We are a managed service provider that got tired of the tooling.
We ran email authentication for our own clients, and the platforms we paid for priced hosted MTA-STS like a luxury, buried the data in XML, and billed by email volume for a job that scales with domains. We built the thing we wanted to buy. That origin explains most of what is good about this product, and all of what is missing.
A product with a service business behind it.
Each step below carries what it means for you — including the ones where the answer is “not much”.
PlatOps Security opens in Bethesda
A managed service provider, not a product company. Email authentication was one line item among many — something we configured for clients because it was on the checklist, not because we found it interesting.
Ten years of running other people’s mail before we wrote a line of this product. It is why our defaults assume you have other work to do, and it is also why we are late to a category that has been running since 2012.
We paid for the tooling, and resented it
Hosted MTA-STS priced like a luxury when it is a text file on an HTTPS endpoint. Aggregate data buried in XML nobody on the account team could read. Billing by email volume for a job whose real unit is domains.
Those three complaints are the whole product thesis, which means we are vulnerable to a fair reply: we built for our own irritations, not from research. Where a competitor solved something we never felt, they are usually still ahead.
Google and Yahoo made it every client at once
Bulk senders had to authenticate or stop arriving. For an MSP that is not one project, it is the whole book of business in the same quarter, with the same deadline, and no tooling that priced sensibly across it.
We built the thing we wanted to buy instead of absorbing the bill. The cost was becoming a software company while still running the service business — which is why the Partner plan is published, not negotiated.
DDMARC launched
Free monitoring, flat per-domain pricing, and hosted MTA-STS and BIMI included from the Growth plan. A residency choice — US or EU on any plan — because our own clients had data-residency answers to give before they could sign anything.
Launching in 2024 makes us the newest platform in every comparison we publish. Smaller community, fewer third-party tutorials, and fewer people who have already hit your exact problem than Dmarcian has after twelve years.
Still an MSP, which shows in both directions
The service business is still running, so the product gets used against real client estates before it ships. It also means we are a smaller company than most of the names we compare ourselves to.
You get a roadmap driven by mail that broke, not by a competitive matrix. You also get a vendor who will say when a requirement rules us out, because we would rather lose the deal than the argument.
We still run email authentication for real clients as a service business, which means the people building this product also do the unglamorous work of chasing a marketing team for DKIM access. Every design decision in the platform — flat per-domain pricing, hosted MTA-STS on ordinary plans, the sender inventory as the first thing you see — comes from that side of the desk, not from a roadmap workshop.
Every company claims these. Ours are links.
A values list is worth nothing — anyone can write “we care about our customers” and mean nothing by it. So each principle below points at a specific page on this site where we have already paid the cost of holding it. If a link does not back up its claim, the claim is wrong and we would like to know.
Our comparison hub has a section on the requirement that rules us out, and every head-to-head page has one headed “where the other one is the better buy”, with the situations spelled out.
Our SOC 2 and ISO 27001 certifications are held by the parent infrastructure company, not by DDMARC. The security page says so in its headline instead of displaying borrowed badges, and tells a reviewer to log it as a gap if their process requires a report naming us.
Customers send us their DMARC reports to protect their domains, not to become a chart. So we scan the public internet instead — less granular, checkable by anyone, and the dataset downloads with no email gate so our competitors can take it too.
Lookalike domains, display-name spoofing and compromised accounts all authenticate perfectly and DMARC does nothing about them. Our financial-services page maps all four attack variants and marks the three we cannot solve instead of selling DMARC as anti-phishing.
Free through Enterprise, and both partner plans with their per-domain overage rates, are on the pricing page. Enterprise starts at a published figure, not a conversation. There is nothing to negotiate below very large volumes, which also means we never need to see your budget first.
Our own alternatives page tells readers that two of the six common reasons for switching are not worth a migration, and suggests a free workaround instead. The onboarding flow tells you nothing will happen for 24 hours instead of faking activity.
Five things a bigger vendor would not admit.
We have also deliberately left the team photos and founder-story section off this page. We are a small distributed team and a grid of stock-lit headshots would tell you nothing useful about whether the product works. Ask to speak to whoever would handle your account and we will put you in front of them.
Who you are contracting with.
DDMARC is a product of PlatOps Security, LLC — not a separate legal entity. That is the name that appears on your invoice, your DPA and any agreement you sign, so it is worth stating here instead of leaving procurement to discover it.
Domains that reach enforcement.
Not signups, not seats, not dashboard sessions. A domain sitting at p=none forever is a customer we have failed, even though it pays the same as one at p=reject.
Do not take any of this on trust.
2 domains free, no card, and nothing about your mail changes on day one. A month of using the product will tell you more about whether we are any good than an About page ever could.