Email security
What does DMARC set-up cost?
Publishing a DMARC record costs nothing: it is one line in your domain's DNS. What you pay for is the work around it: finding every service that sends email in your name, fixing SPF and DKIM for each, and moving the policy from p=none to quarantine or reject without blocking your own invoices. Published prices for that run from report software you use yourself to €1,197 + VAT for an Irish firm to do it.
By Oscar CobbeCurrent as at 5 minute read6 sources
The record is free
Google's sender guidelines put it in one line: set up DMARC by publishing a DMARC record for your domain. Any business can add it where its domain's DNS is managed, at no charge. Google recommends DMARC reports too, so you can see who sends email in your domain's name, and it requires DMARC of anybody sending 5,000 or more messages a day to Gmail accounts.
A record at p=none changes nothing about what happens to forged mail. The DMARC standard says a domain at none offers no expression of preference: receivers are told nothing about what to do with mail that fails. Protection starts at quarantine or reject, which is why our guide on what SPF, DKIM and DMARC decide treats p=none as a starting point and nothing more.
Where the cost is
Moving to quarantine or reject safely is the work. It has four parts.
- 1Finding every service that sends as your domain: your mailboxes, and the invoicing, newsletter, booking and website-form services that send on your behalf.
- 2One SPF record listing them. The SPF standard says a domain must not publish more than one, and a receiver that finds two treats the check as an error.
- 3DKIM signing switched on for each service that supports it.
- 4Reading the reports until every legitimate sender passes, then setting the policy to quarantine or reject, and keeping it right when a new service starts sending.
Prices, side by side
As each business published them on 22 October 2026. The first two are software: they show you the reports, and you or your IT provider make the changes. The last two make the changes for you.
| Option | Published price | What you get | Who changes the records |
|---|---|---|---|
| dmarcian, Basic | $24 a month, $288 a year, in US dollars as shown (its free plan is for non-business personal use) | Report software for a small business with a single domain | You, or your IT provider |
| EasyDMARC, DMARC Plus | $44.99 a month, or $35.99 a month billed annually, in US dollars as shown | Report monitoring and tools for two domains | You, or your IT provider |
| Pragmatic Security, Domain Fix | €1,197 + VAT once; Domain Watch €119 a month after | SPF, DKIM and DMARC configured for your email provider, plus HTTPS and security headers, with a before-and-after report; Watch adds a weekly re-scan and a monthly DMARC report digest | Pragmatic Security |
| FourWinds, Secured and proven | Not sold on its own: part of the programme, €2,950 up to 10 staff | SPF and DMARC set to enforce, with five other basics: cookie consent, a privacy notice, two-step sign-in, a tested backup restore and a practised incident plan. A second scan proves the email fix from outside | FourWinds |
| FourWinds, Run, after the programme | €450 a month | Your website and email scanned again every week, and a fix that slips reopened as ours, alongside the rest of Run | FourWinds |
Which to choose
If your IT provider manages your DNS and has time to read the reports, report software is the cheapest of the paid routes above. If nobody does, a done-for-you fix closes this gap and only this one.
If an insurer or a customer is asking about email protection, look at what else the same questionnaire asks. Our guide on what a cyber insurer asks goes through Chubb's Irish proposal forms question by question. Where two-step sign-in and backups are on the list too, Secured and proven is priced for that case.
Sources
- 1.Email sender guidelines · Google
- 2.RFC 9989, Domain-Based Message Authentication, Reporting, and Conformance (DMARC), section 3.2.12 and the p tag · Internet Engineering Task Force
- 3.RFC 7208, Sender Policy Framework (SPF), sections 3.2 and 4.5 · Internet Engineering Task Force
- 4.Pricing · dmarcian
- 5.Business packages · EasyDMARC
- 6.Pricing: Domain Fix and Domain Watch · Pragmatic Security
Free, and no account needed
See your domain's DMARC policy, free
The free compliance check reads your domain's SPF and DMARC records from outside and says in plain words whether forged mail in your name would be refused, junked or delivered. It also looks at the website. Kept, with a free account, it becomes a dated compliance record.
Run the free checkDMARC set to enforce, and proven
Secured and proven sets SPF and DMARC to enforce as one of six basics, with cookie consent, a privacy notice, two-step sign-in, a tested backup restore and a practised incident plan. A second scan proves the email fix from outside. From €2,950 up to 10 staff, fixed before we start.
Secured and provenWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and updated when the law changes.
More about how we work →Read next
- Email securityCan someone send email as your business? What SPF, DKIM and DMARC decide
- Payment fraudA supplier emails new bank details. What should happen next
- Cyber insuranceWhat does it cost to meet cyber insurance requirements in Ireland?
Written on 22 October 2026 and accurate as at that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so.