We resolved the DMARC record of 180 major sending domains and read where each one sends its reports. Valimail appears on 27 of them, Proofpoint on 26, Dmarcian on 16. Another 36 send reports only to themselves and buy nothing. Most of the products that rank for this question appear once, or not at all.
That gap is a sample, not a scandal. These are large senders, and a large sender buys differently from the team publishing its first DMARC record this week. What the corpus does answer is the question a roundup cannot, because the answer sits in DNS rather than on a pricing page: what a working reporting setup looks like, and what quietly breaks when you add a second tool to one.
DMARC monitoring parses reports that mailbox providers already send for free
Mailbox providers generate DMARC aggregate reports whether or not you pay anyone. Publish a rua address in your DMARC record and Google, Microsoft, Yahoo and several hundred smaller receivers start mailing you XML, usually once a day, describing every IP address that sent mail using your domain and whether it passed SPF and DKIM alignment. The reports cost nothing. They are also close to unreadable: one day for a medium sender is dozens of XML files, each listing IP addresses with no names attached.
A DMARC monitoring tool buys you four things on top of that raw feed. It aggregates the XML across reporters and days. It resolves IP addresses to named sending services, so 209.85.220.41 becomes Google Workspace. It tracks alignment over time, so you can see whether a fix worked. And it tells you when your policy is safe to tighten, which is the job the whole category exists for: moving from p=none to p=quarantine to p=reject without silently blocking mail you wanted sent.
None of that requires a subscription in principle. You can parse the XML yourself, and a meaningful share of large senders do. What you are buying is the aggregation, the naming, and the judgement about when to raise the policy.
Who 166 major domains actually send their DMARC reports to
Of 180 domains we resolved on August 15, 2026, 173 publish a DMARC record and 166 of those publish at least one rua address. Here is where those reports go, counted by domain rather than by address, so a domain listing two platforms appears under both.
| Report destination | Domains |
|---|---|
| Valimail | 27 |
| Proofpoint | 26 |
| Dmarcian | 16 |
| Agari (Fortra) | 12 |
| DMARC Analyzer (Mimecast) | 9 |
| Red Sift OnDMARC | 8 |
| Validity | 8 |
| DMARC Digests | 6 |
| Cloudflare | 5 |
| Postmark DMARC Digests | 5 |
| In-house, reports sent to the sending domain itself | 36 |
Read this as what large senders do, not as market share. The corpus is a set of well-known sending domains we track as a control for our own DMARC parser, so it leans heavily toward enterprises, and enterprises buy DMARC monitoring bundled into a security suite. Proofpoint, Agari, Mimecast and Validity are all in that column because the buyer was already paying them for something else.
The list is also thinner than the market. EasyDMARC, DMARCLY, Report URI, Postmastery and Cyber Pilot each appear exactly once, and PowerDMARC, URIports, Fraudmarc, Skysnag and Sendmarc appear zero times. That is a statement about which domains we track, not about those products. If you sell to enterprises, this table is your competitive set. If you are a fifty-person company, it mostly tells you that the expensive options are well represented among people who are not you.
The finding that does travel across company sizes is the last row. Those 36 domains, more than one in five, resolve their own reports and buy nothing at all. Across the Unspam 2026 Email Deliverability Benchmark, 48% publish a DMARC policy, so the population that has got as far as a policy is already the half that takes this seriously.
The word free covers five different offers in this category
Almost every tool here advertises something free, and the word covers at least five distinct arrangements. Sorting them is the fastest way to shorten a shortlist, because three of the five expire or exclude you.
| Offer | What it means | Examples |
|---|---|---|
| Free tier | A permanently free plan, usually one domain with reduced history | EasyDMARC, Valimail Monitor |
| Free digest | Free forever, but the product is an email summary rather than a dashboard | Postmark DMARC Digests |
| Free with the DNS | Included at no charge if you already host DNS there | Cloudflare DMARC Management |
| Free trial | The full product, then it stops | Red Sift OnDMARC, URIports |
| Free for personal use | A real free plan whose terms exclude business domains | Dmarcian |
The last row is the one worth reading twice. Dmarcian's free account is described on its own pricing page as designed for non-business personal use, which means the domain you actually need to monitor does not qualify. It is a generous offer and a common misreading.
We checked every arrangement in that table on September 21, 2026, and deliberately left prices out of it. A price is the fastest-moving fact on any vendor's site, so a roundup that quotes one is wrong within a quarter and cannot tell you when it went wrong. The shape of an offer changes far more slowly than its number.
Your rua list has an order, and the third address has no guarantee under it
Position in a rua list decides whether an address receives anything, and the standard that used to protect the second position was replaced in May 2026. You can list several reporting addresses in one DMARC record, separated by commas, and most people assume all of them receive everything. That was never quite true, and it is less true now.
RFC 7489, the document DMARC ran on for eight years, said receivers "MAY impose a limit on the number of URIs to which they will send reports but MUST support the ability to send to at least two." That sentence did two jobs: it let a receiver cap the work, and it guaranteed you a floor of two.
RFC 9989 replaced it with a plainer sentence in section 4.6: "A report SHOULD be sent to each listed URI provided in the DMARC Policy Record." The companion aggregate-reporting document, RFC 9990, gives the mechanics in section 3.5. A receiver "MUST evaluate the provided reporting URIs in the order given", ignore any that are malformed, and attempt delivery to every remaining one "up to the Receiver's limits on supported URIs".
Three consequences follow, and they point in different directions:
- Order is normative. Position in the list is not cosmetic. A receiver works through your addresses front to back.
- The limit survived. Receivers may still cap how many addresses they serve, and the current text does not say what the cap may be.
- The floor of two is gone. RFC 7489 promised your second address would be served. Neither RFC 9989 nor RFC 9990 promises that, and neither promises your third.
Deployed receivers implemented RFC 7489 and will not all change quickly, so two addresses remains the safe working assumption in practice. The direction of travel is the point: a third address had a weak guarantee before and has none now.
Six of the 166 records we read list more than two addresses, and ours is one of them. unspam.email published three, and the reporting address we care about sat third. The pattern in the other five is the same and entirely reasonable: an email platform's address, added when someone set up sending, plus a monitoring vendor's, added later by someone else. Nobody made a mistake anywhere. The list simply grew past the point where the standard protects it, and no interface warns you.
Six tools worth a shortlist, grouped by what they are
The right tool depends on which group you are buying from, so these are grouped rather than ranked. A weekly email and an enterprise authentication platform are not competitors, and a list that ranks them against each other is answering a question nobody asked.
Valimail
The most common destination in this corpus, and one of the few enterprise platforms with a permanently free monitoring tier. Valimail's pitch is automation: it identifies sending services by name and aims to reach enforcement without hand-editing DNS. The free tier is genuine, and the paid tiers are quoted rather than listed.
Dmarcian
One of the oldest dedicated DMARC platforms, and a reference implementation for the category for over a decade. Strong free tooling that anyone can use without an account, including a record checker and an XML-to-human converter. The free platform account is restricted to non-business personal use, so budget for a paid plan if the domain belongs to a company.
Red Sift OnDMARC
The strongest fit for a team that wants more than reports. Its differentiator is dynamic SPF, which flattens your record server-side so you stop hitting the ten-lookup limit, alongside hosted DMARC and BIMI. Free trial rather than a free tier.
EasyDMARC
The SMB incumbent, and the product whose content you are most likely to have read on the way here. Free tier for a single domain, paid plans priced by email volume and domain count, and a broad platform underneath: it parses failure reports as well as aggregate ones, hosts your DMARC, SPF, DKIM and BIMI records, and reports on TLS. Also a large managed-service business aimed at MSPs.
Postmark DMARC Digests
The right answer for a domain that needs watching rather than working on. It is free, it is a weekly email, and it shows your top sending sources with a short history. No dashboard, no policy workflow, no cost, no expiry. For a domain already sitting at p=reject that only needs to know when something changes, a weekly email is the correct amount of product.
Cloudflare DMARC Management
Free on every Cloudflare plan if your DNS is already there, and it sets up in a click because Cloudflare can write the record itself. Still labelled beta. It also checks your SPF record against the ten-lookup limit. There is nothing in it about policy advancement, so treat it as visibility rather than a programme.
A note on the security suites
Proofpoint, Mimecast, Agari and Validity take 54 of the 166 records between them, and almost nobody buys them for DMARC monitoring alone. If your company already runs one, the DMARC module is probably included and better resourced than anything you would buy separately. Check what you own before you shop.
How to trial two DMARC tools at once without losing a month of data
Comparing two DMARC platforms honestly means feeding both the same reports over the same weeks, and the obvious way to do that is to put both addresses in your rua list. That works for two. It is where the third-address problem starts, because a trial usually gets added to a record that already has something in it.
- Read your current record first. Run the domain through a DMARC checker and count the addresses already in
rua. An email platform may have added one years ago without telling anyone. - Keep the list at two for the duration. If you already have two, park one rather than appending a third. A trial that silently receives a fraction of your reports produces a comparison that is wrong in the vendor's favour or against it, and you cannot tell which.
- Put the address you are evaluating first. Order is what the receiver honours, so the candidate belongs in position one while you are judging it, not appended to the end.
- Give it at least two weeks. Receivers report on their own schedule and the last day or two is always incomplete. A weekend is not a sample.
- Compare source naming, not report counts. Both tools receive the same XML, so the message totals should broadly agree. What differs is how many IP addresses each one turns into a named service, and that is the actual product.
If you are publishing a DMARC record for the first time rather than replacing one, a DMARC record generator will produce a correct p=none starting record, and our guide to what DMARC is and how it works covers the tags themselves.
What Unspam DMARC monitoring does, and where it stops
Unspam DMARC monitoring collects aggregate reports, resolves them into named sending sources carrying a category and a trust level, and runs a policy readiness check: a named list of what is blocking a stricter policy, rather than a score. The blockers are specific. Not enough reporting days yet, compliance below the threshold, a named source still failing, or traffic nobody has reviewed. It also re-reads your published record on a schedule and tells you if your reporting address disappears from it, which is a failure mode a reports-only tool cannot see, because it can only ever look at reports that arrived.
Two details come straight from how rua ordering works. When Unspam generates your record it puts its reporting address first in the list, and it tells you which position that address held before. If your existing record ends the list before an address, so that the address receives nothing, it repairs the list rather than appending to it.
Where it stops matters just as much. Unspam reads aggregate reports and not failure reports. It does not host your DMARC, SPF, DKIM or BIMI records, and it has nothing to say about TLS reporting. If you want a full authentication platform, EasyDMARC and Red Sift OnDMARC are the right shelf. If you want to know who is sending as your domain and when you can safely raise the policy, this is that.
On price: DMARC monitoring sits on the Unspam Custom plan, which has a $5 a month minimum. The first domain adds nothing to that bill and each domain after it is $6 a month. That is a genuinely free first domain rather than a free plan, and the difference is the one that separates a free tier from a free trial: you need to be spending $5 on something before the free domain is free. To read a single report you already have, without an account, the DMARC report analyzer takes an XML file and returns its contents in plain language.
How to choose one
Start from which of four situations you are in, because they have different answers and only one of them is a shopping problem.
You have no DMARC record at all. Publish p=none with a reporting address and wait two weeks. Any free option will do, including the ones that expire, because you are collecting a baseline rather than choosing a tool.
You have a record and a policy you are afraid to tighten. This is the real category. You want named sources and an explicit blocker list, and you should expect to pay. Judge candidates on how many of your sending IP addresses each one resolves to names, because that number decides how long the project takes.
You already run an enterprise email security suite. Check what you own before buying anything. Roughly a third of the records we read report into a platform the company bought for another reason entirely.
You are at p=reject and only want to know when something changes. A weekly digest is enough, and paying for a dashboard you will open twice a year is not a bargain at any price.
Whichever you pick, publish the record before you finish choosing. Reports only accumulate once an address is in DNS, and every week without one is a week of evidence you cannot get back. If you also want to know how a specific message will land before you send it, run a free spam test and read the authentication results beside the content ones.
