What shipped, and what it changed for you.
Every release, oldest at the bottom. Fixes and renames are listed alongside the features, not quietly folded into them. A changelog that only contains good news is a marketing feed.
A Year of History on Every Paid Plan
Retention, forensic handling and single sign-on spelled out, two special hosting environments, and a comparison section rewritten to compete on facts.
Protect moves from 90 days to a year and Growth from 180. Monitor stays at 30 days; Enterprise stays custom. Year-over-year comparison and a twelve-month audit window no longer depend on which paid plan you chose.
Forensic samples carry message headers and addresses, so their window is now a fixed 90 days on every plan that enables them, independent of aggregate history, and then deleted. Stated on the pricing, privacy, security and DPA pages.
SAML 2.0 and OIDC single sign-on is provisioned as part of an Enterprise agreement. Several pages said there was no SSO; every one of them now says the same thing. Self-serve plans sign in with email and password, a passkey, Google or Microsoft.
Two special AWS environments, provisioned on request under an Enterprise agreement. The HIPAA-eligible environment runs on AWS services covered by the AWS BAA; DDMARC's own BAA is still in preparation. GovCloud hosting is where the environment runs, not a FedRAMP authorization.
Competitor prices re-checked in September 2026. Every comparison now shows where the API unlocks and whether sending volume is metered, and each competitor reference states a price, tier, cap or feature, not an opinion. Pages no longer send readers elsewhere for a managed rollout or a one-off lookup, both of which are on this site.
Managed DMARC is $99 per domain per month, billed annually; the enforcement sprint is $2,500 per domain. Earlier copy said up to five domains.
Two Specialist Services & a Repackaged Partner Starter
Someone to run your authentication instead of another tier to read, and a partner entry plan that includes five more domains at a higher base.
A named specialist, priced per domain and billed annually, added to whichever plan you already have. They read your reports, review forensic samples, triage alerts, trace new senders, draft the record changes for you to approve, and send a written monthly report. It is a person, not a feature flag.
The rollout from p=none to p=reject, priced per domain and run end to end in about 30 days: every sender inventoried and authenticated, including inside third-party sending platforms where needed, the policy stepped up behind safety gates, and a written handover. Where a sender lives in a system that cannot be changed inside the engagement, you get a written account of what is blocking reject instead of a policy that breaks real mail.
Up from $99/mo with 25 included. The per-domain rate above the allowance is unchanged at $3.99, and Partner still takes over as the cheaper plan from 76 domains up, so the arithmetic that decides which plan you want has not moved.
Two Published Partner Tiers & Active-Domain Billing
The MSP program now has a lower entry point, billing counts only the domains that are sending, and the partner page routes MSPs and hosting providers to the answers each one needs.
A second, lower partner plan: $99/month including your first 25 domains, then $3.99 per additional domain. It is the cheaper plan up to about 75 domains; Partner ($299/mo, 100 included) takes over above that. Both are self-serve — subscribe online, switch plans any month.
The partner page now routes MSPs and hosting providers to tailored paths, and answers the questions partners ask — plan choice, what counts as a billable domain, who bills the client, and how migration works — in a dedicated FAQ.
DNSSEC & DANE/TLSA Monitoring
Two more layers of DNS and transport security, watched continuously alongside your DMARC, SPF, DKIM, MTA-STS and BIMI records.
See whether your zone is DNSSEC-signed and whether the chain of trust validates, with an alert the moment a signature expires or a delegation breaks.
Track the TLSA records that pin your mail server's certificate in DNSSEC-signed DNS, so you know your DANE-enforced delivery stays intact after a certificate rotation.
Added plain-language explainers — What is DNSSEC?, What is DANE?, and What is DKIM2? — to the learn hub.
MSP Enablement Kit
Everything a managed service provider needs to pitch, price and win email-authentication business — all self-serve, no sales call required.
A public MSP battlecard, a live margin calculator that prices the cheaper of the two partner tiers for your client-domain count, and a printable white-label client one-pager you can brand and send.
Start a partner account and subscribe online with a card. No application, no partner agreement, no setup fee — though we will still sign an agreement or walk you through it on a call if your procurement needs one.
Compliance Guides & Clearer Pricing
Landing pages that map the major email-authentication mandates to concrete steps, plus a pricing page that is easier to trust at a glance.
New guides for PCI DSS v4.0.1 (Requirement 5.4.1), the Google/Yahoo/Microsoft bulk-sender rules, cyber-insurance underwriting questions, and NIS2 — each with deadlines and a step-by-step checklist.
The pricing page now spells out that plans have no per-email volume limits or overage fees, adds value context to each plan, and anchors the Enterprise plan with a published starting price.
Refreshed every /compare page against competitors' July 2026 published pricing and features, and synced our own plan facts across the tables.
State of Email Security 2026
Original, public-data research on how email authentication is deployed across the internet — plus upgrades to the free checker.
A research report built from independent DNS scans measuring real-world adoption of DMARC, SPF, MTA-STS, TLS-RPT and BIMI, with a downloadable dataset and distribution kit.
The free domain checker can now send your full email-security report to your inbox, so you can act on it later or forward it to whoever owns your DNS.
Field Notes Blog & Refreshed Brand
A new place for practical email-authentication writing, a refreshed look, and a clearer plan name.
The DDMARC blog launches with hands-on setup guides for Google Workspace and Microsoft 365, subdomain-policy deep-dives, and how to read your aggregate reports.
A new forest-green identity across the site, replacing the previous blue/cyan palette.
Keyboard-navigable menus, larger touch targets, stronger text contrast, labeled form fields, and reduced-motion support across the marketing site.
The entry paid plan is now called Protect everywhere — pricing, docs and comparisons — to match what the dashboard shows.
Managed MTA-STS & BIMI Hosting
The full hosted email-security stack: we now serve your MTA-STS policy over HTTPS with automatic certificates and id updates, and host your BIMI logo and Verified Mark Certificate.
Enforce TLS for your inbound mail without running a policy server. Two CNAMEs and we do the rest: the policy file served over HTTPS with a certificate for your domain, and the policy id bumped automatically on every change so receivers always pick up updates. Policies start in testing mode, and switching to enforce checks your live MX records first — a misconfigured policy cannot silently block your mail.
Upload your logo SVG and Verified Mark Certificate — we validate them against the BIMI security profile, host both over HTTPS, and publish the BIMI record behind a single CNAME. Replacing the logo or adding a VMC later never touches your DNS again.
Hourly end-to-end checks on every hosted record — DMARC, SPF, DKIM, MTA-STS and BIMI — with alerts the moment a delegation breaks.
Hosted SPF Flattening & Hosted DKIM
Your SPF and DKIM DNS, managed: an auto-flattened SPF record that stays under the 10-lookup limit by itself, and DKIM keys you rotate without ever touching DNS again.
Point a single include at DDMARC and we resolve your SPF sources to IP addresses, serve the flattened record with a 5-minute TTL, and re-resolve every 30 minutes — no more 10-lookup failures, no chasing provider IP changes. If a refresh ever fails, we keep serving your last known-good record and alert you.
Generate a DKIM key in one click: we serve the public key from our zone, you install the private key on your mail server (shown once, never stored by us). Rotations publish a new selector alongside the old — one CNAME per selector, and your DNS never changes again.
If your SPF include or a DKIM CNAME ever stops pointing at your hosted records, you get a critical alert before deliverability suffers.
Domains sending through Google Workspace or Microsoft 365 are steered to those providers' native DKIM, with hosted DKIM recommended for your other senders.
Sender Intelligence & Guided Fixes
Know exactly who is sending as your domain and exactly which DNS change fixes each failing source — plus hosted DMARC management goes GA.
Delegate _dmarc via a single CNAME and manage your DMARC policy from the dashboard — including scheduled, gradual policy ramp-up to p=reject.
Sending sources are automatically labeled with the email service behind them (Google Workspace, SendGrid, Mailchimp, and more), with confidence-aware labeling that never guesses.
Every failing sender now comes with the exact, copyable DNS change that fixes it — the precise SPF include to add and the provider's DKIM setup steps. You stay in control: changes are applied in your DNS, never ours.
Alert on email volume spikes or drops versus your domain's 7-day baseline, and on never-before-seen sending sources — delivered to email, Slack, Teams, Telegram, or webhooks.
One-click executive PDF summarizing your domains' DMARC, SPF, DKIM, TLS-RPT, and MTA-STS posture.
Scheduled DNS monitoring is now included on the free Monitor plan; forensic (RUF) reports are included from Protect up.
Earlier releases predate this log.
The one change most likely to have confused you.
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.
None of this matters until your own records are right.
Every release above exists to make one thing easier: knowing who is sending as your domain and whether it passes. The free checker answers the second half in about 30 seconds.