In short
Valimail is an automated DMARC platform, now a DigiCert company, with free Monitor for visibility, Enforce for sender authorisation and enforcement, and Amplify for BIMI. Its Instant SPF uses SPF macros to work around the 10-lookup limit. We supply Valimail Core and Pro to UK organisations through Pax8, with terms confirmed at quote.
Get a quote for Valimail
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What Valimail is
Valimail's approach is automation through DNS delegation. Instead of reading IP addresses in raw reports, it resolves them to named services: in its own example, not "104.47.51.33" but "Microsoft 365" (opens in a new tab). Instead of a DNS change for every new sender, it authorises senders against records it updates for you. Its public product line has three parts:
| Product | What Valimail says it does | How it is sold |
|---|---|---|
| Monitor (opens in a new tab) | Free visibility into every service sending as your domain, identified by name | Free, with no credit card |
| Enforce (opens in a new tab) | Automates SPF, DKIM and DMARC record management, handles sender authorisation and gets the domain to enforcement | By quote |
| Amplify (opens in a new tab) | An add-on for Enforce customers that automates BIMI and helps you get a mark certificate | By quote |
Valimail's pricing page (opens in a new tab) lists Monitor as free and Enforce and Amplify as priced on request. For managed service providers, and for us, Valimail also sells two per-domain editions on the Pax8 marketplace, Valimail Core and Valimail Pro.
Ownership. DigiCert acquired Valimail in September 2025, and Valimail now calls itself "Valimail, a DigiCert company". Its announcement told existing customers that nothing changes for their account or login (opens in a new tab), with no planned migrations or new credentials.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Valimail Monitor: free DMARC visibility
Valimail Monitor (opens in a new tab) is the free starting point. It shows:
- Your senders by name: it identifies thousands of known sending services, so legitimate senders stand out from bad actors
- Enforcement status: which domains pass and fail DMARC, with aligned SPF and DKIM (opens in a new tab) and overall disposition
- Mailbox provider readiness: a check against Google, Microsoft and Yahoo's DKIM, SPF and DMARC requirements
- A BIMI preview: upload your logo and see how it could look in the inbox
- A weekly report that, in Valimail's words, shows which domains are passing and failing (opens in a new tab) DMARC, aligned SPF and DKIM, for primary domains and subdomains
Connecting Monitor is a reporting change only. You add Valimail's reporting address (shown in your Monitor account) to the rua tag of your DMARC record, or, if you have no record, create one such as v=DMARC1; p=none; rua=mailto:(address from Valimail). Valimail says no change to your email flow will occur (opens in a new tab) and you keep managing the record in your own DNS. Monitor can connect automatically (opens in a new tab) for DNS hosts that support it, and the first reports usually arrive the next day. Monitor gives visibility; acting on what it finds is the job of Enforce.
Valimail Enforce: automated enforcement
Valimail Enforce (opens in a new tab) is where Valimail takes over the records. The products page (opens in a new tab) lists one-click sender authorisation, real-time threat blocking, custom policy configuration, "unlimited, hidden SPF records" and automated SPF, DKIM and DNS management.
Once your DMARC record is delegated to Valimail, you manage it in Enforce (opens in a new tab): the policy (none, quarantine or reject), the subdomain policy, a policy for non-existent subdomains (np), the RFC 9989 testing mode (t) and the public suffix domain flag (psd, which Valimail calls the Organizational Domain Boundary), strict or relaxed alignment, and extra rua and ruf addresses. RFC 9989 removed the pct tag (it is now historic); Valimail labels the setting deprecated and shows it only for domains that already use it.
The account overview (opens in a new tab) shows mail sources on a world map, suspicious mail by country, delivery outcomes (allowed, quarantined or rejected), top senders and DMARC, DKIM and SPF failure rates over 7 to 90 days.
Microsoft 365 and Google Workspace. Valimail's Microsoft page (opens in a new tab) describes a Microsoft 365 Mailbox Connector that shows services emailing your own staff, such as payroll messages, a Microsoft Sentinel connector for Enforce events, and a Trusted Domains feature that reads your tenant's domain list to find unprotected domains. Valimail also describes full Google Workspace integration (opens in a new tab). See DMARC for Microsoft 365 and DMARC for Google Workspace.
Is Valimail the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Instant SPF and how Valimail set-up works
Instant SPF is Valimail's answer to SPF's 10 DNS lookup limit (opens in a new tab). Rather than listing every sender, your SPF record uses macros already defined in the SPF standard (opens in a new tab). When a receiver checks a message, the macros pass the sending IP (%{i}), the EHLO name (%{h}) and the domain (%{d}) to Valimail, which returns only the SPF rule for that service (opens in a new tab): mail from Microsoft 365 gets the Microsoft 365 include, and nothing else. Valimail says this means your full list of senders is not exposed in public DNS (opens in a new tab), and contrasts it with flattened records, which it calls static.
The DNS records. Valimail's set-up guide (opens in a new tab) describes "one-time updates in your DNS for three records":
| Record | Name | What you publish |
|---|---|---|
| DMARC | _dmarc.example.co.uk | An NS record delegating to ns.vali.email (or a CNAME where your DNS host cannot delegate) |
| DKIM | _domainkey.example.co.uk | An NS record delegating the DKIM selectors to Valimail |
| SPF | example.co.uk | v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all (back up your old record first; other includes can go before ~all) |
Valimail says pointing SPF to it does not change the contents of the SPF record (opens in a new tab), only where it is managed. If DMARC points to Valimail with a TXT record instead, Valimail receives reports but shows the domain as "Reporting Only", and the record cannot be managed in Enforce.
Failure (RUF) reports in Valimail
Valimail handles failure reports through a feature it calls RUF+:
- Failure Reports (opens in a new tab): in Valimail Enforce, under Failure Insights, you can open each failure report a receiver sent and see why the message failed. Valimail says the feature is available to accounts that opt in, and needs no extra connection because it is built on the RUF reports you receive
- Failing Senders report (opens in a new tab): available on Valimail Enforce Enterprise accounts, it identifies the staff who receive email from a failing service, to help you find the owner of a service nobody has told IT about. It uses the Microsoft 365 or Google Workspace mailbox connector
- Extra ruf addresses can be added to a delegated DMARC record from the domain's configuration page in Enforce (managing the DMARC record (opens in a new tab))
Valimail's article also notes that many large mailbox providers, including Microsoft and Google, do not send failure reports, so aggregate reports remain the main source of evidence. Our DMARC reports guide explains the difference between rua and ruf reports and what personal data failure reports can contain.
Amplify and BIMI
Valimail Amplify (opens in a new tab) adds BIMI to Enforce. Valimail describes single-click logo configuration, management of multiple brands, domains and logos, and help acquiring and managing a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). It is for organisations already at DMARC enforcement.
The BIMI Group (opens in a new tab) explains the requirements: SPF or DKIM aligned with your From domain, DMARC at quarantine or reject, and a logo in SVG Tiny-PS. Gmail and Apple require a mark certificate, while some providers may show a logo without one. Each mailbox provider decides for itself whether to display a logo, so BIMI improves your chances rather than promising a result. For managed service providers, BIMI management is part of Valimail Pro.
How we help with Valimail
We supply Valimail Core and Valimail Pro through the Pax8 marketplace, billed monthly, with terms confirmed at quote. We can:
- Assess your domains: start with free Valimail Monitor or our DMARC checker to see where each domain stands
- Choose the edition: Core for automated DMARC, SPF and DKIM management; Pro if you also want BIMI, MTA-STS, API access or advanced alerting
- Plan the DNS changes: the _dmarc and _domainkey delegations and the Instant SPF record, with your DNS host
- Move you to enforcement: authorise your genuine senders and plan each policy step per domain
Contact us for free advice or a Valimail quote. Comparing platforms? See EasyDMARC vs Valimail and EasyDMARC.
More on Valimail
Frequently asked questions
Is Valimail free?
Valimail Monitor is free, with no credit card: it identifies your senders and sends a weekly DMARC report. Valimail Enforce and Amplify are priced by quote (opens in a new tab), as are the Valimail Core and Pro editions we supply through Pax8. Ask us for a quote.
Who owns Valimail?
DigiCert acquired Valimail in September 2025, and the company now calls itself "Valimail, a DigiCert company". Valimail told existing customers that nothing changes for their account or login (opens in a new tab).
Does Valimail change my mail flow?
No. Monitor only needs Valimail's address in your rua tag, and Valimail says no change to your email flow (opens in a new tab) occurs. Enforce manages DNS records through delegation; your email still flows through your own email service.
What is Valimail Instant SPF?
Instant SPF is Valimail's method for getting past SPF's 10-lookup limit. Your SPF record uses SPF macros, so receivers ask Valimail for the rule that applies to the sending service, and only that service's include (opens in a new tab) is returned. Your full sender list is not published in DNS.
Does Valimail show DMARC failure (RUF) reports?
Yes, through its RUF+ features. Failure Reports (opens in a new tab) in Enforce let opted-in accounts investigate each failure report received, and the Failing Senders report (opens in a new tab) on Enforce Enterprise helps identify the owner of a failing service.
Still have a question about Valimail?
Ask us and a member of our team will get back to you.
More DMARC guides
EasyDMARCEasyDMARC: DMARC monitoring, Managed DMARC and EasySPF explained.DMARC managementManaged DMARC: hosted records, controlled policy changes and how we help.DMARC reportsAggregate (rua) and failure (ruf) DMARC reports explained.DMARC checkerLook up any domain's DMARC record, test the syntax and see what each tag means.