Free vs paid DMARC: what each option actually covers

When free is genuinely enough

Let's be clear, because too many articles are afraid to say it: in several cases, free isn't just sufficient — it's the right call.

• A single domain, a simple and stable sending ecosystem. One mail platform and a tool or two, and it almost never changes. Once aligned, it stays aligned.
• A one-off hardening to p=reject, once and for all. The goal is to reach enforcement, then leave it alone. Once p=reject sits on a stable ecosystem, there isn't much to monitor.
• A technically confident owner. Someone who reads a DNS record without flinching, opens an XML file without fear, and isn't sent running by parsing three reports by hand.
• No compliance-evidence requirement. Nobody is asking for a demonstration, with history to back it, that the domain has been protected for six months.

In that profile, a monthly subscription would buy features that will never be used. A free diagnosis up front, a careful policy ramp, an occasional check: that's plenty. A problem nobody has is not worth paying to solve.

When paid earns its cost

Conversely, several situations tip the balance — and there, insisting on doing everything by hand costs more than the subscription, in time and in risk.

• Many domains. Past a handful of domains, manual management breaks down. Each domain has its own source inventory, its own stage, its own daily reports.
• Continuous monitoring is required. The sending ecosystem moves: new vendors appear every month, marketing wires up a tool without warning, a subsidiary opens a flow. Free DMARC monitoring — meaning someone opening XML files now and then — won't catch those changes in time.
• A non-technical team. If the responsible person isn't comfortable with DNS and XML, a service that translates everything into plain language and concrete actions isn't a luxury, it's what makes the project doable.
• Compliance evidence. NIS2, DORA, an audit, a customer demanding assurances: that calls for queryable, exportable history, not a mailbox. Retention and reporting are exactly what a paid service brings.
• No time to parse XML. This is often the real criterion. Technically, it could all be done by hand. But time has a cost, and spending it decoding aggregate reports instead of the actual job is a bad trade.

The underlying link here is that those aggregate reports are precisely what a paid service ingests continuously — understanding what they contain clarifies exactly what gets delegated. For a look under the hood, turning the returns into an inventory explains what they say and why reading them by hand doesn't scale.

Two concrete examples

Nothing beats two opposite cases to make the decision tangible.

Case 1 — The solo founder who hardens once and forgets it. Camille runs a three-person design studio. She sends from a single mail platform and a billing tool. Two sources, that's it, and it won't change for a long time. She runs her domain through a free analyzer, discovers she's at p=none, aligns her DKIM in an afternoon, lets p=none run for three weeks to confirm her reports are clean, then flips to p=quarantine over a weekend and finally p=reject. Total spent: zero. For her profile — one domain, a frozen ecosystem, a technically confident owner — a monthly subscription would be money thrown away. Free isn't a compromise here: it's the right answer. Her one remaining discipline: re-check her domain twice a year, just in case.

Case 2 — The 200-person company where a source appears every month. A 200-employee industrial SME, five brand domains, roughly fifteen subdomains. Marketing launches campaigns from new tools without telling IT; HR has its own emailing platform; an event vendor sends twice a year on the domain's behalf. Every month, a new legitimate source appears in the reports. Here, manual reading is lost from the start: nobody will open the XML of five domains every day, and the day a legitimate source starts failing under p=reject, the email vanishes silently — a customer never gets their confirmation, and the news arrives as a complaint. For this profile, a paid service that ingests reports continuously, names every source, and alerts the moment an unknown sender emerges, pays for itself at the first incident avoided. The subscription cost is trivial against the cost of a critical flow breaking with nobody noticing.

Same standard, same goal (p=reject), two opposite answers — because what's bought isn't protection, it's the ability to maintain it in an environment that moves.

Common mistakes

Two symmetrical traps lie in wait, and they cost dearly in both directions.

• Treating a one-off free check as ongoing protection. The most common error. A domain goes through an analyzer, the verdict reads "p=reject, all green," and the topic gets filed away. Six months later, marketing has wired up three tools, two of them fail alignment, and nobody knows because nobody is watching. A snapshot diagnosis is not an alerting system. Free gives today's position; it raises no warning about what changes tomorrow. An ecosystem that moves needs monitoring — free (someone disciplined, every day — rare) or paid.
• Paying for features a single-domain owner will never use. The inverse error. A founder with one frozen domain has no need for multi-domain management, real-time alerting, or six months of exportable retention. Subscribing to a rich plan "just in case" is like buying comprehensive insurance for a bicycle. The service should be sized to the real risk, not to fear.
• Believing "free" means "effortless." Free is free in euros, not in time. Parsing reports by hand is work. The real trade-off isn't "free versus paid" but "time versus a subscription." That time deserves a price before the conclusion lands.
• Confusing price with fit. The cheapest isn't the best, and neither is the most expensive. The right choice is the one that matches the domain count, the ecosystem's stability, and the team's technical level. The criteria that actually matter are detailed in the features of a DMARC analyzer.

A decision shortcut

If one grid is worth keeping, here it is. Three questions:

1. How many domains? One, stable → free is probably enough. Several, or growing → lean toward paid.
2. Does the sending ecosystem move? Frozen → free holds. Shifting (new sources regularly) → continuous monitoring becomes necessary.
3. Is compliance to be proven, and is there time to parse XML? Evidence required or zero time → paid is justified. Neither, plus technical comfort → free stays the answer.

Three "yes" on the free side: free without hesitation. Two or three "yes" on the paid side: the subscription pays for itself. It's that simple, and above all: it's a decision to make consciously, not a sales reflex to submit to. For what a paid offer concretely covers and at which tier, our pricing page details the plans by domain count.

In one sentence

DMARC is free; what costs money is having it run by someone else when the domains are too many, the ecosystem moves, the team isn't technical, or compliance has to be proven — otherwise, a good free diagnosis and a careful policy ramp are plenty.

Either way, better to start from the fact, not the subscription. A pass of the domain through our analyzer says in ten seconds where the posture stands, and therefore whether a paid service would really bring anything. If the verdict reassures and the profile is simple, the answer is there. If it reveals an ecosystem more mobile than expected, creating an account lets Thomas, the virtual CISO, ingest the reports, name the sources and say what to harden safely. Free answers "where does the domain stand?"; paid answers "how does that stay true, unattended, over time?".