Introduction
DMARC pricing is one of those areas where most MSPs leave money on the table. Hourly billing undervalues the work; bundling into "managed IT" makes the value invisible to the client; charging per-incident misses the recurring nature of the operational rhythm. This article covers the three-tier pricing structure that captures the value cleanly — what's in each tier, what the price ranges look like in practice, how to calculate the margin math from your own cost basis, and the common pricing pitfalls that turn a profitable service line into a charity case.
This is the long-form companion to the DMARC for MSPs pillar and the deeper-than-strictly-necessary article that lets you defend your numbers in a tough procurement conversation.
Why this topic matters
DMARC has unusual unit economics compared to other MSP service lines. The upfront work is heavy (discovery, authentication fixes, policy progression over 8-12 weeks) but the recurring effort is low and predictable. The work is specialty enough that clients can't realistically self-serve, but the recurring rhythm is automatable enough that an analyst can manage many client tenants from a multi-tenant platform. Pricing that respects this shape — heavy upfront, light steady-state — is profitable. Pricing that doesn't is a charity case, where the upfront work eats the year-one margin and the recurring revenue isn't enough to recover.
The three-tier pricing structure
The three tiers map onto the natural shape of the work. Most successful MSP practices end up here whether they were aiming for this model or arrived by trial and error.
Tier 1: Audit
What's included: A snapshot of the client's current SPF, DKIM, and DMARC posture; a categorized list of every sender appearing as the client's domain in the last 30 days (if there are any aggregate reports to pull from) or an inference from current DNS state if not; a remediation plan ranked by impact; a written recommendation on whether the client is ready for an enforcement rollout or needs structural fixes first.
Range: Free as a sales tool, or $500-$1,500 as a paid engagement.
Time investment: 2-3 hours of analyst time.
Margin: 80-90% if charged at the upper end; sales tool if free.
When to charge vs offer free: If the audit converts more than 40% of recipients to a paid rollout, offer it free — the lifetime value of the converted clients dwarfs the audit revenue. If conversion drops below that, charge for the audit; it filters for serious buyers and the revenue covers the cost of the unconverted ones.
Tier 2: Rollout
What's included: The full 8-12-week enforcement rollout. Authentication fixes (SPF includes, DKIM enablement, alignment repair) across all discovered senders. Phased policy progression p=none → p=quarantine (with pct ramp) → p=reject. Documented runbook for the steady-state operational team. Handoff to whichever team owns Tier 3 monitoring afterward.
Range: $3,000-$15,000 fixed, depending on sender complexity. The range is wide because the work scales with the number of distinct sending services. A pure-M365 client with five SaaS senders is at the low end; an enterprise client with on-prem Exchange, a third-party gateway, and twenty marketing tools is at the high end.
Time investment: 20-40 hours over 8-12 weeks.
Margin: 50-70%. Lower than the other tiers because most of the work is human attention rather than platform leverage.
Scope boundaries: Be explicit about what's in scope (everything within the client's domain ecosystem at start of engagement) versus out of scope (new SaaS signups during the rollout — those go on the change-control register). The MSA / SOW article covers this in more depth.
Tier 3: Monthly monitoring
What's included: Aggregate report review (weekly internally, monthly to client), new-sender alerts, policy-state monitoring, change-control coverage for new SaaS signups, DKIM rotation when due, the quarterly business review export with the client-facing narrative.
Range: $50-$300 per domain per month. Lower end for small-portfolio clients with a single domain; upper end for enterprise tenants with multiple domains and high change cadence.
Time investment: 1-2 hours per client per month at steady state. Less during quiet quarters, more when the client adds a new sender or hits a policy escalation gate.
Margin: 70-90%. The profitable recurring tier. This is what justifies the modest upfront margins on Tier 2.
Per-tenant vs flat pricing
The two pricing models for Tier 3 — per-domain vs flat per-client — each have a clean rationale:
Per-domain: Honest pricing. Clients with twenty domains pay roughly twenty times as much as clients with one domain. Easy to explain, easy to scale, easy to defend in procurement. The downside is that clients with portfolio-style domain inventories (a parent brand plus many sub-brands) feel the cost more sharply.
Flat per-client: Simpler invoice. The client pays one monthly number regardless of how many domains. The MSP absorbs the per-domain variability inside the flat rate. Easier to bundle into "managed IT" packages; harder to defend when the client suddenly adds ten domains via acquisition.
The pattern that holds up: per-domain pricing for self-serve clients (smaller), flat-per-client pricing for enterprise (larger), with a clean conversion formula so a growing client can shift from one model to the other without negotiating from scratch.
Pricing by client size
A rough heuristic that scales with most practices:
- Under 25 employees, single domain. Audit free, rollout $3-5K, monthly $50-100/domain. The audit-as-sales-tool model works at this segment because the buying cycle is short. Editorial opinion: for the smallest end of this segment — sole traders, two-person consultancies, very-small-business clients with one quiet domain — DMARC can be delivered profitably at $20-$25/month per domain. The platform license is the floor; analyst time is minimal because change cadence is near-zero. Discount the recurring tier only for clients where the lifetime relationship makes the math work.
- 25-200 employees, 1-3 domains. Audit $500, rollout $5-10K, monthly $100-200/domain. Procurement is more formal; a paid audit reads as more credible.
- 200-1,000 employees, 3-10 domains. Audit $1-2K, rollout $10-25K, monthly $200-400/domain. This segment usually has internal IT — the MSP value proposition is specialty expertise, not headcount.
- Over 1,000 employees, many domains. Custom pricing. Per-domain unit economics are the floor; the negotiated price is usually 30-50% above that floor to reflect the enterprise sales motion and the increased scope complexity.
Volume discount on the monthly tier past 5 domains within the same client makes sense and is expected.
The margin math
The arithmetic that should drive your numbers, not aspirational pricing:
Loaded hourly cost = (Annual analyst salary + benefits + overhead) ÷ (billable hours per year). For a $80K engineer, that's roughly $50-70/hour fully loaded depending on the overhead model.
Tier 1 cost = 2.5 hours × $60 = $150. At $500 charged, the margin is 70%. At $1,500 charged, 90%.
Tier 2 cost = 30 hours × $60 = $1,800. At $5,000 charged, margin is 64%. At $10,000 charged, 82%. The wide range exists because client complexity drives the hours; price-scope-margin must be quoted together, not in isolation.
Tier 3 cost = 1.5 hours/month × $60 = $90/client/month. At $150/domain charged for a single-domain client, margin is 40% (low — this is the small-client segment where the platform license eats more of the take). At $300/domain charged, margin is 70%. At $600/domain for a multi-domain enterprise (negotiated), margin is 85%.
Add the platform license to the cost basis for Tier 3. Most multi-tenant DMARC platforms cost $5-50 per managed domain per month wholesale; the per-active-Premium-domain pricing model is the friendliest to MSP economics because inactive domains don't draw cost.
Common pricing pitfalls
- Pricing the rollout from a position of insecurity. The work is specialty; quote with confidence. Discounting the rollout to win the deal usually results in a client who never converts to Tier 3 because the rollout was framed as "the work" rather than "the foundation for the work."
- Bundling DMARC into managed IT. Makes the value invisible. Clients can't understand why DMARC service is "$50 per month" when their managed-IT line is "$2,500 per month" — they assume it's already included. Separate line item, separate sale, separate value perception.
- Underpricing the audit when it's the close mechanism. If the audit is the sales tool, treat it like one — invest in the deliverable, make it visibly more valuable than the price. A $500 audit that looks like a $5,000 deliverable closes the rollout.
- Forgetting platform pass-through. The platform license is part of your COGS. If you charge $100/domain/month and the platform costs you $50, your gross margin is 50%, not the 90% you may have penciled in.
- No annual prepay discount. A 10-15% discount for annual prepay smooths cash flow and reduces churn. Most clients take it, and the discount is cheaper than the cost of monthly billing operations and churn risk.
- Treating remediation overruns as included. "We fixed everything we found" is open-ended scope. Define what's included (the senders discovered during initial discovery + minor cleanup in the first 30 days) versus what's billable (new senders added by client during the rollout, brand acquisitions, sub-domain delegations). The MSA / SOW article goes deep on this.
Step-by-step approach to setting your prices
- Calculate your loaded hourly cost. Engineer salary + benefits + overhead ÷ billable hours.
- Multiply by hours per tier. Audit, rollout, monthly. These should be conservative estimates from your actual recent engagements, not aspirational.
- Apply target margin. 60-80% on the rollout, 70-90% on monitoring. The rollout margin is intentionally lower because the work is more variable; the monitoring margin is where the practice's profitability lives.
- Add the platform license to the cost basis for the monthly tier. Don't double-count, but don't ignore it either.
- Round to clean numbers. $4,995 reads better than $4,832; $295/month reads better than $287.
- Test with 3 clients. Quote three new prospects at the new prices. If conversion drops noticeably, you've moved too far in one step; adjust.
Best practices
- Don't bundle into "managed IT." Separate line item on the invoice. The client should be able to see what DMARC costs them as a number.
- Price the rollout above your cost confidently. It's specialty work — engineering hours, not commodity hours.
- Use the audit as the sales close, not a profit center. Free or near-free at the lower segments; paid at the enterprise segment where procurement signals credibility.
- Annual prepay discount. 10-15% off annual on the monthly tier. Smooths cash flow, reduces churn risk, and gives you a cleaner annual P&L view.
- Productize remediation overruns. Define what's included in the rollout scope versus what's billable as a change order. Document this in the MSA / SOW.
- Raise prices annually. Not aggressively — 5-8% per year reflecting inflation in your cost basis. Clients expect it; the absence of a price increase reads as "they've been overcharging us all along."
Recommended next step
Calculate your costs for each tier this week. If your current pricing doesn't yield 60%+ margin on the rollout and 70%+ on monitoring, raise prices on the next quote. DMARC is specialty work; price like it. The clients who balk at specialty pricing are the same clients who will balk at the operational discipline the engagement requires — losing those before contract is cheaper than losing them mid-engagement.
FAQ
Can DMARC ever be priced below the standard SMB floor?
Yes — our editorial view is that DMARC can be delivered profitably at $20-$25/month per domain for very small businesses (sole traders, micro-clients with one quiet domain, no marketing senders, near-zero change cadence). The platform license is the cost floor; analyst time is essentially zero on these accounts at steady state. Don't make this the default price — it works only for the smallest segment where the lifetime relationship justifies the math.
What's a good "free audit" loss leader?
Free if it converts >40% of audits to rollouts. Charge if conversion drops below. The free-audit model is right for the SMB segment; the paid-audit model is right for enterprise where procurement reads paid as credible.
Can I bill the rollout hourly?
You can, but clients prefer fixed-scope and fixed-scope forces tighter discovery up-front. The hourly model invites scope creep and unbounded engagement risk. Fixed-scope with a defined change-order mechanism for true scope expansion is the better model.
What about white-label costs?
Add your platform license to the cost basis. Most platforms price $5-50/domain/month wholesale; the per-active-Premium-domain model where inactive domains cost zero is friendliest to MSP economics.
Should I charge for BIMI setup separately?
Yes — BIMI is a distinct SKU. $1,500-3,000 for setup plus the VMC pass-through. BIMI buyers are usually enterprise clients with brand teams; treat it as a separate engagement, not an upgrade to the DMARC line.
How do I handle multi-domain enterprise clients?
Negotiated pricing. Use per-domain unit economics as the floor; quote 30-50% above the floor to reflect enterprise sales motion and scope complexity. Volume discounting past 5 domains within a single client is expected.
What about clients who want to bundle DMARC into a larger security suite?
Tactically fine, strategically risky. Make sure the DMARC component is visible inside the bundle — line-item it within the bundle invoice — so the client can see what they're paying for. Invisible value is value the client will eventually try to remove.
How often should I revisit pricing?
Annually for inflation adjustments; whenever the platform cost basis changes by more than 10%; whenever your sales cycle exposes a pricing barrier (a pattern of deals lost at price). Don't change pricing inside a sales cycle.
Final thoughts
Three tiers, three prices, predictable margin per tier. DMARC pricing works when you respect the shape of the work — finite rollout, recurring monitoring, the audit as either sales tool or premium offering depending on segment.
Price intentionally, not from imitation. Raise prices when audits are converting at high rates; reconsider scope when conversion drops. The data tells you the answer; the role of the operator is to read it.