In short
EasyDMARC is an email authentication platform with DMARC reporting, hosted DMARC (Managed DMARC), EasySPF flattening, Managed DKIM, BIMI and MTA-STS. For UK buyers, reports sent to its .eu reporting addresses are processed in AWS Ireland. We supply EasyDMARC through the Pax8 cloud marketplace and can bill it monthly, terms confirmed at quote.
Get a quote for EasyDMARC
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What EasyDMARC is
EasyDMARC describes itself as an Email Trust Platform (opens in a new tab) with "four modules" and "one operating view across your email infrastructure". The current release is branded EasyDMARC V3. The four modules are:
| Module | What it covers |
|---|---|
| DMARC | Aggregate and failure report dashboards, Managed DMARC, EasySPF, Managed DKIM (opens in a new tab), Managed BIMI and Managed MTA-STS |
| Sender Insights | Mail streams, delivery analytics, inbox placement tests, email investigation and reputation monitoring |
| DNS Manager (opens in a new tab) | DNS management across providers, with versioning, audit history, rollback and verification |
| Threat Intelligence | Malicious IPs, lookalike domains and other signs of impersonation and domain abuse |
Two points matter when you are assessing it. First, EasyDMARC is not in your sending path: its homepage says it runs alongside your mail flow (opens in a new tab), "not inside it", so your email carries on if the platform has an outage. Second, it works with what you already have: EasyDMARC's MSP FAQ (opens in a new tab) says Microsoft 365, Google Workspace, your email gateway and your DNS provider "keep performing their normal roles". It says it handles metadata and delivery signals only, not email content; its privacy policy (opens in a new tab) notes that subject lines are stored only if you use failure (RUF) reports.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
DMARC reporting and monitoring
EasyDMARC's reporting and monitoring (opens in a new tab) module is built around three stages: Monitor, Enforce and Maintain.
- Aggregate (RUA) reports are turned from XML into dashboards, classified and grouped by sending source, with vendor-level detail, blocklist checks, filtering and geolocation
- Failure (RUF) reports show the From address, subject line, date and header of each failing message, where receivers send them
- In-workflow guidance walks you through configuring SPF with EasySPF and DKIM with Managed DKIM for each sending source
- Alerts cover DMARC, SPF and DKIM records that change or fail validation, blocklist listings and changes in email volume; the wider Alerting (opens in a new tab) module lets you set conditions, thresholds and severity
EasyDMARC draws a useful line between the two terms: DMARC reporting organises the data your domain receives, while DMARC monitoring is the ongoing process of watching sources, authentication rates and record changes over time. Our DMARC reports guide explains what is inside each report type.
Hosted records: Managed DMARC, EasySPF and Managed DKIM
The biggest time saver is hosting your records with EasyDMARC, so policy and sender changes happen in a dashboard rather than in DNS:
| Feature | What you publish once | What you then manage in EasyDMARC | Notes |
|---|---|---|---|
| Managed DMARC (opens in a new tab) | A CNAME at _dmarc pointing to EasyDMARC | The p, sp, pct, aspf, adkim, rua, ruf, fo and ri tags | Ramps, one-click rollback, pre-save validation, versioned history, approvals and role-based access (EasyDMARC still offers pct ramps; RFC 9989 has made pct and ri historic, with t=y as the testing replacement for pct) |
| EasySPF (opens in a new tab) | One EasySPF TXT record | Your authorised sending sources, custom includes and IP ranges | Dynamic flattening keeps you under the SPF 10-lookup limit; it can be used without DMARC |
| Managed DKIM (opens in a new tab) | A one-time NS delegation of _domainkey | Selector records (TXT or CNAME) across domains and services | The sending system keeps control of the private signing key and selector rotation |
Why SPF needs help. SPF allows at most 10 DNS lookups (opens in a new tab) when a receiver checks your record, and every include, a, mx and redirect counts, including those nested inside your providers' own includes. A business using Microsoft 365, a marketing platform, a CRM and a helpdesk can pass that limit, and the record then fails with a PermError. EasySPF flattens the includes into IP ranges and, in EasyDMARC's words, refreshes them "when a provider's published SPF data changes".
You keep your DNS. EasyDMARC says it hosts the DMARC policy record "while your team retains full control of the DNS zone". If a subscription ends, its support article says Managed DMARC and EasySPF records keep working (opens in a new tab) but can no longer be changed, and it advises moving back to standard records first. Which plans include each feature is covered on EasyDMARC pricing.
Is EasyDMARC the right fit for you?
We will check it against your systems and requirements and recommend the right option.
BIMI, MTA-STS and TLS reporting
Beyond DMARC itself, EasyDMARC manages two related standards:
- Managed BIMI (opens in a new tab): you upload your logo, publish one CNAME, and EasyDMARC validates and hosts the logo, manages the BIMI record and guides the certificate steps. Its prerequisites are DMARC at enforcement, an SVG Tiny P/S logo and, for Gmail, a VMC or CMC issued by an external certificate authority. BIMI Reporting (opens in a new tab) shows reported brand impressions by mailbox provider
- Managed MTA-STS (opens in a new tab): after a one-time CNAME set-up, policy changes made in EasyDMARC apply automatically, and JSON TLS reports are turned into charts
BIMI only lets a mailbox provider consider showing your logo: the BIMI Group (opens in a new tab) says each provider has its own criteria, so no platform can promise the logo appears. MTA-STS (RFC 8461 (opens in a new tab)) protects mail coming into your domain by asking senders to use verified TLS; the NCSC recommends starting in testing mode with TLS reporting (opens in a new tab) for at least a month.
EasyDMARC for MSPs, integrations and the API
EasyDMARC has a dedicated MSP platform (opens in a new tab) with multi-tenant client management, roles, permissions, SSO, audit history and white-label reports and alerts. Its DMARC for MSPs (opens in a new tab) page adds grouping by client, region or tag, bulk actions, optional read-only client access and per-domain roles.
Its integrations directory (opens in a new tab) lists:
| Type | Examples listed by EasyDMARC |
|---|---|
| DNS providers | Cloudflare, AWS Route 53, Azure DNS, GoDaddy, Google Cloud DNS, Namecheap, OVHcloud and others |
| Sending platforms | Microsoft 365, Google Workspace, Amazon SES, HubSpot, SendGrid, Mailchimp, Mailgun, Salesforce, Shopify, Klaviyo and others |
| Reputation and security | Google Postmaster, Microsoft SNDS, Microsoft Sentinel and Splunk |
| Collaboration | Slack, Google Chat and Microsoft Teams |
| MSP tools | ConnectWise, Autotask PSA, HaloPSA, SyncroMSP, Acronis and Pax8 |
SSO works with Okta, Microsoft Entra ID and Google Workspace over SAML 2.0. The EasyDMARC API (opens in a new tab) (v1.0) lets security teams pull aggregate and failure reports into a SIEM, onboard domains in bulk and run batch DNS checks. Bulk onboarding can use Direct Connect for supported DNS providers.
Data residency, security and getting started
Where reports are processed. EasyDMARC's data hosting page (opens in a new tab) says the region depends on the reporting hostname in your DMARC record. Reports sent to rua.easydmarc.eu and ruf.easydmarc.eu are processed in AWS eu-west-1 (Ireland), for customers wanting EU data residency; .com and .us addresses go to the US, with other regions for Australia and New Zealand, Canada and Asia. If location matters to you, we can set your records up with the .eu addresses from the start.
Security. EasyDMARC's Trust Center (opens in a new tab) lists an annual SOC 2 Type 2 audit, a SOC 3 report, AES-256 encryption at rest and TLS in transit.
Getting started:
- Try EasyDMARC's free public tools (opens in a new tab) (DMARC checker and generator, SPF, DKIM, BIMI and MTA-STS tools, a report analyser and a domain scanner), or our own DMARC checker and DMARC generator
- Start the 14-day free trial (opens in a new tab); EasyDMARC says no credit card is needed
- Add your domains and publish the DMARC record, either as a TXT record or as a Managed DMARC CNAME (DNS records (opens in a new tab))
- Moving from another tool? EasyDMARC's migration steps (opens in a new tab) change only the reporting destination, with mail flow unchanged, and can import historical reports
- Work through the sources it finds, then switch on EasySPF and Managed DKIM where they help
How we help with EasyDMARC
We supply EasyDMARC through the Pax8 cloud marketplace, so the licence can sit alongside your other software and be billed monthly, with terms confirmed at quote. We can:
- Assess your domains: review your current DMARC, SPF and DKIM records and how many domains and how much email you send, which decides the plan
- Choose the plan: match DMARC Plus, DMARC Premium, Deliverability, Enterprise or the MSP plan to the features you need
- Set up reporting: point each domain at EasyDMARC, using the EU reporting addresses if you prefer
- Move you to enforcement: work through the senders it finds, set up EasySPF and Managed DKIM, and plan each policy step
Contact us for free advice or an EasyDMARC quote. Comparing platforms? See EasyDMARC vs Valimail and Valimail.
Frequently asked questions
What is EasyDMARC?
EasyDMARC is a platform for monitoring and managing email authentication. It turns DMARC reports into dashboards, hosts your DMARC, SPF and DKIM records so you can change them from one place, and adds BIMI, MTA-STS, DNS management and deliverability modules. EasyDMARC calls it an Email Trust Platform (opens in a new tab). We supply it through Pax8.
Is EasyDMARC free?
EasyDMARC has free public tools and a 14-day trial, and its plans are paid; see EasyDMARC pricing for the free options and plans.
Does EasyDMARC sit in the mail flow?
No. EasyDMARC reads DMARC reports and hosts DNS records; it does not relay your email. Its homepage says it runs alongside your mail flow, not inside it (opens in a new tab), so your email carries on if the platform has an outage.
Can EasyDMARC handle SPF records over 10 lookups?
Yes, through EasySPF (opens in a new tab). You publish one EasySPF record and EasyDMARC flattens your providers' includes into IP ranges, refreshing them when providers change their published SPF data, so the record stays within SPF's 10-lookup limit.
Where does EasyDMARC store DMARC reports?
It depends on the reporting address. EasyDMARC's data hosting page (opens in a new tab) says reports sent to its .eu addresses are processed in AWS Ireland, and .com addresses in the US. EasyDMARC lists no UK-only region, so UK organisations wanting European processing usually use the .eu addresses.
What happens to Managed DMARC records if we stop using EasyDMARC?
EasyDMARC's support article says Managed DMARC and EasySPF records keep working after a subscription ends (opens in a new tab), but you can no longer change them. It advises replacing them with standard records before you leave, which we can help with.
Still have a question about EasyDMARC?
Ask us and a member of our team will get back to you.
More DMARC guides
ValimailValimail: automated DMARC monitoring and enforcement with Instant SPF.DMARC managementManaged DMARC: hosted records, controlled policy changes and how we help.DMARC checkerLook up any domain's DMARC record, test the syntax and see what each tag means.DMARC report analyserHow DMARC report analysers turn XML reports into readable dashboards.