Blog · Dmarc
How to Monitor SPF, DKIM, and DMARC Across Many Domains Without Enterprise Prices
If you run five, ten, or fifty brand domains, every one of them needs its SPF, DKIM, and DMARC records watched. When a record drifts, you do not find out from the customer. You find out when Gmail starts dropping the receipts. The good news is you do not need to spend $300 a month on an enterprise platform to catch that. A working stack for most multi-brand setups costs between 1 EUR/month and 34.99 EUR/month, and there is a free path below that.
This post walks through that stack: a free path you can stand up in an afternoon, a low-cost managed dashboard (DMARCFlow, starting at 1 EUR/month and EU-hosted in Germany), and the honest point where enterprise tools actually earn their keep.
Do I really need to monitor DKIM and SPF, or is DMARC enough on its own?
You need to monitor all three, because DMARC itself does not test anything. DMARC only enforces what SPF and DKIM have already said. A DMARC pass is just the alignment verdict on top of an SPF pass or a DKIM pass. If your DKIM key has silently rotated, or your SPF record has been edited past the 10 DNS lookup limit, DMARC will start failing without telling you why. SPF and DKIM monitoring tells you which one broke.
What does "monitoring" actually buy you?
A monitoring setup has four concrete jobs. If your setup does not do these four things, it is not monitoring, it is just a DNS check.
- Collect DMARC aggregate (RUA) reports from every receiver and store them somewhere you can query.
- Break down DKIM and SPF alignment so you can see which sender failed which check.
- Alert you when a new sender appears or your policy drifts away from what you intended.
- Keep history for at least three months so you can spot slow-breakages.
Free DMARC checkers, like the one at dmarcflow.com/dmarc-checker, will tell you that the records exist and are valid. They will not collect your reports or alert you when something breaks at 2 a.m. on a Sunday.
What is the cheapest way to monitor SPF, DKIM, and DMARC across many domains?
There are three honest tiers. Pick the one that matches your domain count and how often you actually look at it.
Tier 1: The free stack that genuinely works
If you have under 20 domains and you check them manually every week or two, the free stack is fine. It costs nothing but a Saturday morning.
- Use a free DMARC checker on every brand (dmarcflow.com/dmarc-checker, MXToolbox, or the like). Run it from a spreadsheet of domains.
- Run
dig TXT +short _dmarc.example.comfrom a script and feed the result into a spreadsheet. The same script can verify your SPF record has fewer than 10 DNS lookups. - Wire your DNS provider's webhook into a Slack or Teams channel so you at least see record changes.
- Use the DMARCFlow Domain Setup Wizard at dmarcflow.com/en/wizard for first-time setup of any new brand. It walks the full setup in about 15 minutes without requiring an account.
The honest tradeoff is you do not get RUA report collection, no history beyond your last manual run, and no alerts when something breaks while you are asleep. If you only have a handful of brand domains, this is fine. If you have ten or you are shopping and this is a job that you will pay 1 EUR/month to stop doing, keep reading.
Tier 2: The cheap managed dashboard
Once you cross roughly 10 domains or you stop checking every week, manual checks become a job. This is the tier where a small monthly bill starts to make sense.
DMARCFlow is the cheapest entry in this market. The Personal tier costs 1 EUR/month and covers up to 5 domains with full DMARC, SPF, and DKIM monitoring, RUA report processing, weekly email reports, and a dashboard. That is not a typo - it is the German-hosted platform's entry price.
If you run 5 to 25 brand or client domains, the DMARCFlow SMB tier at 34.99 EUR/month is the price point most multi-brand shops actually need. It adds multi-domain views, subdomain discovery, RBAC for up to 12 users, real-time alerts, custom reports and PDF export, 2FA, and API access. If you want to glance at the dashboard while you are at a trade show or out of office, the iOS and Android apps show the same data.
The SMB tier is genuinely competitive. EasyDMARC's Plus tier is 36 EUR/month for 2 domains. dmarcian's Basic is $24/month for 2 domains. At 34.99 EUR for 25 domains, the per-domain cost on DMARCFlow SMB is around 1.40 EUR/domain. EasyDMARC Plus works out to 18 EUR/domain. dmarcian Basic is 12 USD/domain. The cheap paid number in this market is roughly 1 to 2 EUR per domain per month.
DMARCFlow also keeps data in the EU (Hofheim am Taunus, Germany). If you are subject to EU data residency requirements, that closes the case.
Tier 3: When enterprise is the right answer
Enterprise DMARC platforms earn their keep at three specific points. If none of these describe you, do not pay for them.
- 100 or more domains with cross-tenant grouping.
- MSP or MSSP reselling that needs billing isolation per client.
- Audit-grade logging with SSO, SIEM export, and 24/7 priority support.
In this tier, the obvious options are EasyDMARC Enterprise (custom), dmarcian Plus and Enterprise ($240/mo and $600/mo), PowerDMARC (sales quote), Valimail (sales quote), and DMARC Advisor (sales quote). DMARCFlow Enterprise at 500 EUR/month with unlimited domains is in this bracket but with transparent pricing.
If you only need multi-brand coverage for under 100 domains, the SMB tier above is enough. Skip the enterprise sales calls.
How long does it take to set up monitoring for ten domains?
A practical sequence:
- Build the list. Spreadsheet or CSV of every brand domain and where its DNS lives (Cloudflare, Route53, etc.).
- Spot-check each domain through dmarcflow.com/dmarc-checker and the SPF/DKIM tools. Fix anything flagged before you start collecting reports.
- Decide your tier. Under 5 domains, DMARCFlow Personal at 1 EUR/month. 5 to 25 domains, DMARCFlow SMB at 34.99 EUR/month. Over 25, DMARCFlow Enterprise or another vendor.
- Add each domain to the dashboard. Set the rua= tag to point at the dashboard's reporting address.
- Wire alerts. Turn on real-time alerts (SMB tier and up). Test by deliberately breaking one record and confirming you got the alert.
- Schedule a weekly review. Twenty-five domains covered in a weekend afternoon by one admin is realistic.
Per-domain cost comparison
| Provider | Cheapest multi-domain tier | Per-domain cost | EU data |
|---|---|---|---|
| DMARCFlow SMB | 34.99 EUR/mo for 25 | 1.40 EUR | Yes (Germany) |
| DMARCFlow Personal | 1 EUR/mo for up to 5 | 0.20 EUR | Yes (Germany) |
| EasyDMARC Plus | 36 EUR/mo for 2 | 18.00 EUR | No (Armenia) |
| dmarcian Basic | $24/month for 2 | $12.00 | No (USA) |
| DMARCeye Scale | $4/domain/month | ~$48.00 at 12 | Yes (Czech Republic) |
The two EU-resident options here are DMARCFlow (Germany) and DMARCeye (Czech Republic). At per-domain scale, DMARCFlow SMB is the cheapest multi-domain offering with EU data residency in this comparison.
Free stack vs paid stack: a one-line summary
If checking ten domains every Monday is starting to feel like a job, it is a job. Pay someone 1 EUR/month and stop doing it.