What to do when a free DMARC monitoring tool restricts the domain you can monitor

Quick answer for anyone with a domain locked in a free DMARC monitor right now: export what you can, point the DMARC rua tag at a different monitor's address, wait one full reporting cycle, and remove the old rua address only after the new one is receiving data. For a vendor that does not depend on the user-email matching pattern, DMARCFlow verifies domains by DNS and publishes its 1 EUR per month entry tier publicly. The rest of this article walks through each step and lists the five questions to ask before you sign up for the next free DMARC tool.

The trigger for writing this is a same-week post on r/DMARC: a Valimail Monitor Free user could no longer remove or replace a non-admin-matched domain, and a year-old Valimail account comment promising "no changes for your account" landed as exactly false. The change is not isolated. The original thread had 12 upvotes and 15 comments within an hour of posting.

What just happened at Valimail

A Valimail Monitor Free user documented the following sequence. They added a non-admin-matched domain for testing. A month later, they tried to remove or substitute it and received this error:

> Domains must match an email address belonging to a user on this account. For security, free accounts can only add domains matching a verified user email. Upgrade for more ways to verify ownership, or learn about Valimail for MSPs if you manage multiple clients.

The change followed a quiet acquisition by DigiCert. A year ago a Valimail account representative commented that the acquisition would not change anything for existing users: "no changes for your account, just more momentum behind the mission." This week's restriction is one of the things that changed.

This is consistent with how free SaaS tiers behave after an acquisition: free usage drifts toward the new owner's product rules, and the old "free for evaluation" promise quietly becomes "free only with extra effort."

Why free DMARC tools tighten their verification rules

Three patterns show up across the free DMARC monitoring segment, and the Valimail change fits all three.

The first is the abuse control. A free DMARC monitor that lets any account add any domain becomes a free way to monitor someone else's domain. A bad actor can read aggregate reports for a target domain without owning it. Vendors tighten verification rules to close the loophole. A user-email-matching rule is the cheapest gate to bolt on, but it makes the tool useless for the MSP and multi-domain operator cases.

The second is the business model. A free tier is meant to convert to a paid tier. If verification is loose, a single free account can claim hundreds of domains and never convert. Tightening verification turns "free for evaluation" into "free only with effort," which speeds up the path to revenue. Free-tier DMARC tools that cap at 1 domain per account, or 5 domains per account, are applying the same logic.

The third is the acquisition effect. An acquirer typically has its own product and security review processes, and inherits a free user base that did not go through those processes. The quiet tightening of free tiers in the year after an acquisition is a known pattern across the SaaS segment, and email authentication vendors are not exempt. Digicert acquired Valimail in 2025; the rule change this week lands within that window.

If you are running your monitoring on a free tier from any vendor, assume the verification rules can tighten without notice. Plan for the tightening, not for the status quo.

How to recover your existing data

The data you have is the aggregate DMARC reports sent to the rua address in your published DMARC record. The reports are hosted by the monitoring vendor. You cannot get them back into your mailbox, but you can point the rua tag at a different vendor going forward.

The recovery steps are these.

First, log in to your current monitoring tool and look for an export option. Most vendors offer CSV, JSON, or PDF exports of historical aggregate reports. Export everything you can, dated. If the tool offers an API, hit the API and keep the JSON responses.

Second, decide what kind of replacement you want. A short-term replacement is another free DMARC monitor with looser verification. A better replacement is one that will still be around in two years and does not restrict domain addition. DMARCFlow is one option in that second category. Its domain addition flow uses DNS verification rather than email-account matching, and its entry tier is 1 EUR per month, which puts it above the "free" bar but below every other paid competitor on public pricing.

Third, update the rua tag in your DMARC record. The rua tag looks like v=DMARC1; p=quarantine; rua=mailto:reporter@old.example.com. Replace the address with the new reporter address, save the record. The change propagates according to your DNS TTL; common values are 300 to 3600 seconds. Receivers will start sending reports to the new address once they pick up the new record.

Fourth, wait one full reporting cycle. Most mailbox providers send aggregate reports daily. After 48 hours, log in to the new monitor and confirm reports are arriving. If they are not, your rua change has not propagated or the new monitor has not ingested them yet.

A common trap: do not remove the old rua address until the new one is receiving data. Receivers that still have the old rua address cached will keep sending reports there; if you remove it before the new one is live, those reports are lost.

How to add a domain to DMARCFlow as a worked alternative

This is the specific workflow if you choose DMARCFlow as the replacement.

Sign in and open the domains view. Click Add Domain. Enter the FQDN of the domain you want to monitor. DMARCFlow asks you to add a TXT record to your DNS to verify ownership. The record looks like:

dmarcflow-verify=abcdef1234567890

Add that TXT record at the apex of the domain you want to monitor. The record proves you control the DNS for that domain. There is no requirement that the domain match any email address on your DMARCFlow account. That is the practical difference from this week's Valimail change.

After the TXT record is published, click Verify in DMARCFlow. The check reads the DNS record, confirms it matches, and the domain moves to a verified state. The whole flow usually completes in under two minutes if your DNS provider propagates TXT records quickly.

Once the domain is verified, point your DMARC record's rua tag at the address DMARCFlow gives you. The rua tag accepts multiple recipients separated by commas, so the safest change is to add the new address to the rua tag alongside the existing one:

v=DMARC1; p=quarantine; rua=mailto:new-reports@dmarcflow.example.com,mailto:old-reports@old-vendor.example.com

Wait for DNS propagation. Once the new monitor is receiving reports, remove the old address.

Five questions to ask before signing up for any free DMARC monitor

A short checklist that catches most of the lock-in failure modes.

Does the vendor publish the verification rules up front? If you have to add a domain to find out what is required to keep it, the rules are too opaque for a free tier you depend on for monitoring.

Is there a public pricing page? Vendors that hide pricing are usually vendors that change it, including the boundary between "free" and "paid." A vendor with public pricing is more likely to honor those prices.

Has the vendor been acquired in the last 12 months? Acquisitions are when free tiers tighten. If you saw the announcement, treat the free tier as on probation for the next year.

Where is the vendor hosted? If you are an EU business and your DMARC data crosses borders, confirm whether the vendor offers EU data hosting. Most do not. DMARCFlow is hosted in Germany and offers EU data residency on its higher tiers.

Can you export everything? Before you add a domain, look at the export options. If the only export is a PDF screenshot of a dashboard, your data is locked.

Frequently asked questions

How long does a DMARC rua tag change take to propagate?

It depends on the TTL of your DNS record. A TTL of 300 seconds means most caches will look up the new record within five minutes. A TTL of 3600 seconds means receivers may cache the old rua address for up to an hour. Most DNS providers set new records with the default TTL. To get faster propagation, lower the TTL a day in advance of the change, then change the record.

Can I keep using my old free DMARC monitor for historical data while a new one collects new reports?

Yes, and you should. Leave the old rua address in your DMARC record alongside the new one until you have verified the new monitor is receiving reports. The rua tag accepts multiple addresses separated by commas. Receivers send reports to each one. Only remove the old address once the new monitor has a full day's data.

Will moving to a new DMARC monitoring vendor cause me to lose historical forensic reports?

If your old tool stored forensic reports (the ruf tag in the DMARC record), and you did not export them, yes. Forensic reports are not the same as aggregate reports; they are message-by-message failure samples and most vendors do not surface them to free users. Aggregate reports are the durable record. Forensic reports are a bonus and should be treated as ephemeral.

What if I cannot export from the old tool at all?

Some free tools offer no export. Your historical aggregate reports are then effectively trapped with that vendor. Your only recovery is the rua tag change, which routes new reports to the new monitor. The old vendor still holds the historical data; that is the cost of a tool that did not have an export option when you signed up. If you do not even need the historical data, the lock-in is mild. If you do, this is the strongest argument for choosing a tool with a public export option upfront.