Understand your DMARC in minutes — not XML.
DMARC arrives as dense XML that is hard to read by hand. We monitor your domains and turn those aggregate reports into a plain-English verdict your clients actually read — one you can understand in minutes — plus a full API to automate the rest.
every Monday — with your logo on it
A sender using an old, unmonitored subdomain started failing DMARC — likely a forgotten marketing tool, not a spoof, but worth confirming.
Acme Agency flagged it for the client to review this week — nothing forwarded automatically until it's confirmed safe.
Sent weekly, under your brand — your logo, your sender name. Works with reports from Google, Microsoft, Yahoo and every provider that sends them.
Protected in 3 steps
v=DMARC1; p=none; rua=mailto:r-<token>@rua.plaindmarc.com; adkim=r; aspf=rPublish a single DNS TXT record pointing at us. Copy, paste, done — in under a minute.
Mailbox providers send your DMARC reports automatically — the first usually arrives within 1–3 days.
A plain-English verdict per domain — what passed, what failed, and exactly what to fix. Between reports we also check roughly daily and email you if a record breaks or a sender starts failing. See a sample report.
Silent email failures cost you clients
Since Google and Yahoo's 2024 bulk-sender rules — and Gmail rejecting non-compliant mail outright in November 2025 — unmonitored DMARC means mail silently lands in spam or bounces. You find out when someone complains. The reports that would warn you arrive as dense XML no one reads.
Is your domain protected? See right now
Free, instant, no signup — a plain-English read of your live DMARC record.
Example result
MONITORING ONLYacme-client.com has a DMARC record but only monitors (p=none) — spoofed mail is still delivered.
- Policy is p=none (monitoring only) — failing mail is still delivered as normal.
That's the free instant check. Weekly monitoring adds a sender-by-sender breakdown and exactly what to fix — see a full sample report.
Monitoring your clients actually read, not dashboards they ignore
Every domain gets a per-week verdict: what passed, what failed, and exactly what to fix — written so a client reads it, not an XML dump.
Send the weekly report under your brand — your logo, your sender name, your reply-to. It never goes out from your domain, so your deliverability is never on the line.
Between weekly reports we watch, roughly daily, for a record that disappears, a brand-new sender failing, or a known sender's pass rate collapsing — and email you.
Point TLS-RPT at us and we turn encryption failures into a plain-English alert. Host a BIMI logo with us so a verified mark can show next to authenticated mail.
Built for you — and your AI agents
Every action in the dashboard — add a domain, read a verdict, send a client report — is also a scriptable API call. A public llms.txt and a documented Bearer-key API mean an agent can check a domain, add it, and read the verdict without a human clicking through a UI.
Hey, I'm Suleiman — PlainDMARC is a one-person product.
I built it because I was tired of reading raw DMARC XML for client domains: unzipping attachments, squinting at source IPs, then translating it all into an email a client could actually understand.
There's no sales team and no growth playbook here — just weekly reports written so a client actually reads them, and a founder who reads every reply. If something is unclear or broken, reply to any email. It lands in my inbox.
Boring about security, on purpose
No badges we haven't earned, no claims we can't back. Everything below is documented, in plain English, in our security disclosures.
One flat bill, every domain
Your bill never grows as you onboard clients. Every plan — including Free — gets the full monitoring. Paid tiers add capacity and white-label reports, not better data.
Billed monthly. for 2 months free on every paid plan.
Showing monthly pricing.
Free
No card required
- 1 domain
- 1 team seat (just you)
- Weekly plain-English verdict
- Daily safety alerts
- No card required — ever
Solo
14-day free trial
- Up to 5 domains
- 2 team seats — owner + view-only
- Weekly verdict per domain
- Daily safety alerts
- For freelancers & small senders
Fully used, that's $2.40 per domain.
Start 14-day free trialAgency
14-day free trial
Founding agency pricing — this rate is locked for life
- Up to 25 client domains
- 5 team seats — owner + view-only
- Client-scoped logins — each client sees only their domain
- Everything in Solo
- White-label client reports — your logo, your sender name
- Weekly auto-send to each client
- Hosted link + printable PDF
- See a sample client report
Fully used, that's $1.56 per client domain.
Start 14-day free trialAgency+
14-day free trial
- Up to 100 client domains
- 10 team seats — owner + view-only
- Everything in Agency
Fully used, that's $0.59 per client domain.
Start 14-day free trialPaid trials run 14 days with a card on file — cancel in one click before day 15 and you pay nothing. See how a flat bill compares across portfolios on our honest pricing comparison.
Questions, answered plainly
Something else? Email hello@plaindmarc.com — it lands in the founder's inbox.
What is DMARC?
DMARC is an email standard (RFC 7489) that tells mailbox providers how to handle messages that fail authentication (SPF/DKIM). It also lets you receive reports on who is sending mail as your domain — legitimate or not. To go deeper, read the standard itself at RFC 7489, the overview at dmarc.org, and the sender best practices published by M3AAWG.
Do I need code or a developer?
No. You add one DNS TXT record — a copy-and-paste change in your domain settings. No code, no servers, no integrations.
What if something breaks mid-week?
You don't wait for the weekly report. Between reports we check roughly daily for three things and email you an alert: a DMARC record that disappears (or changes so reports stop reaching us), mail from a sender we've never seen before failing DMARC, and a known sender whose pass rate suddenly collapses. You can switch alerts on or off per account in the dashboard's Notifications view.
Can you tell me when mail can't reach my domain securely?
Yes — this is inbound TLS monitoring. Other mail servers report (via TLS-RPT) when they couldn't set up an encrypted connection to deliver mail to you: a downgrade to plaintext, or an expired or mismatched certificate. Add one TXT record pointing those reports at the same PlainDMARC address as your DMARC reports, and we turn them into a plain-English alert that names the cause. Our free MTA-STS / TLS-RPT checker gives you the record to paste.
Can you host my brand logo for BIMI?
Yes. Upload your logo as a BIMI-format SVG — and your VMC certificate if you have one — and we host both and give you the BIMI DNS record to paste. Once your domain is at an enforced DMARC policy, a verified logo can appear next to your authenticated mail in inboxes that support BIMI, such as Gmail and Apple Mail. The free BIMI checker tells you whether your logo qualifies before you upload.
What happens when my trial ends?
After 14 days your card is charged for the plan you picked. You'll get a reminder email before the trial ends. Cancel in one click any time before then and you pay nothing.
What's in the free plan?
One domain, the same weekly plain-English verdict, and daily safety alerts. White-label client reports are on paid plans.
Does the bill grow as I add client domains?
No. One flat bill covers every domain on your plan — it never grows as you onboard clients, so your margin per client stays predictable as you grow.
Do paid plans get better data than Free?
No — every plan gets the full monitoring: weekly verdicts, sender drill-downs, roughly-daily alerts. Paid tiers add domain capacity and white-label client reports, not better data.
Can I cancel anytime?
Yes. Cancel anytime with no lock-in. Your data stays yours.
What do you see?
Only the contents of DMARC aggregate reports: sending source IPs, message volumes, and SPF/DKIM pass/fail results. That's it — full detail is on our security page.
Can you read our email?
No. Aggregate reports contain no message content, subject lines, or recipient lists, and we never request forensic (ruf) reports. See security.
Do you send emails from my domain?
No — and this one matters. Client reports go out from reports@plaindmarc.com with your sender name and your reply-to address. We never send from your domain, so there's nothing to configure, no DNS risk, and your own deliverability is never on the line.
Do you change my DNS automatically?
Never. We give you one TXT record to copy and paste, and we only ever read from there. Remove it and the reports stop coming — that's the whole integration.
Do I need to change my mail provider?
No. PlainDMARC sits alongside whatever you send with today. Mailbox providers send us reports about your domain; your mail keeps flowing exactly as it does now.
What happens to our data if we cancel?
Your account and report data are deleted on request — email hello@plaindmarc.com anytime, including right after you cancel.
Find the failure hiding in your mail flow
No password — enter your email and we'll send a sign-in link. One DNS record later, you're monitored.