Every plan runs every check. You pay for domains
The free plan is not a trial and not a cut-down version. It runs the same checks on the same schedule as the most expensive one. What you buy with a paid plan is room for more domains.
Free
For one domain you want to keep an eye on
- 1 domain
- Every check, every report
- Email alerts and digests
- No card required
Standard
For a team looking after a handful of domains
- 10 domains
- Every check, every report
- Email alerts and digests
- Billed yearly
Business
For an estate of up to a hundred domains
- 100 domains
- Every check, every report
- Email alerts and digests
- Billed yearly
Enterprise
For more domains than you want to count
- Unlimited domains
- Every check, every report
- Email alerts and digests
- Billed yearly
Compare plans and features
Most rows are the same across all four columns, and that is the point.
| Features | Free | Standard | Business | Enterprise |
|---|---|---|---|---|
| Reports we collect and parse for you | ||||
DMARC aggregate (RUA) | ||||
DMARC forensic (RUF) | ||||
SMTP TLS reporting (TLS-RPT) | ||||
CAA violation reports | ||||
Sending source attribution | ||||
Per-source pass and fail counts | ||||
| Mail and DNS checks, run on a schedule | ||||
MX records and delivery path | ||||
SPF | ||||
DKIM selectors and key strength | ||||
DMARC policy | ||||
ARC | ||||
CAA | ||||
BIMI and VMC | ||||
DNSSEC chain of trust | ||||
DANE and TLSA | ||||
MTA-STS policy | ||||
TLS-RPT record | ||||
TLS and STARTTLS on every mail host | ||||
Reverse DNS and FCrDNS | ||||
Blocklists for your IPs and domain | ||||
| Web side of the same domain | ||||
Zone transfer exposure (AXFR) | ||||
security.txt | ||||
Security headers | ||||
HTTPS redirect | ||||
robots.txt and sitemap.xml | ||||
Cookie flags | ||||
| The same on every plan | ||||
Time between checks | 10 minutes | 10 minutes | 10 minutes | 10 minutes |
Blocklists watched | 120 | 120 | 120 | 120 |
Report history you can query | 365 days | 365 days | 365 days | 365 days |
Email alerts and digests | ||||
Expiry reminders | ||||
Team members | Unlimited | Unlimited | Unlimited | Unlimited |
| What the price buys | ||||
Domains you can monitor | 1 | 10 | 100 | Unlimited |
Zero-Trust readiness
Data is encrypted at rest (AES-256) and in transit (TLS 1.3), and we follow established security best practices.
People who run mail themselves
We answer technical questions within 12 to 24 hours, on every plan, and we run this same tooling against our own mail.
Your data, and a way out
GDPR and CCPA compliant. Reports export to CSV and PDF from the browser, and deleting a domain removes its monitoring data within 24 hours.
Questions about the plans
What each plan includes, how long your data stays, and what happens when you outgrow one
Yes. The free plan covers one domain and needs no card. It is not a cut-down edition, because the same checks run for it as for every paid plan and on the same schedule, so DNS, SPF, DKIM, DMARC, MTA-STS and TLS are re-checked every ten minutes and blocklists once a day, and your DMARC, TLS-RPT, forensic and CAA reports are parsed the same way. A paid plan buys room for more domains, and nothing else.
Every name you add counts as one, including subdomains. Adding example.com and mail.example.com uses two of your allowance. We would rather say this plainly than have you discover it when the eleventh name is refused.
The same on every plan, and it differs by data type. Check history is deleted after 30 days. Raw report messages are deleted 90 days after they arrive, which covers aggregate DMARC, TLS-RPT, forensic DMARC, CAA and delivery status alike, and it happens whether or not we managed to parse the message. Parsed reports are kept while you use the service, and any report view reaches back at most 365 days. Deleting a domain removes its monitoring data within 24 hours; reports already received are keyed by the domain name, so write to us and we will remove those too.
Rate limits are the same on every plan and depend on the endpoint rather than on what you pay. The public lookup tools allow between 5 and 15 requests a minute depending on how expensive the check is, and a deep TLS scan is limited to two every five minutes. What a paid plan buys is domains, not throughput.
Any report view exports to CSV or PDF from the browser, on every plan including the free one, and the export covers the whole range you are looking at rather than the rows on screen. There is no scheduled export and no JSON export today, so a SIEM integration would need building.
Start on the free plan and move up if you need to
One domain costs nothing and needs no card. If you later need ten or a hundred, the checks do not change, only the number of domains does.