DMARCLY Review: SPF, DKIM and DMARC Monitoring Without the Engineering Project

Quick Verdict

DMARCLY is a DMARC, SPF and DKIM monitoring platform with a genuinely useful trick: at signup it creates two private mailboxes for you — one for aggregate reports, one for forensic reports — and embeds their addresses in the DMARC record it generates. Reports accumulate there, get parsed automatically, and surface as charts you can act on. That removes the two chores that kill most DMARC projects: collecting reports and decoding them.

Pricing starts at $17.99 per month for the Professional plan: two domains, 100,000 compliant messages a month, two months of history and one user. Growth ($39.99), Business ($69) and Enterprise ($199) scale domains, volume, history and users; Enterprise adds API access, user access control and SAML single sign-on. Every plan carries a 14-day trial, and generator and checker tools are free without an account.

The honest caveats: there is no free tier, so a single personal domain pays from day one; data history is short on the cheaper plans; and the Safe SPF feature that fixes the 10-DNS-lookup problem is rationed by tier — one domain on Growth, two on Business, four on Enterprise, and none on Professional. Our analysis found DMARCLY a strong fit for teams that send real transactional or marketing email; it is overkill for a hobby domain and priced accordingly.

🤔 What Is DMARCLY?

DMARCLY is a hosted email-authentication service that monitors SPF, DKIM and DMARC for your domains and helps you reach enforcement. It is not a gateway, spam filter or secure email service: it never sits in your mail path or quarantines messages. Think of it as observability for the records that decide whether your mail is trusted, plus the dashboards and alerts that make those records manageable without an email engineer on staff.

The company presents itself as a small team of email specialists, some with more than a decade spent building mainstream email systems such as Microsoft Exchange and running open-source mail transfer agents like Postfix. Its leadership is named on the site — Andrew Hawkins as CTO and Gangcai Lin as CEO — and it states GDPR compliance, which matters when the data flowing through the platform is a log of who is sending mail as your brand.

⚙️ Key Features

Report collection and parsing, handled end to end

Two private mailboxes are provisioned when you sign up: one for aggregate reports, one for forensic. When you generate your DMARC record in the dashboard, those addresses are written into it, and mailbox providers send their reports straight there. DMARCLY then parses the XML in the background and renders it as charts. The analytics can be viewed by domain, sending source, organisation, authentication result and country — which is how you discover that a newsletter platform you forgot about has been failing DKIM for months.

Safe SPF and the 10-lookup trap

SPF permits only ten DNS lookups during validation. Exceed that and you get a PermError, which can send legitimate mail to spam — usually right after someone adds a new marketing tool to the record. DMARCLY’s Safe SPF is designed to break that ceiling with precise, continuously updated validation instead of manual record trimming. It is one of the few features here that solves a problem rather than describing one, which is why its tier limits are worth reading carefully: no Safe SPF domain on Professional, one on Growth, two on Business and four on Enterprise.

Guided enforcement with reports and DNS alerts

Moving from p=none to p=reject is where DMARC projects stall, because every unknown sender becomes a business risk the moment you start blocking. DMARCLY frames the upgrade path explicitly as monitoring, then quarantine, then reject, and supports it with periodic summaries you can schedule daily, weekly or monthly, plus alerts whenever DMARC, SPF or DKIM records change in DNS. Unidentified senders appear in an actions list so you can label them legitimate or not — the kind of workflow that turns a report into a decision.

BIMI, MTA-STS, TLS reporting and blacklist monitoring

Beyond the core trio, the platform renders ARC results when local policy overrides the final disposition, publishes the records needed for BIMI (the brand logo in supported inboxes) and for MTA-STS and TLS reporting, which guard against man-in-the-middle delivery over unencrypted connections. Adaptive blacklist monitoring checks the reputation of the IPs actually sending your outbound mail against Spamhaus ZEN, the SpamCop Blocking List, the Barracuda Reputation Block List and the Passive Spam Block List. Together these features push DMARCLY past a report viewer and toward a deliverability dashboard.

Security controls and MSP tooling

The account layer is more serious than the price suggests: enforceable two-factor authentication, single sign-on with SAML providers including Azure AD, Google and Okta on Enterprise, user access control, an API, and encryption for forensic reports including PGP. Agencies get an MSP dashboard for switching between client domains and checking each client’s DMARC, DKIM and SPF status. Outside the paid product, DMARCLY also publishes free SPF, DKIM, DMARC and BIMI generators and checkers, and will email you a free DMARC report on your own domain.

💰 Pricing & Plans

DMARCLY sells four monthly plans, all with a 14-day free trial and no free tier. Domain counts, monthly compliant-message volume, data history and user seats are the four variables that move as you climb. The table below reflects the published figures at the time of our analysis — check current pricing on the site before subscribing.

The step that matters most is Professional to Growth: you go from two domains to eight, gain Safe SPF and live chat support, and triple your history. If you manage a handful of client domains, Growth is usually the honest entry point — and if you need API access, single sign-on or an audit-length history, only Enterprise will do. Every tier includes aggregate and forensic report processing, forensic report encryption, automatic subdomain detection, email vendor identification, IP reputation monitoring, GeoMaps, BIMI, MTA-STS and TLS reporting, the record checkers, periodic reports and alerts, and two-factor authentication.

⚔️ DMARCLY vs. Competitors

DMARC monitoring has commoditised in the last few years, so the real question is which trade-off suits your team: price, data history, or how much hand-holding you want.

Verdict: on features per dollar, DMARCLY is competitive in the middle of the market — undercutting EasyDMARC’s entry price while including forensic encryption, BIMI and blacklist monitoring. It loses at the bottom, where dmarcian and Postmark cost nothing, and at the top, where procurement prefers vendors with published enterprise references.

🎯 Who Should Use DMARCLY?

• Small and mid-sized companies sending transactional email from their own domain — invoices, password resets, order confirmations — where spoofing damages both trust and deliverability.
• Agencies and MSPs monitoring multiple client domains and needing a fast, per-client status view.
• Teams with SPF lookup errors who have hit “too many DNS lookups” and need Safe SPF rather than manual record surgery.
• Gmail and Microsoft 365 senders moving toward a rejection policy who want monitoring to prove nothing legitimate breaks first.

🚫 Who Should Skip It

• Single-domain hobby setups. dmarcian’s free Personal plan and Postmark’s free weekly digest cover that ground for nothing.
• Anyone wanting a free tier with real volume. There is a 14-day trial and then a subscription; DMARCLY does not have a permanent free plan.
• Long-retention requirements on a budget. Two months of history on Professional is short for annual audits or seasonal traffic comparisons.
• Teams expecting a mail gateway. DMARCLY monitors and reports; it does not filter, quarantine or deliver your email.

❓ Frequently Asked Questions

🏁 Final Verdict

DMARCLY does the unglamorous work of DMARC well: it takes reports you would never read, turns them into something you can act on, and nudges you through the enforcement ladder until your domain refuses to be spoofed. Safe SPF, forensic encryption, BIMI, MTA-STS and blacklist monitoring in the same product at $17.99 to $69 a month is a fair deal for a business that sends real email, and the free record tools are genuinely useful even if you never subscribe.

It is not the cheapest way to watch one domain, and its short data history on lower tiers will irritate anyone preparing for an audit. But if your email is part of your revenue and you want the whole job — collect, parse, alert, enforce — handled in one dashboard, DMARCLY earns its place on the shortlist.