DMARC Pricing for UK MSPs and Multi-Domain Teams
From £1 per domain per month. Pricing is volume-based, so the per-domain price falls as you add domains to the portfolio. There is no free tier — a free trial, then a per-domain price you can quote to a client on the first call without waiting for a quote cycle.
The rest of this page is the context around that number: how DMARC is priced across the market, what actually drives cost as a portfolio grows, and what to check in any DMARC contract — including one you sign with somebody else.
Three pricing models, and why only one suits a portfolio.
DMARC platforms are priced in broadly three ways. The differences are not cosmetic: each model assumes a different kind of buyer, and picking the one that assumes the wrong buyer is how a service line ends up with unpredictable cost of goods. This section is deliberately generic — the pattern holds regardless of which product you end up choosing.
Per domain
You pay for each domain being monitored, regardless of how many mailboxes or messages sit behind it. This matches the protocol: DMARC is published, evaluated and reported at the domain level, so the unit you buy is the unit you operate.
For a provider it means cost of goods is a number you already know at the point of quoting, because you know exactly how many domains a client has. Our own pricing uses this model, starting at £1 per domain per month and falling per domain with volume.
Per seat
Common where DMARC is a feature inside a larger email-security or gateway suite. You pay per mailbox, which makes sense for the rest of the suite — filtering and quarantine genuinely are per-user — and no sense at all for DMARC.
The distortion is easy to see. A 400-mailbox professional services firm and a 12-mailbox holding company each have one domain and generate one sender inventory, but under per-seat pricing one costs many times the other. It also penalises exactly the clients where spoofing risk is highest: small finance and legal firms with high-value email and few staff.
Per message or per report volume
Priced against the volume of mail sent, or the volume of aggregate report data ingested. Occasionally the cheapest option for a very small, very quiet domain.
The problem is that the bill moves with something you do not control. A client runs an unusually large mailing, or a spoofing campaign generates a spike of failing mail from thousands of sources, and consumption rises precisely when you least want a billing conversation. Registrar and hosting add-ons sometimes fold DMARC into a bundle instead, which is predictable but usually caps out well before portfolio scale.
One more distinction worth checking whichever model you buy under: whether a domain includes its subdomains, and whether a parked or non-sending domain — the legacy trading name a client still owns — is billed at the same rate as an active one. Portfolios contain far more of those than people expect.
Platform cost is the small half of the number.
The licence is the line item people compare. The labour is the line item that decides whether the service line works.
Domain count, not client count. The billable unit is the domain, and clients rarely have one. A manufacturer with three retired brand domains, a charity with a separate campaign domain, a firm that rebranded and kept the old registration — every one of those needs its own record, its own reporting address and its own decision. Count the estate before you model the cost, because the estate is reliably larger than the client thinks.
Where each domain sits on the path to enforcement. A domain at p=none during discovery generates findings and questions. A domain sitting clean at p=reject generates almost nothing until something changes. Platform cost is flat across both; your labour is not, which is why most practices bill enforcement work differently from steady-state monitoring.
Third-party sender count. A client sending only from Microsoft 365 is a short engagement. A client whose marketing platform, e-signature service, helpdesk, payroll provider and booking system all send on the domain is a long one, because each needs its own alignment fix. This variable, not domain count, is what makes two identically sized clients cost very different amounts to onboard.
Enforcement is all-or-nothing now. DMARCbis, published in May 2026 as RFC 9989 with RFC 9990 for aggregate reporting and RFC 9991 for failure reporting, removed the pct= tag. There is no partial rollout to soften a mistake, so the sender inventory has to be right before each step. That raises the value of the discovery work and lowers the appeal of any pricing model that discourages you from monitoring a domain thoroughly before enforcing it.
Volume, in the right direction. Under volume-based per-domain pricing the per-domain price falls as the portfolio grows, so the platform gets cheaper per unit exactly as the operational work becomes more templated. Both curves move the same way, which is the point.
Monitoring, analysis and reporting — in the base price.
The thing to watch across the market is whether the headline per-domain figure covers the parts you actually use daily, or whether report parsing, multi-tenant access and client-ready output are separately licensed. Here they are the product.
Aggregate report ingestion
A reporting endpoint for the rua= tag, with the XML parsed into readable sender data rather than left as attachments.
Sender discovery and analysis
Every source sending as the domain, identified and classified, with alignment failures explained in terms of the fix rather than the error.
Multi-tenant portfolio view
The portfolio is the primary object, not an add-on. Per-tenant separation so a colleague can be handed one client without seeing the rest of the book.
Client-ready reporting
Output designed to be forwarded to a client rather than rewritten by an engineer first — the difference between a billable report and three unbillable hours.
Free tools, no account required
The point-in-time checkers stay free and unmetered for anyone: DMARC checker, SPF analyzer, DNS lookup, DMARC generator and email header analyzer. Ideal for a prospect audit; not a substitute for continuous monitoring.
Trial, not a free tier
Being straightforward about this: there is a free trial, not a permanently free plan. You can add a domain and see real aggregate report data before committing. We would rather say that than advertise a free tier that quietly stops being useful at the point you need it most.
What to check in any DMARC contract.
This list is deliberately vendor-neutral. It is the set of questions worth asking of whichever platform you end up buying, including ours — and it is far more useful than a feature grid, because these are the terms that hurt eighteen months in rather than during the trial.
Data residency and processing
Aggregate reports are metadata about your clients' mail flow, not message content — but they still reveal sending patterns and infrastructure. Ask where reports are processed and stored, which entity is the data processor, and what the sub-processor list looks like. UK public sector procurement will ask you this in writing, so get the answer in writing first.
Report retention
How far back does history go, and does it shorten on lower-priced plans? Retention matters more than it sounds: comparing this month against the same month last year is how you catch an annual mailing that only appears once a year, and an assurance conversation often asks for a trend rather than a snapshot. Ask what happens to history if you downgrade.
Offboarding and data portability
You will eventually lose a client or change platform. Can you export the sender inventory and report history in a usable format, and at what notice? The mechanical step is repointing rua= away, but the reason to check the terms up front is that historic findings rarely transfer between platforms — a migration usually means a fresh monitoring window before you can safely make enforcement decisions again.
Domain limits and what counts as a domain
Is a subdomain a separate billable domain? Is a parked, non-sending domain charged at the full rate? Can you add a domain mid-month and remove one when a client leaves, or are you committed for the term? Portfolios churn, and a contract that treats every registration as a full-price active domain is materially more expensive than its headline suggests.
Support model
Not just response times — who you are actually escalating to. A DMARC problem at enforcement is urgent and specific ("this client's payroll notifications started failing after a key rotation"), and a general first-line queue is the wrong shape for it. Ask what happens when you need to roll a policy back at four in the afternoon, and whether support understands your role as a provider acting for a client.
Claims that should raise an eyebrow
Two are worth naming. Anyone telling you DMARC is a Cyber Essentials requirement is wrong — the scheme's five technical controls do not cover email authentication. And nobody is an NCSC-approved DMARC provider: the NCSC published vendor-neutral guidance and does not endorse individual products. DMARC AI makes no such claim and has no affiliation with the NCSC. A vendor willing to stretch on those points will stretch elsewhere.
You are not reselling a licence. You are selling the reading of it.
The tiering, gating and packaging of a DMARC practice are covered in full on the MSP pillar. This section is only about how the cost base behaves underneath it.
A client cannot buy the outcome by buying the platform, because the platform produces findings and the findings need someone to act on them. That gap is the service, and it is why DMARC prices as a managed line rather than a marked-up subscription. What you bill for is the sender inventory, the alignment fixes, the judgement about when a domain is ready to escalate, and the monthly report the client can hand to a board or an assurance process.
Three structural facts make the economics work. First, the cost base is per domain and known in advance, so you can quote without a discovery call. Second, volume pricing means the per-domain price falls as the portfolio grows, so margin improves with scale instead of eroding. Third, the labour scales sub-linearly — the second thirty domains take far less effort per domain than the first ten, because the discovery patterns, the alignment fixes and the report template are all reusable by then.
The honest caveat is that we are not going to publish a margin figure, because the number that matters is what you bill, and that varies enormously by region, by client mix and by what else sits in your stack. The general shape holds across practices: platform cost per domain is a small fraction of a monitoring-and-enforcement line, and the differentiator is whether your report is good enough that the client renews without a conversation.
Two practical notes. Bill discovery and enforcement work differently from steady-state monitoring — the effort profile is genuinely different and clients understand that. And put the domain estate in the contract explicitly, including parked and legacy domains, so adding the fourth brand domain in month six is a scoped change rather than an argument.
The rest of the UK cluster.
Questions UK MSPs ask us.
How much does DMARC AI cost in GBP? add
Pricing starts at £1 per domain per month and is volume-based, so the per-domain price falls as you add domains to the portfolio.
Because it is priced per domain rather than per mailbox, the cost of covering a client is the same whether that client has twelve mailboxes or four hundred — which makes a service line straightforward to quote.
For an exact figure against your own portfolio size, ask us on a call rather than working from a table. The number depends on how many domains you are bringing.
Is there a free tier? add
There is a free trial rather than a permanently free tier. You can add a domain and see real aggregate report data before committing.
We would rather be straightforward about this than advertise a free plan that quietly stops being useful at the point you need it most.
Do we pay per domain or per mailbox? add
Per domain. This matters for MSPs, because a client with 400 mailboxes on one domain costs the same to monitor as a client with 12 mailboxes on one domain — DMARC operates at the domain level.
Per-seat pricing tends to punish exactly the clients where DMARC is most valuable. Per-domain pricing also makes the service line easier to quote, because your cost base is a number you already know.
What margin can we expect as an MSP? add
That depends on what you bill, which varies considerably by region and by the rest of your stack, so treat any vendor quoting you a specific margin percentage with suspicion — they do not know your rate card.
The structural point is more useful. Platform cost per domain is typically a small fraction of what a monitoring-and-enforcement line bills, and the operational work scales sub-linearly because most of it is templated: the second domain you onboard takes less effort than the first, and the fiftieth takes less again.
The margin pressure in a DMARC practice comes from remediation labour on messy client estates, not from platform cost. Scope that properly in the contract and the economics hold.
Does the price change as we add client domains? add
Yes — downwards. Pricing is volume-based, so the per-domain price falls as the portfolio grows rather than rising. The £1 figure is the starting point for the volume model.
From £1 per domain per month.
Start a free trial, add a client domain and see real aggregate report data before you commit to anything. Volume-based pricing means the per-domain price falls as you add domains, so the economics improve as the portfolio grows.