Skip to content
DDMARC
Hosting providers · from $119/month · no setup fee

You host 40,000 domains. You will enroll maybe 900.

Built and priced by an MSP: PlatOps Security, MSP since 2014. Most hosted domains never send mail, and most owners will never ask for email security. So you pay per domain you enroll, provisioned by API from your own control panel. A domain counts from the day you add it and stops at the next daily sync after you remove its customer organization.

Subscribe as a partner — $119/mo, no applicationSee the provisioning calls
01 — Does the margin work

Run your own numbers before you talk to us.

Real published rates, no discount to negotiate for. We pick the cheaper plan for your volume automatically.

120domains
10100250500
What you charge the end customer
Your costPartner
$359/month
$299 base + 20 × $2.99
Effective cost per domain$2.99
Your monthly revenue$600
Gross margin40%
Annual contribution$2,894
Works

$241 a month at 40% margin, or $2,894 a year, with no engineering cost after the provisioning integration is built once.

Partner Starter is $119/month including 30 domains, then $3.99 each. Partner is $299/month including 100, then $2.99 each. A domain counts from the day you enroll it, whether or not it is sending mail — parked and silent domains cost the same as ones generating reports every day. This calculator prices exactly the domain count you enter, not a ceiling.

Above 1,000 domains: talk to us for a per-domain rate; the calculator stops at list pricing. Talk to us before committing at that scale.

02 — Provisioning

Wire it into your control panel once.

Email security becomes a checkbox on the hosting plan, and nobody on your team logs into our dashboard to turn it on. These are the calls the API documentation covers today.

01

Create the client organization

One isolated tenant per hosting customer. Their domains, reports and portal access all hang off it, separated from every other client. Name, slug and admin email are required; admin name is optional.

curl -X POST "https://api.ddmarc.com/api/v1/msp/customers" \
  -H "X-API-Key: $DDMARC_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme Ltd","slug":"acme","admin_email":"it@acme.com"}'
Returns the organization with its public_id (org-…), which every later call takes. Set the slug to your own account identifier for your own records. This endpoint needs an admin-scoped key belonging to an admin user in your partner organization — a read or write key is rejected.
02

Enroll a domain

Add each domain whose owner opted in, with the same admin key. Exceeding the customer's domain cap returns 403, so your provisioning job can treat the cap as a normal branch, not an outage.

curl -X POST "https://api.ddmarc.com/api/v1/msp/customers/org-3f9a2c7d/domains" \
  -H "X-API-Key: $DDMARC_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"acme.com","admin_email":"it@acme.com"}'
201 with the domain record; 403 when the customer is at its cap, 409 for a duplicate. The optional admin_email is the portal login for that domain. DNS monitoring is enrolled in the same call.
03

Read posture back into your panel

Pull one customer's domains and their current state to render a score and a next action inside your own control panel, so most customers never need to open the portal at all.

curl "https://api.ddmarc.com/api/v1/msp/customers/org-3f9a2c7d/detail" \
  -H "X-API-Key: $DDMARC_ADMIN_KEY"
The customer, its domains with DMARC, SPF and DKIM verification flags and pass rate, and recent activity. Alert webhooks push changes to you, so this is a render call, not a polling loop.
Auth
Keys go in an X-API-Key header and carry a read, write or admin scope. The partner endpoints require admin specifically.
Rotation
Keys are created and revoked through the API itself, so rotation belongs in your deployment pipeline, not in a dashboard.
Webhooks
Alert webhooks push events into your own systems, so you are not polling for changes. The event list is in the API docs.
Billing
Every domain enrolled under your customer organizations counts at the daily usage sync, and removing one drops the count on the next sync — about 24 hours, not the next cycle.
Domain caps
A customer has no per-customer cap until you set one: PATCH /api/v1/msp/customers/{customer_public_id} with max_domains (1 to 10,000, or null to remove it). Your own plan sets no domain limit.
Which key
Your partner admin key does all three calls above. A key issued inside a customer organization only sees that customer, so hand one to a customer only when they want direct API access of their own.
03 — Whose product is it

Yours, on your hostname. Two DNS records.

Point a CNAME at our portal edge, prove ownership with a TXT record, and the customer portal serves from your domain with your logo and colors once it verifies. Verify a sending domain too and the login email carries your brand as well. Alert and digest emails still carry a DDMARC footer today.

Set-up, once
CNAMEsecurity.yourhosting.com
connect.ddmarc.com
Serves the portal from your hostname. This is our portal edge, and it answers TLS for verified vanity hosts.
TXTthe name shown in your partner settings
the verification token issued to you
Proves you control the hostname before we serve anything on it. Both the name and the token are generated per partner.

Certificates for your hostname are issued and renewed on our side. There is nothing to keep alive on yours.

Who answers the ticket
Where do I paste this record?You
Why is my mail going to spam?You
Report parsing or ingestion faultUs
MTA-STS or BIMI hosting issueUs
API error or webhook not firingUs
Portal branding and accessYou

Escalations from your desk to ours are unbranded, so a customer never learns who the platform is from a support thread. The portal is read-only for them: add, edit or remove domains — only you enroll them.

04 — What an enrolled domain gets

The same nine protocols, per domain.

Including the two things your customers would otherwise have to host themselves — which is the part that is hard to replicate.

DMARCPolicy & reporting — parse every aggregate (rua) report into named senders, not raw xml
SPFAuthorized sending IPs — resolve the full include tree and count dns lookups against the limit of 10
DKIMSigning keys — discover selectors from report data instead of making you list them
ARCForwarded mail — parse arc chains from report samples and show each hop
MTA-STSEnforced TLS — host the policy file for you, on our certificate and cdnhosted by us
TLS-RPTEncryption failures — aggregate tls reports from every reporting provider
DNSSECSigned DNS — check the ad flag on live resolution, not just registrar settings
DANECertificate pinning — monitor tlsa records for every mx host
BIMILogo in the inbox — host the svg tiny ps logo and the vmc on our endpointhosted by us

Start with 30 domains.

Enroll your own domains and a handful of willing customers, see the reports land, then decide whether it belongs in your plan line-up.

Subscribe as a partner — $119/moRead the API docs
hello@ddmarc.comNo setup feeBilled per enrolled domain
Common questions

What buyers on this page ask.

Explore more

Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.

EnterpriseSmall BusinessHealthcareFinancial ServicesMSP & AgenciesCompare DMARC toolsPricing & plans