Publishing a DMARC record is the easy part. The hard part is the weeks afterward, when
aggregate reports start arriving as gzipped XML from Google, Microsoft, Yahoo and everyone else,
and you have to work out which of the sixteen sending sources in them are actually yours before
you can safely move to p=reject. That is what these tools are for. The full
background on the records themselves is in
SPF, DKIM and DMARC explained.
Comparison at a glance
| Tool | Type | Free tier | Best for |
|---|---|---|---|
| Postmark DMARC Digests | Report analyzer | Fully free | One domain, weekly email digest |
| Cloudflare DMARC Management | Report analyzer | Fully free | Domains already on Cloudflare DNS |
| dmarcian | Full platform | Limited trial | Guided path to enforcement |
| EasyDMARC | Full platform | Limited free tier | MSPs and multi-domain estates |
| Valimail | Full platform | Free "Monitor" tier | Enterprises wanting automation |
| URIports | Report analyzer + CSP/NEL | Trial | Teams also collecting browser reports |
| parsedmarc | Open source | Free, self-hosted | Data into your own SIEM |
| MXToolbox | Record checker | Free lookups | Validating record syntax |
Free report analyzers
1. Postmark DMARC Digests
Point your rua address at Postmark and receive a weekly plain-English email
summarizing who sent mail as your domain and whether SPF and DKIM passed. It is completely free,
has no upsell attached, requires no account beyond signup, and takes about two minutes to set up.
For a company with one domain and a handful of sending services, this is genuinely all you need. Limits: weekly cadence, one domain, and summary-level detail rather than deep forensics.
2. Cloudflare DMARC Management
If your DNS is already on Cloudflare, this is built into the dashboard at no cost. Cloudflare receives the aggregate reports, parses them, and shows sources with pass/fail breakdowns and trend charts. Setup is close to a single click since it manages the DNS record for you.
Limits: you need to be a Cloudflare DNS customer, and it covers aggregate
(rua) reports rather than forensic ones.
Paid platforms
3. dmarcian
Founded by one of the authors of the DMARC specification, and it shows in the product's opinionated guidance. Beyond parsing, dmarcian identifies sending sources by name (recognizing that an unfamiliar IP block belongs to a specific marketing platform, for instance), which is the single most time-consuming part of the job. Its "Domain Catalog" tracks progress toward enforcement across many domains.
Best for: teams who want to reach p=reject deliberately and want
the tool to tell them what to fix next.
4. EasyDMARC
A broad platform covering DMARC, SPF and DKIM management with hosted record services (SPF macros to stay under the ten-lookup limit, hosted DKIM), plus multi-tenant features and white labeling aimed at MSPs. Pricing is competitive and there is a usable free tier for a single domain.
Best for: agencies and MSPs managing email authentication for many client domains from one console.
5. Valimail
Enterprise-focused, with a free "Monitor" tier that is more capable than most free offerings. Valimail's distinguishing feature is automated enforcement: rather than making you hand-edit SPF includes as vendors change, it manages authentication for known services and pushes you toward enforcement with less manual record surgery.
Best for: larger organizations with many sending services and limited appetite for editing DNS records.
6. URIports
Handles DMARC reports alongside browser-generated reports (Content-Security-Policy violations, Network Error Logging, Certificate Transparency). If you are already setting up CSP reporting from your security headers work, consolidating both report streams in one place is a reasonable simplification.
Open source
7. parsedmarc
A Python tool that fetches DMARC reports from an IMAP mailbox or S3, parses aggregate and forensic reports, enriches them with geolocation and reverse DNS, and ships the results to Elasticsearch, OpenSearch or Splunk with prebuilt dashboards. It is the standard answer for keeping report data inside your own infrastructure.
Cost: free software, plus hosting the mailbox, the parser and the search stack, plus maintaining dashboards. Sensible if you already run Elasticsearch, heavy if you do not.
Record checkers (a different job)
8. MXToolbox and friends
MXToolbox, dmarcian's free record checker and similar tools validate the syntax and content of a published record: is the DMARC record well formed, is SPF within its ten-lookup budget, does DKIM resolve for a given selector. This is a one-off lookup, not monitoring, and it is the right tool while you are drafting records.
The gap most teams miss
Everything above analyzes reports about mail. Nothing above watches your records for change, and those fail differently:
- A vendor migration edits SPF and pushes it past the ten-lookup limit, which returns a permanent error and silently disables SPF entirely.
- Someone sets
p=none"temporarily" during a deliverability incident, and it stays that way for two years. - A subdomain policy is added that is weaker than the parent's.
- Parked and secondary domains, the favorite spoofing targets, have no records at all because nobody was watching them.
A DMARC analyzer will not flag any of those, because from its perspective mail is still flowing
and reports are still arriving. Catching them means monitoring the DNS records themselves as
public configuration that can drift. That is a job for
external attack surface monitoring,
Bastion included: we check SPF lookup budget, DMARC policy strength and CAA presence on every
scan. We do not aggregate rua reports, so if you are working toward enforcement,
pair a report analyzer from this list with record monitoring. They answer different questions.
What to pick
- One domain, want to reach enforcement: Postmark DMARC Digests, free, this afternoon.
- Already on Cloudflare DNS: turn on DMARC Management, also free.
- Complex sending estate, want guidance: dmarcian or Valimail.
- Managing client domains: EasyDMARC.
- Data must stay in-house: parsedmarc.
- Any of the above: add record monitoring so a policy downgrade does not go unnoticed for a year.
Frequently asked questions
Is there a free service that can monitor DMARC?
Yes, and two of them are genuinely good. Postmark DMARC Digests parses your aggregate reports and emails a weekly plain-English summary at no cost for a single domain. Cloudflare DMARC Management is free and built into the dashboard if your DNS is on Cloudflare. Valimail also offers a free Monitor tier. For most small companies one of these is sufficient to reach a DMARC reject policy.
What does a DMARC analyzer actually do?
DMARC aggregate reports arrive as gzipped XML from every receiving provider, listing sending IPs and whether SPF and DKIM passed and aligned. An analyzer collects those reports, parses them, groups sending IPs into recognizable services, and shows which of your senders authenticate correctly. That is what tells you it is safe to move from p=none to p=quarantine and then p=reject without blocking your own legitimate mail.
What tool can I use to check if my DMARC record is valid?
MXToolbox, dmarcian's free record checker and most email security vendors offer free syntax lookups that confirm a DMARC record is well formed and report your policy. Check SPF at the same time, since the ten-DNS-lookup limit is the most common silent failure: past ten lookups, SPF returns a permanent error and stops working entirely.
Do I still need DMARC monitoring after reaching p=reject?
Yes, for two reasons. Reports remain your view of who is attempting to spoof your domain and whether a new internal service has started sending without authenticating, which would now be rejected. And records drift: vendor migrations edit SPF, policies get loosened during deliverability incidents and are not restored. Keep reporting on, and monitor the records themselves for change.