CertaDNS
Enterprise-grade email security at SMB prices

Stop Email Spoofing.Protect Your Domain.

Hosted SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — on the DNS you already run. Free for your first domain.

Start freeSee How We Compare

No setup fees • 7-day money-back guarantee • Cancel anytime

Email authentication: SPF, DKIM and DMARC verifying your mail and blocking spoofers

Every domain's posture at a glance — SPF, DKIM, DMARC, MTA-STS & more:

Email authentication dashboard report card across multiple domains
140+
Email Providers
2
DNS Lookups (Dynamic)
91%
Cheaper Than Valimail
6x
More Features Than AutoSPF

Your Domain Is Under Attack

Every day, attackers spoof legitimate domains to send phishing emails. Without proper email authentication, your brand is an easy target.

SPF Lookup Limits

The 10 DNS lookup limit means your SPF record breaks the moment you add a few SaaS providers. Emails start failing silently.

Email Spoofing

Without enforced DMARC, anyone can send emails that appear to come from your domain. Customers and partners can't tell the difference.

DKIM Mismanagement

Stale DKIM keys, missing selectors, or misconfigured records silently degrade your email deliverability and domain reputation.

Complete Email Authentication Suite

Everything you need to secure your email — SPF, DKIM, and DMARC — managed from a single dashboard.

EXCLUSIVE

Dynamic Macro-Based SPF

RFC 7208 macro-based SPF that eliminates the 10 DNS lookup limit entirely. Always 2 lookups, always under 80 characters. Provider IP changes propagate in real time via EHLO-aware delegation.

Static SPF Flattening

Recursively resolves all include, a, mx, and redirect mechanisms to explicit IP addresses. Zero DNS lookups required. Auto-refreshes every 6 hours and publishes directly to your nameservers.

Hosted DKIM

Every DKIM key your email services use, published and checked in one place — with which ones are actually signing your mail. After a one-time DNS change, add or replace keys without touching DNS again, and hear about it when a key stops working, weakens or goes quiet. Running your own mail server? Generate its key in your browser; the private key never leaves your hands.

DMARC Report Dashboard

Automatic IMAP collection of aggregate reports from Google, Microsoft, Yahoo, and every major ISP. Visual dashboard showing pass rates, sender breakdown, and authentication results.

5-Stage Policy Wizard

Guided progression from p=none (monitoring) to p=reject (full enforcement). Each stage validates your authentication is working before recommending the next step. No guesswork.

140+ Pre-Configured Providers

Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailchimp, HubSpot, Salesforce, and 130+ more. Global coverage including providers across the US, EU, Asia, and Latin America.

PATENT-FREE IMPLEMENTATION

Dynamic SPF That Actually Works

Traditional SPF flattening is a band-aid — it solves the 10 lookup limit but breaks when providers change IPs between refresh cycles. Dynamic SPF solves the problem at the protocol level.

When a mail server checks your SPF, our system recognizes the sending server in real time, verifies it against your authorized providers, and returns a definitive pass or fail. No stale caches. No lookup limits. No record-length issues.

Our EHLO-aware delegation is a technical advantage no competitor offers — when Google sends email, we recognize their server and delegate directly to Google's own SPF record. Provider IP changes propagate instantly, with zero action required from you.

Technical Highlights

DNS Lookups: Always 2
vs. 3 for Valimail, unlimited for flattening
Record Length: ~80 characters
vs. 450+ chars for flattened records
Provider IP Changes: Instant
EHLO delegation to provider SPF in real time
Failure Mode: Graceful
Valid SPF FAIL, not NXDOMAIN errors
Protocol: Standard TXT
Fully debuggable with dig, nslookup, etc.
Fallback: Dual-mode
Switch to static flattening anytime — no lock-in

How CertaDNS compares

Each vendor's cheapest published tier with coverage comparable to our Plus tier — and the catch that comes with it.

Published entry pricing for comparable email-authentication tiers, last reviewed 2026-06-11
VendorComparable tierList priceWhat to know
CertaDNSPlus
$12/mo
$132/yr — 2 domains
Hosted DKIM with key monitoring, DMARC, MTA-STS, TLS-RPT and BIMI. Hosted SPF is a $10/mo add-on below Premium. No SSO today. A free tier covers one domain with hosted DMARC and BIMI.
AutoSPFPlus
$37/mo
$444/yr
Macro SPF needs Premium at $97/mo. SPF only — no DMARC/DKIM/MTA-STS.
EasyDMARCPremium
$71.99/mo
$864/yr
First tier that includes EasySPF, MTA-STS hosting, BIMI and TLS-RPT.
PowerDMARCBasic
$12/mo
$144/yr
Annual billing, 100k messages. Power SPF is a paid add-on at this tier.
DMARCLYBusiness
$69/mo
$828/yr
Safe SPF still quota-capped at this tier; SSO needs Enterprise at $199/mo.
SkysnagComply
$249/mo
$2,988/yr
First tier that includes MTA-STS, TLS-RPT and BIMI. Monitor is $39/mo, DMARC only.
dmarcianPlus
$240/mo
$2,880/yr
Basic is $24/mo but caps at 2 domains and excludes RUF.
Red SiftOnDMARC Essentials
$249/mo
$2,988/yr
Approximate. Basic is ~$35/mo but caps Dynamic SPF and domains. Brand Trust is a separate SKU.
ValimailEnforce
Contact sales
—
Contact-sales. Third-party listings cite five-figure annual contracts; Valimail publishes no figure.

List prices as published by each vendor, last reviewed 2026-06-11. Competitor tiers are billed per account with domain caps; CertaDNS is billed per protected domain, so the comparison shifts with your domain count. Full side-by-side comparisons.

Up and Running in Minutes

Go from zero email authentication to full DMARC enforcement with a guided process.

1

Add Your Domain

Add your domain under Email Authentication. Your DNS stays with your current provider — no zone import, no nameserver change.

2

Configure Authentication

Choose Static or Dynamic SPF mode, add the DKIM keys your email services use, and set up DMARC reporting. Our wizard guides you through every step.

3

Monitor & Enforce

Watch your DMARC reports in real time. Use the 5-stage policy wizard to safely progress from monitoring to full enforcement.

Start free. Grow into it.

Free is a tier, not a trial. One domain, hosted DMARC and BIMI, and your reports processed and readable — with no card and no expiry.

Free

$0

Everything needed to see who is sending as you.

  • 1 domain
  • 1 user
  • 14 days of data history
  • Hosted DMARC and BIMI
  • RUA and RUF report processing
  • DMARC geolocation report
  • Alert monitoring
  • Two-factor authentication
Start free

Plus

$12/mo

Publish every record from here, and watch delivery as well as auth.

  • 2 domains
  • 1 user
  • 3 months of data history
  • Hosted DMARC, DKIM, MTA-STS, TLS-RPT and BIMI
  • RUA and RUF report processing
  • DMARC geolocation report
  • Scheduled reports by email
  • TLS reports
  • Alert monitoring
  • Two-factor authentication
Choose Plus

Premium

$70/mo

The whole record set, your whole team.

  • 5 domains
  • Unlimited users
  • 1 year of data history
  • Hosted DMARC, SPF, DKIM, MTA-STS, TLS-RPT and BIMI
  • RUA and RUF report processing
  • DMARC geolocation report
  • Scheduled reports by email
  • TLS reports
  • Permission and group management
  • Alert monitoring
  • Two-factor authentication
  • Email support
Choose Premium

Enterprise

Custom

Every domain you own, wired into what you already run.

  • Unlimited domains
  • Unlimited users
  • 3 years of data history
  • Hosted DMARC, SPF, DKIM, MTA-STS, TLS-RPT and BIMI
  • RUA and RUF report processing
  • DMARC geolocation report
  • Scheduled and advanced reports by email
  • DMARC report export (RUA/RUF)
  • Brand protection included
  • Custom alert rules, Slack and Teams, SIEM
  • Permission and group management
  • API access and audit logs
  • Dedicated support
Talk to us

Annual billing works out to roughly one month free. Hosted SPF is a $10/month add-on on Free and Plus, and included from Premium. Full pricing.

vs. AutoSPF
$37/mo
Plus · SPF only — no DMARC, DKIM or MTA-STS
Full comparison
vs. EasyDMARC
$71.99/mo
Premium · Cheapest tier that bundles SPF flattening + MTA-STS
Full comparison
vs. Valimail
Contact sales
Enforce · Enforce tier is quote-only
Full comparison

Frequently Asked Questions

What is Dynamic SPF and why do I need it?
SPF records are limited to 10 DNS lookups. If you use multiple email providers (Google Workspace, SendGrid, Mailchimp, etc.), you quickly exceed this limit and emails start failing. Dynamic SPF uses RFC 7208 macros to evaluate each email in real time against your authorized senders, eliminating the lookup limit entirely.
How does CertaDNS compare to Valimail?
CertaDNS offers a technically comparable Dynamic SPF implementation using a different (patent-free) protocol. We use include: + TXT records vs. Valimail's exists: + A records. Our approach uses fewer DNS lookups (2 vs. 3), provides graceful failure behavior, and includes EHLO-aware provider delegation that propagates IP changes instantly. The primary difference is price: dynamic SPF is included with our Premium tier at $70/mo for five domains, or a $10/mo add-on below it — published either way. Valimail's Enforce tier is quote-only — third-party listings cite five-figure annual contracts, but Valimail publishes no figure.
Do I need to move my DNS to CertaDNS?
No. Your DNS stays where it is. For each record we host, you add one CNAME at your DNS provider pointing to CertaDNS, and we keep the record behind it current, so later changes need nothing from you. SPF is the exception: it stays a TXT record in your own zone, because the root of a domain cannot be a CNAME. If your domain is on CertaDNS Managed DNS, we publish everything in your zone directly.
What happens if I choose Dynamic SPF and CertaDNS goes down?
CertaDNS offers dual-mode flexibility. You can switch from Dynamic to Static SPF at any time. In Static mode, your SPF record contains explicit IP addresses with zero external dependencies. We recommend keeping a static fallback configuration as an additional safety net.
What email providers are supported?
We support 140+ email providers including Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailchimp, Mailgun, Postmark, HubSpot, Salesforce, Constant Contact, and many more. We also cover regional providers across Europe, Asia, Latin America, and Russia.
Which plan do I need?
Free covers one domain with hosted DMARC and BIMI, report processing and the geolocation breakdown — enough to see who is sending as you. Plus, at $12 a month, adds hosted DKIM, MTA-STS and TLS-RPT across two domains. Premium, at $70, covers five domains, adds hosted SPF and permission management, and includes unlimited users. Enterprise is quoted. None of them require you to move your DNS.
How long does it take to reach DMARC p=reject?
It depends on your email complexity, but our 5-stage wizard guides most organizations from p=none to p=reject within 4-8 weeks. The wizard monitors your authentication results at each stage and only recommends progressing when your pass rates are consistently high.

Your Competitors Are Already Authenticated.

Google and Yahoo now require SPF, DKIM, and DMARC for bulk senders. Don't let your emails land in spam — or worse, let attackers send as you.

Hosted DMARC and BIMI on your first domain, free.

Build your planCreate Free Account