Skip to content
DDMARC
MSPs & agencies · white-label · from $119/month

DMARC is easy to sell and expensive to deliver.

Built and priced by an MSP: PlatOps Security, MSP since 2014. The record takes 10 minutes. Getting a client to enforcement means finding out who their marketing team hired, chasing DNS access nobody documented, and explaining it all in a language the client’s owner understands. That labor is your margin — so this page is about how much of it the platform removes.

Subscribe as a partner — $119/mo, no applicationDoes it integrate with my PSA?
01 — Where the hours go

Pick a client you already have.

Planning estimates for one client, from kick-off to enforcement — and which side of the line each task falls on.

The client whose marketing team buys tools.

Several brand domains, a CRM, two email platforms, a booking tool and something nobody remembers signing up for. The technical work is easy; finding the owner of each sender is not.

Month 1 — onboarding≈ 4 hours
Enroll every domain, publish records, produce the first named sender inventory.
Months 2–3 — alignment≈ 6 hours
The real cost. Each unaligned sender needs an owner found and a vendor ticket raised.
Enforcement≈ 2 hours
Brand by brand, with a rollback ready if a regression appears in the reports.
To enforcement, typically one quarter≈ 12 hours
Steady state, per month≈ 45 minutes
The platform does this
Sender discovery — every service sending as the client, named from report data, not from interviews
Record generation, and a live DNS check that confirms it published correctly
Continuous DNS monitoring, so a record edited or dropped becomes an alert, not a surprise
Managed MTA-STS and BIMI hosting on your own organization's domains, so there is no endpoint of yours to keep alive
A prospect scan that grades up to 50 domains and produces a white-label PDF
Your technician still does this
Getting DNS access, or getting the client to get it
Finding the human who owns each unaligned sending tool
Deciding when the client is ready for enforcement, and saying so
Assembling the quarterly review — the data is there, the document is yours
The conversation where you explain why this matters
Configuring alert rules — they are set per organization, nothing inherited across clients
Building the monthly client report by hand — there is no portal export to generate it for you

This column is the part worth billing as project work instead of absorbing into a managed-service fee.

02 — What you hand over

A number that went up, with your logo on it.

Security work is hard to renew because nothing visible happens when it works. A posture score with a dated history is the exception — it is the rare security deliverable a non-technical owner can read in 5 seconds and feel good about.

01
A score with a dated history
Out of 100 with a letter grade, per domain, so “we improved your security” becomes a number the client can see moving between reviews.
02
The sender inventory
A named list of every service sending as them. Clients are consistently surprised by this one, and it justifies the engagement on its own.
03
Evidence for their own auditor
Enforcement status per domain with dates, which is what their cyber-insurance questionnaire and any framework assessment will ask for.
04
A next action, not a problem list
Each finding carries the specific record change. Your first-line technician can action it without escalating to your senior engineer.
Quarterly review, your brandexample, from your partner dashboard
January
42
grade F · p=none
April
88
grade A · p=reject
Unauthorized senders blocked3 sources
Legitimate senders aligned7 of 7
Policynone → reject
Domains at enforcement4 of 4

A worked example on a fictional client, from your partner dashboard. The score, the history and the sender inventory come from the product; assembling them into the review document is your hour, not ours.

03 — Running forty of them at once

One dashboard, one tenant per client.

Each client is a separate organization with its own portal, and your customers sign in without a password. Once you verify your vanity domain and sending domain, the portal and login email carry your brand — alert and digest emails still carry a DDMARC footer today. What follows is how the dashboard behaves across a book of them, including the default that catches every new partner in week one. For the per-client process itself, see the DMARC at scale playbook for MSPs; for partner onboarding, start with the MSP getting-started guide.

01One tenant per clientEach customer is a separate organization with its own domains, reports and portal. A customer sees only their own — which is the answer their security review will want.
02Passwordless client accessYour customer types the domain they manage; a six-digit code and magic link go to the login email you set on it, valid fifteen minutes. There is no password for you to reset.
03The portal is read-onlyCustomers read reports, run a live DNS check and follow rollout progress. They cannot add or remove domains, export data, or see any billing — you stay the one who changes things.
04One dashboard for the bookPartner → Customers is where every client, domain and login email lives, with an “at limit” marker when a customer hits their domain cap.
05Caps are optionalA new customer organization has no domain limit. Set one per customer when you want to hold a client to a fixed count, and the “at limit” marker shows who has reached theirs.
06Unbranded escalationWhen you escalate to us, nothing in the thread reveals the platform to your client. Your brand stays intact through support.
04 — The integration answer

There is no ConnectWise module.

You will ask, so here it is up front. The REST API and outbound webhooks are live and cover what the dashboard does; no native PSA or RMM module has shipped. The ConnectWise, Autotask, Kaseya, NinjaOne and HaloPSA modules are on the roadmap with no dates promised. Below is what that means in practice.

Live today
REST APIfull coverage
Outbound webhooksalert events
Slack · DiscordProtect and up
Microsoft Teams · TelegramGrowth and up
Jiraticket from an alert
CSV exportreports and senders
White-label portalyour hostname

The usual route to a PSA is a webhook receiver that opens a ticket. Note the payload carries no event id, so build your receiver to tolerate a repeat.

Not built yet
ConnectWise Manageroadmap
Autotaskroadmap
Kaseya · NinjaOne · HaloPSAroadmap
Zapier · Make · n8ncoming soon
PagerDuty · Opsgeniecoming soon

No native PSA or RMM module has shipped. Zapier, Make, n8n, PagerDuty and Opsgenie come first; the PSA modules follow on the roadmap.

If a native module is a hard requirement, not a preference, tell us which one and we will be straight with you about whether it is close. We would rather lose the deal than have you discover it after signing.

The plan-gated rows above (Slack, Discord, Teams, Telegram, managed MTA-STS and BIMI hosting) are what your own partner organization gets on its plan. Customer organizations are created on Monitor and do not inherit them automatically.

05 — What it costs you

Per domain, not per client.

A client with one domain costs you one domain. Your retail price is yours to set — most of the value you charge for is the labor column above, not the platform.

Partner Starter$119/mo · 30 domains
Above the allotment$3.99 per domain
Partner$299/mo · 100 domains
Above the allotment$2.99 per domain
A domain counts whenit is enrolled
Client leavesremove it, billing drops
Run your marginYour domain count, your retail price, our published rate.

Already running a book on another vendor? White-glove migration is included at no charge — we repoint the reporting addresses and run both in parallel for a cycle. Request a free migration.

Included in the partner plan

No setup fee, month to month.

White-label portal on your own hostname, with your logo and colors
No cap on client organizations — you pay per domain, not per client
Managed MTA-STS and BIMI hosting on your own organization's domains
REST API, outbound webhooks and CSV export
Prospect scanner: 50 domains a scan, 200 a day, white-label PDF

The subscription is billed through Stripe and managed from the Stripe customer portal, so switching plans or canceling does not need us in the loop.

Run it on 3 clients first.

Pick your messiest client, your tidiest, and one you would like to upsell. You will know within a month whether this is a service line or a distraction — and we would rather you found out cheaply.

Subscribe as a partner — $119/moRun your margin
hello@ddmarc.comNo setup feeBilled per enrolled domain
Common questions

What buyers on this page ask.

Explore more

Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.

EnterpriseSmall BusinessHealthcareFinancial ServicesHosting ProvidersCompare DMARC toolsPricing & plans