterprise product, and price the alternatives before you outgrow it.
Best for
Small businesses with up to four domains that want a very cheap, capable, self-serve DMARC entry point with hosted record management, and larger organizations already buying into Red Sift's wider email security platform.
Not the right fit for
- Anyone whose actual problem is cold email landing in spam; authentication monitoring proves your mail is signed correctly and says nothing about whether it reaches the inbox.
- Buyers who want inbox placement evidence; DMARC reports do not carry placement data, so OnDMARC can never tell you whether a message landed in the inbox, promotions, or spam.
- Growing companies that need a published upgrade path; everything above the $9 Express tier is custom-quoted, and the next tier up is built for twenty-five sender domains.
- Teams that need more than thirty days of report history on a published price; a year of history starts at the sales-quoted Essentials tier.
- Anyone looking for warming or sender reputation building, which Red Sift does not offer in any product.
How it works
- 1
You add a domain and publish a DMARC record pointing the rua tag, and optionally the ruf tag, at Red Sift's reporting addresses. Nothing about your mail flow changes; you are only asking receiving servers to report what they see.
- 2
Aggregate reports begin arriving within a day or two from Google, Microsoft, Yahoo, and other receivers. OnDMARC parses them into per-source views with SPF and DKIM alignment outcomes, identifying recognized sending services by name rather than leaving you to interpret IP ranges.
- 3
Rather than editing DNS for every change, you can delegate authentication records to Red Sift's dynamic services. SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI are then managed inside the platform, which also resolves the ten DNS lookup limit that silently breaks SPF on domains with many vendors.
- 4
The Investigate tool diagnoses a domain's current posture on demand, and the guided deployment path moves you from p=none through p=quarantine with a percentage rollout to p=reject as your legitimate mail reaches consistent alignment. Alerting flags new or failing sources afterwards.
Feature breakdown
20 features in 4 modulesDMARC report analysis
The core job, with forensic reporting included at every tier rather than gated.- Aggregate report processing
- Ingests rua reports from every receiver that sends them and renders per-source volume with SPF and DKIM alignment outcomes, in place of daily XML attachments.
- Forensic reporting as standard
- Per-message failure detail is included across the range rather than reserved for mid or upper tiers, which is unusual. Coverage is still limited because most large receivers do not send failure reports.
- Sending source identification
- Recognized email vendors are named rather than shown as IP ranges, which is what makes reports usable without email engineering knowledge.
- Investigate tool
- On-demand diagnostics of a domain's authentication posture, useful both for your own domains and for checking a partner or acquisition target before integrating their mail.
- Alignment separation
- Distinguishes SPF authentication from SPF alignment and DKIM signing from DKIM alignment, the distinction behind most confusing DMARC failures.
- Data history by tier
- Thirty days on Express and one year on the sales-quoted tiers. Thirty days is the binding constraint on the entry plan.
Dynamic hosted services
Record management delegated to the platform, available on every tier including the $9 one.- Hosted DMARC
- Publish a delegating record once and change policy from none to quarantine to reject inside the platform rather than through a DNS ticket each time.
- Dynamic SPF
- Addresses the ten DNS lookup limit that silently breaks SPF on domains with many vendors, and lets you add or remove authorized senders without hand-flattening a record.
- Hosted DKIM
- Key and selector management handled in the platform rather than as scattered TXT records nobody documented.
- BIMI support
- BIMI record management for displaying a brand logo in supporting inboxes, included at every tier. Display at most large providers additionally requires a Verified Mark Certificate bought separately from a certificate authority.
- MTA-STS and TLS-RPT
- Policy hosting and transport encryption reporting included across the range, covering standards most small business tools ignore entirely.
Getting to enforcement
The guided path to p=reject, which is what the subscription is for.- Staged policy progression
- Guided movement from p=none through p=quarantine with a percentage rollout to p=reject, using alignment coverage as the readiness evidence.
- Compliance tracking
- A headline measure of how much of your mail passes DMARC, which is the number to watch before tightening policy.
- Alerting on new and failing sources
- Notifications when an unrecognized sender appears or an authorized one starts failing, so a newly added SaaS tool does not sit broken for a quarter.
- Subdomain handling
- Tracks subdomain sending separately, since a permissive subdomain policy quietly undermines an enforced organizational one.
Plans, scale, and platform
One published price and three quoted tiers, which is the main structural caveat.- Express at $9
- Up to four domains, up to a million monthly emails, thirty days of history, self-serve signup, billed annually. The cheapest four-domain DMARC plan published anywhere.
- Essentials, Enterprise, and Premier
- Twenty-five active sender domains on Essentials and Enterprise and fifty on Premier, each upgradable to unlimited, with unlimited email volume and a year of history. All custom-quoted.
- Free trial without a credit card
- Available across the range, with self-serve signup on Express and sales engagement for the higher tiers.
- Multi-currency billing
- USD, EUR, GBP, and AUD, which is more accommodating than most vendors in this category.
- Wider Red Sift platform
- OnDMARC sits alongside Red Sift's other email security and brand protection products, so an existing customer can consolidate rather than adding a specialist vendor.
Use cases
4 documentedSmall business with four domains and a $10 budget
The company owns a main domain, a marketing subdomain, and two legacy brands, and every DMARC vendor it has priced charges more for fewer domains.
Express at $9 a month billed annually covers all four with hosted SPF and DMARC, which is enough to reach an enforced policy without a budget conversation.
Marketing team blocked by DNS access
Every SPF change means a ticket to an outsourced IT provider, and the record has already exceeded the ten DNS lookup limit.
Dynamic SPF and hosted DMARC are delegated once, after which authorized senders and policy changes are managed in the platform without further DNS tickets.
Brand preparing BIMI
The company wants its logo displayed next to messages in supporting inboxes, which requires DMARC enforcement first.
OnDMARC drives the domain to p=reject and hosts the BIMI record, after which the brand buys a Verified Mark Certificate separately from a certificate authority.
Security team consolidating vendors
Email authentication, brand protection, and attack surface monitoring are spread across three vendors and three renewal dates.
Red Sift's wider platform absorbs OnDMARC alongside its other products, which is the reason a larger organization would choose it over a cheaper standalone specialist.
Pricing
from $9 per month billed annually (Express)Subscription tiered by active sender domains, monthly email volume, and data history, with one published self-serve entry price and three custom-quoted tiers above it.
| Plan | Price | Includes |
|---|---|---|
| Express | From $9 per month billed annually |
The only published price in the range, and the cheapest four-domain DMARC plan available anywhere. |
| Essentials | Custom quoted |
|
| Enterprise | Custom quoted |
|
| Premier | Custom quoted |
|
Billing notes
- Express is billed annually at the $9 figure; the pricing page presents it as a starting price, so confirm the exact figure for your domain count at signup.
- The gap between Express and Essentials is the structural problem: four domains and thirty days of history, then a sales conversation with no published intermediate step.
- Thirty days of history on Express is short. Anything with a monthly billing run or a quarterly campaign cycle will be hard to diagnose within that window.
- The million-email monthly allowance on Express is far above what a small business generates, so volume will almost never be the reason to upgrade; domain count and history will be.
- Billing is available in USD, EUR, GBP, and AUD, which is unusually accommodating for this category.
- Dynamic hosted services are included at every tier including Express, where competitors often reserve record hosting for enterprise plans.
Value assessment: Express is one of the best value propositions in this entire category, and it exists because Red Sift makes its money elsewhere. Four domains, a million monthly emails, forensic reporting, and full dynamic hosted services for SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI at $9 a month is capability that EasyDMARC charges $71.99 for and dmarcian would price at $240. The catch is the ceiling. Thirty days of history is genuinely limiting, and the moment four domains is not enough you are in a quote process aimed at organizations with twenty-five sender domains. Take Express for what it is, an exceptional entry tier, and have DMARCLY or URIports in mind as the destination if you outgrow it.
Strengths & limitations
Strengths
- Express at $9 a month for four domains with full hosted record services is the cheapest capable published DMARC plan in the category.
- Dynamic hosted DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI on every tier, including the entry plan, where competitors reserve record hosting for enterprise contracts.
- Forensic reporting included as standard rather than gated to mid or upper tiers.
- Dynamic SPF resolves the ten DNS lookup overflow without manual flattening, a failure mode most established domains have.
- Backed by a substantial venture-funded cybersecurity company with roughly $70M raised, which is far more corporate stability than the small specialists in this field offer.
- Free trial with no credit card and self-serve signup on Express, plus billing in four currencies.
- Part of a wider email security and brand protection platform, which matters if you want to consolidate vendors later.
Limitations
- Only one tier has a published price; Essentials, Enterprise, and Premier are all custom-quoted, so the upgrade path is a sales conversation rather than a click.
- Thirty days of data history on Express is the shortest working window among comparable plans and makes periodic sending patterns hard to diagnose.
- The jump from four domains to twenty-five is enormous, with nothing published in between, which strands a company that grows to six or eight domains.
- The product is fundamentally built for organizations with security teams, so a small business is buying an entry tier of an enterprise product rather than a product designed for it.
- Hosted record delegation creates a real vendor dependency: your authentication posture lives in the platform, and leaving means rebuilding records in your own zone.
- No inbox placement testing, so it cannot say whether mail landed in the inbox, promotions, or spam.
- No warming capability, so a new sending domain still needs a separate tool before carrying volume.
Head-to-head comparisons
6 alternativesRed Sift OnDMARC vs EasyDMARC
from $0 (Free, one domain), then $35.99 per month billed annually (Plus)EasyDMARC charges $71.99 a month for four domains where OnDMARC Express covers four for $9 and includes hosted record services EasyDMARC reserves for its Enterprise tier. EasyDMARC gives a year of history against thirty days and a more developed MSP programme. Take OnDMARC Express on price and hosted records; take EasyDMARC if history length or agency multi-tenancy matters.
Full Red Sift OnDMARC vs EasyDMARC comparisonRed Sift OnDMARC vs PowerDMARC
from $0 (Free), then Basic from around $8 per month by volume, about $12 per month billed annually at the 100,000-email stepBoth host SPF, DKIM, DMARC, BIMI, and MTA-STS records on self-serve tiers. PowerDMARC gives five domains and a full year of history for roughly $12 to $15 a month, where OnDMARC Express gives four domains and thirty days for $9. PowerDMARC is the better buy on history alone; OnDMARC wins on vendor stability and on being part of a wider security platform.
Full Red Sift OnDMARC vs PowerDMARC comparisonRed Sift OnDMARC vs dmarcian
from $0 (Personal, non-business use), then $24 per month (Basic)dmarcian is the specification author's product with the best documentation in the field, at $24 for two domains and $240 for eight. OnDMARC Express covers four domains for $9 with hosted records dmarcian does not offer at any tier. Choose dmarcian to be taught the standard properly; choose OnDMARC Express for capability per dollar and delegated record management.
Full Red Sift OnDMARC vs dmarcian comparisonRed Sift OnDMARC vs DMARCLY
from $17.99 per month (Professional)DMARCLY publishes a complete self-serve ladder to two hundred domains, which is exactly what OnDMARC lacks above Express. OnDMARC is cheaper and more capable at four domains or fewer. Start on OnDMARC Express if you are small, and move to DMARCLY rather than into Red Sift's quote process when your domain count grows past four.
Full Red Sift OnDMARC vs DMARCLY comparisonRed Sift OnDMARC vs URIports
from $1.25 per month (Sand, personal), $6 per month billed annually (Pebble)URIports covers five domains for $6 and twenty-five for $30, with browser-side CSP and certificate monitoring alongside DMARC, but offers little guidance and no record hosting beyond MTA-STS. OnDMARC Express hosts everything and is backed by a much larger company. Technical operators watching many domains should take URIports; small businesses wanting delegated records at a low price should take OnDMARC.
Full Red Sift OnDMARC vs URIports comparisonRed Sift OnDMARC vs GlockApps
from $59/mo (Essential, billed annually)GlockApps bundles DMARC analytics into a platform centred on seed-list placement testing and blacklist monitoring, which OnDMARC does not attempt. OnDMARC is far deeper on authentication, with hosted services across six standards. Buy GlockApps to learn where mail lands; buy OnDMARC to control who can send as your domain and to reach p=reject.
Full Red Sift OnDMARC vs GlockApps comparisonImplementation & onboarding
- Setup time
- Under an hour to add domains, publish records, and start collecting. Reaching a defensible p=reject takes four to eight weeks of calendar time, driven by how long it takes every legitimate sender to appear in a report and be fixed. Hosted records make each subsequent change a matter of minutes.
- Learning curve
- Moderate. The reporting is legible and the Investigate tool shortens diagnosis, but the delegation model and the enterprise framing both assume a slightly more technical reader than EasyDMARC does.
- Onboarding
- Self-serve on Express with a free trial and no credit card. The higher tiers are sold and onboarded through Red Sift's sales organization, which is where the small business self-serve experience ends.
- Migration notes
- Moving from another DMARC vendor means repointing the rua tag; historical report data does not transfer, so list both addresses in parallel for a few weeks if continuity matters. If you adopt the dynamic hosted services, plan the exit as well: leaving later means reconstructing SPF, DKIM, DMARC, and BIMI records in your own DNS zone before removing the delegation.
Platform, API & security
- Platforms
- Web applicationDynamic hosted record servicesInvestigate diagnostic tool
- API
- API access is available within the broader Red Sift platform; it is not published as a headline feature of the $9 Express tier, so confirm before planning automation around it.
- Compliance
- SOC 2ISO 27001GDPR
- Data residency
- Regional arrangements are handled through the sales-quoted tiers rather than as a self-serve option.
- SSO
- Available on the enterprise tiers rather than on Express.
- Security notes
- DMARC aggregate reports contain sending IPs and authentication outcomes rather than message bodies. Forensic reports, included as standard here, may carry headers and sometimes partial content from receivers that send them, so enable ruf deliberately on sensitive domains. Dynamic hosted services mean Red Sift controls the effective content of your authentication records, which is a real dependency to weigh against the operational convenience.
Support & resources
- Channels
- Email supportSales-led support on the quoted tiersIn-product diagnostics via the Investigate tool
- Documentation
- Substantial documentation and research output covering DMARC, BIMI, MTA-STS, and email security more broadly, reflecting the company's position as a cybersecurity vendor rather than a single-product specialist.
- Community
- Active presence in the email security and BIMI standards community through Red Sift's research and advocacy work.
Company
- Founded
- 2015
- Headquarters
- London, United Kingdom
- Ownership
- Venture-backed
- Founders
- Rahul Powar, Randal Pinto
- Employees
- Not disclosed
- Funding
- Approximately $69.8M raised in total, including a $54M Series B in 2022 led by Highland Europe with Sands Capital, MMC Ventures, and Oxford Capital Partners participating.
Funding history
| Round | Amount | Year | Notes |
|---|---|---|---|
| Earlier rounds | Approximately $15.8M | 2016 to 2020 | Seed and Series A funding preceding the Series B. |
| Series B | $54M | 2022 | Led by Highland Europe, funding US expansion and the wider email security and brand protection platform. |
Timeline
- 2015Red Sift founded in London by Rahul Powar and Randal Pinto as a data-driven cybersecurity company.
- 2018OnDMARC establishes itself as the company's email authentication product, aimed at organizations deploying DMARC to enforcement rather than merely observing it.
- 2021Adds dynamic hosted services across SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI, and becomes an active participant in BIMI standards advocacy.
- 2022Closes a $54M Series B led by Highland Europe, bringing total funding to roughly $70M and opening a US headquarters.
- 2024The Google and Yahoo bulk sender requirements bring a wave of smaller organizations into DMARC, which the $9 Express tier is positioned to capture.
Integrations
- DNS providers via delegating records for dynamic hosted services
- Google Workspace as a sending source
- Microsoft 365 as a sending source
- Marketing and transactional email vendors, identified by name in reports
- BIMI certificate authorities for Verified Mark Certificates
- The wider Red Sift email security and brand protection platform
Frequently asked questions
10 questionsWhat is Red Sift OnDMARC?
OnDMARC is an email authentication platform from Red Sift, a London cybersecurity company. It collects the DMARC aggregate and forensic reports that receiving mail servers generate about your domain, presents them as sender analytics, and provides dynamic hosted services for DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI so you can reach and maintain an enforced p=reject policy.
Which of the three deliverability jobs does OnDMARC do?
Authentication monitoring only. It does not warm mailboxes and it does not run seed-list inbox placement tests. If your outbound lands in spam while passing SPF, DKIM, and DMARC, OnDMARC will show clean authentication and nothing more; that problem belongs to a warming tool or a placement tester.
How much does OnDMARC cost?
The Express tier starts at $9 a month billed annually and covers up to four domains, up to a million monthly emails, and thirty days of data history, with self-serve signup and a free trial requiring no credit card. Essentials, Enterprise, and Premier are all custom-quoted and cover twenty-five to fifty active sender domains with unlimited volume and a year of history.
How many domains does each tier cover and what happens when I outgrow Express?
Express covers up to four domains. The next tier up, Essentials, is built for twenty-five active sender domains and is custom-quoted, so there is nothing published in between. A company that grows to six or eight domains will find a sales conversation where competitors offer a published upgrade, which is the main structural weakness of the range. DMARCLY at fifteen domains for $69 and URIports at twenty-five for $30 are the obvious alternatives at that point.
What are the DMARC report volume and history limits?
Express covers up to a million monthly emails, which is far more than a small business generates, so volume is rarely the constraint. History is: thirty days on Express against a year on the quoted tiers. Thirty days makes anything with a monthly billing run or quarterly campaign cycle hard to diagnose, and it is the most likely reason an Express customer needs to move.
Does OnDMARC support hosted SPF, DKIM, and BIMI records?
Yes, and unusually it does so at every tier including the $9 Express plan. Dynamic services cover DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI, so you publish a delegating record once and manage policy in the platform. Dynamic SPF also resolves the ten DNS lookup limit without manual flattening. Note that BIMI logo display at most large providers additionally requires a Verified Mark Certificate purchased separately from a certificate authority.
How does OnDMARC get me to a p=reject policy?
You publish p=none first so receivers report without acting on failures. As reports arrive you authorize each legitimate sender in SPF and enable DKIM signing at each vendor, using the Investigate tool to confirm each fix took effect. When legitimate mail aligns consistently you move to p=quarantine with a percentage rollout, then p=reject, with hosted DMARC making each change a click rather than a DNS ticket. Four to eight weeks is realistic for a small business.
How are aggregate and forensic reports presented to a non-expert?
Aggregate reports become per-source views with volume and separate SPF and DKIM alignment outcomes, with recognized email vendors named rather than shown as IP ranges. Forensic reports are included as standard across the range and show individual failing messages, though most large mailbox providers do not send them so coverage is partial. The Investigate tool gives an instant readable summary of a domain's posture without waiting for report accumulation.
Do I still need a warming tool or a placement tester?
If you send cold outbound or you are starting a new domain, yes. Authentication is a prerequisite for good placement, not a substitute. A typical stack is OnDMARC for authentication, a warming service such as MailReach or TrulyInbox for new mailboxes, and a placement tester such as GlockApps or Unspam for evidence of where mail lands.
Who owns Red Sift?
Red Sift is a venture-backed cybersecurity company founded in London in 2015 by Rahul Powar and Randal Pinto. It has raised roughly $69.8M in total, including a $54M Series B in 2022 led by Highland Europe. That makes it by some distance the best-capitalized vendor covered in this category, which matters if long-term vendor stability is part of your decision.
Editorial verdict
OnDMARC Express is the best cheap DMARC plan available, and it exists because Red Sift makes its money from enterprise contracts. Nine dollars a month for four domains, a million monthly emails, forensic reporting, and dynamic hosted services across DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI is capability that EasyDMARC prices at $71.99 and dmarcian at $240, from a vendor with roughly $70M in funding behind it. Two things keep it from being the automatic choice. Thirty days of history is genuinely short, and there is nothing published between four domains and the twenty-five-domain quoted tier, so growth means a sales process rather than an upgrade button. Buy Express if you have four domains or fewer and want hosted record management at the lowest possible price, and plan to move to DMARCLY or URIports rather than up the Red Sift ladder if you outgrow it. As with every product here, it says nothing about whether your mail reaches the inbox.
Written by the SaaSTracker editorial team. Awards, when shown, are judged against the published criteria in our methodology.