Pricing
Plans priced by the number of domains
Pay by the domain. Your first domain is free, and every Business feature is free to try for 30 days, no card needed. Paying yearly saves two months.
Free
For watching one domain
Free for as long as you like
- 1 domain
- The Monday digest
- Every sender graded pass or fail
- Step-by-step proposals you publish yourself
- Report detail kept 90 days
Starter
For one company's domains
or $190 a year
- 3 domains, then $5 each
- Hosted DMARC: we publish each step and put it back if it blocks your email
- Same-day sender alerts
- Report detail kept 12 months
Business
For companies with several brands
or $490 a year
- 10 domains, then $5 each
- Everything in the Starter plan
- Hosted SPF and hosted MTA-STS
- TLS-RPT failures by mail server
- Cleanup checks on every include and selector
- One digest across all your domains
- Client groups with scoped access
- Report detail kept 24 months
Portfolio
For MSPs and agencies
or $790 a year
- 25 domains, then $4 each
- Everything in the Business plan
- Your company name on client digests
- Report detail kept 24 months
- $3.16 a domain with all 25 in use
Enterprise starts at 100 domains, from $399 a month, with SSO and billing by invoice. Report detail is kept 36 months, with a named contact. Agencies and MSPs with a larger client book start here. How it works for MSPs
Get a quoteTry every feature of the Business plan free for 30 days, no credit card needed. Pay yearly and 2 months are free.
Already have an account? Change plan from the billing page.
For MSPs and agencies
What a client book costs on the Portfolio plan
$79 a month covers 25 domains. Each domain past that is $4 a month, prorated to the day. From 100 domains, Enterprise starts at $399 a month.
Domains that send no mail can be parked. We hold each one at p=reject and watch it for spoofing, and up to 50 parked domains are free.
| Domains | A month | Per domain |
|---|---|---|
| 25 domains | $79 | $3.16 |
| 50 domains | $179 | $3.58 |
| 75 domains | $279 | $3.72 |
Plan by plan
Every feature, plan by plan
| Free $0 a month | Starter $19 a month $190 a year | Business $49 a month $490 a year | Portfolio $79 a month $790 a year | Enterprise From $399 a month | |
|---|---|---|---|---|---|
| Limits | |||||
| Domains watched More domains one at a time, at the price shown, prorated to the day. | 1 | 3 then $5 a domain |
10 then $5 a domain |
25 then $4 a domain |
100 more by quote |
| Message volume We do not meter messages. A domain under a spoofing wave has its unaligned sources grouped by network for the day, so the wave never costs you anything. | Unmetered | Unmetered | Unmetered | Unmetered | Unmetered |
| Report history Source-by-source report detail for the plan's window. Daily totals per source stay for the life of the account on every plan. | 90 days | 12 months | 24 months | 24 months | 36 months |
Parked domains, free A domain that sends no mail. We hold it at p=reject and watch its
reports for spoofing, and it does not count toward your plan's domains. |
Not included | Not included | Not included | Up to 50 | Up to 200 |
| Reports and monitoring | |||||
| Dedicated reporting address per domain Your own rua= address per domain, so reports arrive already sorted. | Included | Included | Included | Included | Included |
| Pass and fail trends over 7, 30 and 90 days | Included | Included | Included | Included | Included |
| Sending sources identified Every IP matched to the service behind it, with the DKIM domain, SPF domain, reverse DNS, ASN and country as evidence. When most of a sender's mail passes DKIM or SPF for its company's own domain, your answer covers every address that company sends from. | Included | Included | Included | Included | Included |
| Forwarded mail counted apart from your own We list mail that a forwarder or another company's account sends on as you by itself, so your pass rate covers the senders you use. | Included | Included | Included | Included | Included |
| SPF and DKIM record change history We read both records daily and keep every change, so you can see which edit landed the week your pass rate changed. | Included | Included | Included | Included | Included |
| Manual report upload Upload a report a receiver mailed you and it joins the same dashboard. | Included | Included | Included | Included | Included |
| Watch list for domains you don't monitor Save up to 200 domains from the bulk check, such as suppliers or prospects. We check their DMARC and SPF records daily and email you when one gets worse. | Not included | Included | Included | Included | Included |
| TLS-RPT failure detail Failed TLS connections to your mail servers, counted by server and reason, from the reports mail servers send us, and a line in the digest. On every plan, you can see whether the reports arrive. | Not included | Not included | Included | Included | Included |
| Digest and alerts | |||||
| Monday digest Your pass rate against last week, each new sender with a verdict, and the one change to act on. | Included | Included | Included | Included | Included |
Alerts when your DMARC or SPF record breaks or a DKIM key is deleted We read your records daily and email you once two reads agree. We also email
you when your SPF record changes to end in +all, which lets any
server pass. |
Included | Included | Included | Included | Included |
| Realtime sender alerts Same-day email when a new source fails DMARC or a known sender stops passing. At most one a day per domain. | Not included | Included | Included | Included | Included |
| One email when a provider fails across your domains When one provider starts failing DMARC on 3 or more of your domains within 2 days, you get one email that lists them all. | Not included | Included | Included | Included | Included |
| Skip the digest on a clean week | Not included | Included | Included | Included | Included |
| One digest covering every domain One Monday email for the account, a section per domain. | Not included | Not included | Included | Included | Included |
| Step-by-step proposals you publish yourself We mail each policy step when your reports say it is safe, and you publish it in your own DNS. On the free plan the steps stop at quarantine. | Included | Included | Included | Included | Included |
| Guided enforcement with automatic rollback We publish each policy step through hosted DMARC and put the previous policy back if a sender you marked as yours starts getting rejected in the days after a step. | Not included | Included | Included | Included | Included |
| Hosted records | |||||
| Hosted DMARC Point a CNAME at us, then change p, sp and pct from the dashboard. Other reporting addresses in your record stay in it. | Not included | Included | Included | Included | Included |
| Hosted SPF Add our include to your SPF record, then add and remove senders from the dashboard, with their addresses re-resolved hourly. | Not included | Not included | Included | Included | Included |
| Hosted MTA-STS You publish the CNAMEs, and we serve the policy file and renew its certificate. | Not included | Not included | Included | Included | Included |
| Cleanup, team and sign-in | |||||
| SPF change check against your real mail Whether each range you remove from your SPF record sent mail in the last 90 days, in the dashboard and in the GitHub Action. | Included | Included | Included | Included | Included |
| Sending routes: SPF cleanup A keep, review or remove verdict for every mechanism in your SPF record, from 90 days of your reports. | Not included | Not included | Included | Included | Included |
| Signing keys: DKIM cleanup Every selector that signs your mail, checked against live DNS, with the dead and empty keys listed. | Not included | Not included | Included | Included | Included |
| Evidence export as CSV One row per source and report, for an auditor or a client. | Not included | Included | Included | Included | Included |
| Team members Up to ten people, each with their own sign-in. Billing stays with you. | Not included | Included | Included | Included | Included |
| Two-step sign-in A code from an authenticator app after your password, with backup codes. | Included | Included | Included | Included | Included |
| Single sign-on (SSO) Your team signs in through Entra ID, Google Workspace, Okta or another OpenID Connect provider. | Not included | Not included | Not included | Not included | Included |
| Clients | |||||
| Client groups and a shared report Put each client's domains in a group and share a read-only report on them, with your company name on it. | Not included | Not included | Included | Included | Included |
| Group-scoped members A member who sees one group's domains and nothing else. | Not included | Not included | Included | Included | Included |
| A weekly digest for each client The client's contact confirms from a link, then gets one weekly email covering their domains. | Not included | Not included | Included | Included | Included |
| Your company name on client digests The client's weekly email shows your company name as the sender, followed by "via DomainCanary". | Not included | Not included | Not included | Included | Included |
| Start free | Create your account | Create your account | Create your account | Talk to us | |
Questions
Before you sign up
Is the free plan a trial?
No. The free plan is not a trial and does not expire. One domain, 90 days of report detail, daily totals for the life of the account, and no card. The 30-day trial is Business, and it needs no card either.
What happens when I need one more domain?
Add it. On the Starter and Business plans each domain past the allowance costs $5 a month; on Portfolio it costs $4. The add-domain form shows the price before you confirm, and the charge is prorated to the day.
What happens to my domains if I change plan?
Nothing is deleted. A smaller plan covers the domains you added first; the rest stop getting a digest and alerts, keep every report we already hold, and start again the moment a plan covers them. Report detail past the smaller plan's window is kept for 30 days after the change, then removed; the daily totals stay.
How do I cancel?
From the billing page in your dashboard. Canceling stops the next payment; the paid plan runs to the end of the period you paid for, and the account then moves to the free plan. Nothing is deleted.
What do you do with my report data?
We turn it into your digest, alerts, and dashboard. Aggregate reports list sending servers and message counts, not message content. We share it only with the service providers our privacy policy lists, which we need to run the product.
Start with your first domain free
Create an account and add a domain. The free plan has no end date, and every feature of the Business plan is yours to try for 30 days.
Questions before you start? Email me, and I'll answer you myself.
Josh Purvis, founder of DomainCanary
Software engineer with more than 20 years of experience
contact@domaincanary.com