How a modern stack shapes our DMARC pricing

What a DMARC platform built in 2015 looked like

The DMARC monitoring market was largely established between 2015 and 2019. A typical stack from that period was a report parser in a scripting language, a general-purpose relational database rather than one built for time-series aggregation, and infrastructure that grew as features were added.

Layered architectures like that add latency, compatibility shims cost memory, and the infrastructure needed to serve one customer grows over time, for the same core job: ingest XML, enrich it with metadata, display a dashboard.

What starting from zero looks like

ShieldMarc was built in 2026. Not adapted, not forked, not wrapped around an open-source parser from 2017. Every component was written to solve the specific problem in front of us, using the tools available today.

That meant making deliberate choices that are hard to retrofit onto an older platform:

• A single, purpose-built ingest pipeline instead of chaining three or four open-source tools together. Our report parser handles decompression, XML parsing, metadata enrichment, and storage in a single pass. No intermediate queues, no serialisation boundaries, no wasted memory copying data between processes.
• A lean, purpose-built service for the performance-critical path. The ingest pipeline runs on a fraction of the memory and image footprint of the open-source parsers we tested, which is a fundamentally different cost structure rather than a rounding error.
• A self-operated stack end to end. We run our own database, authentication and monitoring infrastructure rather than renting them from third-party managed platforms. That removes a layer of per-seat and per-usage vendor fees from our costs, and it keeps your data under our direct control.
• Edge-first request handling for the free tools. Lookups from the tool pages go through a Cloudflare Worker that rate-limits them and answers repeat lookups from its cache where it can. The DNSSEC and CAA checkers run entirely in that Worker, and the WHOIS and domain expiry checkers run there unless a registry refuses Cloudflare's network, when our own servers answer instead. The rest, including the DMARC checker and DNS Lookup, run on our own servers.
• Concurrency by default rather than sequential processing. DNS enrichment, SPF tree resolution, and reverse lookups all run in parallel, batched and deduplicated. A report with 100 source IPs does not make 100 serial DNS queries; it deduplicates, resolves the unique set concurrently, and maps the results back. The difference is measurable in seconds, not milliseconds.

The numbers

We benchmark continuously. Two outcomes that matter to customers:

Measured from our production environment against widely-used open-source DMARC parsers running comparable workloads. We keep specific stage timings, infrastructure footprint, and engine internals private.

Why this matters for pricing

Infrastructure cost is the single largest variable expense for any SaaS platform. When your ingest pipeline runs on little memory and CPU, and you operate your own data platform instead of paying a managed vendor's per-usage margin, you can serve more customers on less hardware, cold starts are instant, and scaling is trivial.

This is not about cutting corners. It is about building efficiently. The engineering choices compound: less infrastructure means lower costs, and lower costs let us publish flat prices that smaller organisations and MSPs can budget for.

That is why ShieldMarc's Professional plan is £70/month for 25 domains (£50/month billed annually), and our MSP plan is £130/month for 100 domains (£100/month billed annually), all excluding VAT. No hidden overage fees. These are sustainable prices because the underlying platform was built to be efficient.

Good engineering first. Then AI where it matters.

DMARC aggregate reports are structured XML with well-defined fields. The foundation has to be operational excellence: ingesting reports reliably at scale, enriching them with useful context, and presenting the data clearly enough that you can act on it.

The real engineering work is in the unglamorous details: streaming XML parsing that does not buffer the entire document in memory. DNS lookup deduplication that avoids hammering resolvers. Deterministic document IDs that make every write idempotent. Edge caching that reduces origin load by orders of magnitude for public tools. These are not features you see on a marketing page. They are the reason the platform is fast, reliable, and affordable.

On top of that foundation, a deterministic threat model scores every DMARC report row as it is ingested. This is not a gimmick bolted on for a feature list. It weighs reverse DNS, SPF/DKIM alignment patterns, IP reputation, new sources and volume spikes to surface threats that would take hours to identify manually. AI sits on top of that model and runs only when you ask, and it works because the engineering underneath it is sound.

The same discipline applies to the plain-English AI explanations on our free tools. Not every task needs the most capable model. SSL and DNSSEC results have short, predictable structures, and a lighter model handles them reliably at a fraction of the cost. DMARC interpretation is more complex, with branching rules around subdomain policy, alignment modes, and monitoring state, so that task gets a more capable model. The result is the right model for each job rather than a single expensive default across the board, and at scale the difference compounds into meaningful savings that flow through to pricing.

More than DMARC

Because our infrastructure costs are low, we can include monitors that other platforms charge extra for or do not offer at all:

• DMARC aggregate report ingestion and analysis
• Threat scoring for every report row, with AI explanations on request
• DMARC health monitoring with alignment tracking
• SSL certificate expiry monitoring
• DNS change detection with before/after diffs
• DNSSEC validation status
• MTA-STS and TLS-RPT monitoring
• CAA record monitoring
• Domain registration and expiry tracking
• Website uptime monitoring
• Lookalike domain detection

All included in every paid plan. No module add-ons. No per-monitor fees.