DMARC monitoring for MSPs

If you monitor DMARC for 10 or more client domains, this page is for you.

No per-domain renewal cycle. No tenant account required for every client. When a client leaves, the domain drops out. Nothing to unwind, nothing to migrate.

What DMARCit does for the MSP

Three scenes an MSP actually walks through, not a feature list.

Scene one: a new client onboards with p=none on four domains. They handed you the DNS credentials Friday. Monday you want the aggregate rua reports flowing so you can see who is sending as them before anyone changes a policy. In DMARCit you add the four domains to your account, point rua at the reporting mailbox, and watch the first 48 hours of data come in. No purchase order for a new tenant. No SSO provisioning. The four domains are line items under your account and you monitor them the same way you monitor the other 30.

Scene two: a client asks for a compliance report for their SOC 2 audit. The auditor wants evidence that DMARC monitoring is in place and that legitimate senders are catalogued. Pull the last 90 days of aggregate data for that one domain, export the alignment-rate trend, hand over the source-marking list showing which senders are approved. The auditor sees what a monitoring program looks like without needing a login to a tenant portal.

Scene three: a client offboards. They switched to an in-house IT team, or they moved to another provider. You want to hand them their data and stop paying for their domain the same billing cycle. In DMARCit that is deleting the domain from your account. There is no client-side account for them to reclaim, no billing entity you have to migrate over, no shared-tenant data you need to disentangle. The domain drops out, the reports stop, the bill adjusts on the next cycle.

Multi-domain math

DMARCit tiers, from the live pricing page. Numbers, not adjectives.

  • Starter, $19/month, 1 domain. Only useful if you are still evaluating on a single test domain of your own.
  • Pro, $49/month, 5 domains. Fits an MSP that is running DMARC monitoring for a handful of clients as a pilot service.
  • Team, $149/month, 25 domains. The tier most working MSPs will sit on.

Margin math you can walk through. Assume you bill a client $50 per month per domain for email deliverability monitoring. Your cost basis per client domain looks like this:

  • 5 client domains on Pro ($49/mo): $9.80 per domain per month in tool cost. At $50/mo billed to clients, roughly $40 gross per domain, roughly 80% gross margin.
  • 20 client domains on Team ($149/mo): $7.45 per domain per month in tool cost. Roughly $42.55 gross per domain, roughly 85% gross margin.
  • 50 client domains: Two Team seats at $298 total, $5.96 per domain per month in tool cost. Roughly $44 gross per domain, roughly 88% gross margin.

The math gets better the more clients you add, because the tier steps do not punish scale. That is the wedge.

The no-renewal wedge in MSP context

The common pricing pattern in this category is a per-domain annual license or a per-tenant seat that renews every year. When your client leaves you, that per-client cost keeps billing until the renewal date, or you eat a mid-term cancellation loss.

DMARCit does not punish you when a client leaves. There is no per-domain renewal calendar to reconcile. There is no tenant account to migrate. If a client offboards on the 15th, you remove the domain, and the tier math adjusts on the next monthly cycle. If you drop from 22 client domains to 18, you stay on Team and pay the same $149. If you drop from 26 to 19, you can downgrade a tier the next month. Month-to-month billing is intentional here.

What DMARCit isn't (yet)

Two-sided honesty. MSP buyers have been burned by SaaS that overpromises multi-tenant capabilities. Here is what is not shipped.

  • No white-label mode. Reports and the dashboard show DMARCit branding. If your client-facing service requires a branded portal with your MSP name and logo, DMARCit is not the tool for that scene today.
  • No ConnectWise, Autotask, or Halo PSA integration. Ticket creation from DMARC alerts is manual. If your operations depend on alerts landing as tickets in your PSA, you will be copying and pasting.
  • No multi-tenant SSO or per-client role delegation. One MSP account holds the domains. There is no way to give a specific client login access to just their own domains without giving them access to the parent account.

These are honest gaps, not roadmap teases. If any of the three is a hard requirement for your practice, DMARCit is not the right tool right now. If you can work around them for a monitoring service, the tier math above holds.

How to try it

Run one of your client's aggregate reports through the browser-side parser. Nothing uploads. You will see whether the tool names the senders you already recognize and whether the next-action text matches the fix you would write yourself.