Postmark DMARC Monitoring: What the Free Tier Covers and Where It Stops

Postmark's DMARC tool is the one most people meet first, because it asks for nothing. There is no account to create, no dashboard to log into, and no relationship with Postmark required. You give it a domain and an email address, publish a DNS record it generates, and a readable summary of your DMARC reports arrives by email once a week.

That design is also its limit, and the limits are published rather than hidden. This covers what the free tier actually delivers, where the paid tier begins, and the separate question of why mail sent through Postmark itself can fail DMARC alignment.

What a digest is, and why raw reports need one

Mailbox providers send aggregate DMARC reports as gzipped XML, once a day, per receiver. Each file lists sending IP addresses, message counts, and whether SPF and DKIM passed and aligned. It is machine-readable and, in bulk, close to unreadable by a person. Our walkthrough of reading a DMARC report without a parser shows what is actually in one.

A digest service sits in the middle. It receives those files on your behalf, resolves the IP addresses into named sources where it can, aggregates across receivers, and emails you a summary. Postmark's support documentation describes the purpose directly: the tool "collects reports from ISPs and presents them to you in human-readable emails sent once per week", to make it "much easier to understand and implement DMARC on your domain".

The trade is that the reports go to the vendor rather than to you. That is how every processor in this category works, and it is worth knowing rather than avoiding.

1. Step 1You publish a record

   Postmark generates a rua address on its own domain and you put it in your DMARC record.

2. Step 2Receivers report

   Gmail, Outlook and others send aggregate XML to that address once a day.

3. Step 3Postmark aggregates

   Reports are parsed, sources resolved and counts combined across receivers.

4. Step 4You get a digest

   One readable email per week, with no dashboard on the free tier.

Setting it up

The tool generates a DMARC record for you, in the shape v=DMARC1; p=none; pct=100; rua=mailto:<your-unique-address>@dmarc.postmarkapp.com; sp=none; aspf=r;, and asks you to publish it as a TXT record on the _dmarc hostname for your domain.

Two notes on that record. It starts you at p=none, which is the correct place to start and is not the place to stay; what the policy not enabled warning means covers the decision. And it includes pct=100, a tag the current standard treats as historic since RFC 9989 obsoleted RFC 7489 in May 2026. Leaving it in place is harmless, since receivers ignore tags they do not recognise, and the DMARC record tag by tag covers what replaced it.

Verification is patient by design. Postmark's FAQ notes that DNS providers can "take up to 24 hours to propagate" and that it will "attempt to verify your DMARC DNS record every 30 minutes" until it succeeds, then confirm by email.

One setup detail is worth doing at the same time, because retrofitting it is annoying. You can keep the raw reports as well as the digest by listing two addresses in the rua tag, which Postmark's own FAQ documents with a worked example: the generated address, a comma, then your own mailbox. That leaves you holding the source files if you ever change tools.

The free tier, precisely

Postmark publishes the boundary on its own comparison, and the numbers are the reason to read it before assuming the free tier is enough.

Free monitoring covers the "Top 10 mail sources with 5 IPs for each source", keeps seven days of history, is delivered by email only with no web dashboard, has no user management, and arrives weekly. Postmark describes it as "Great for monitoring personal domains", which is an honest framing of that feature set.

The support FAQ adds three processing limits that matter at volume. Reports carrying fewer than 100,000 records are fully processed, and "Any report exceeding this limit will be truncated to the first 100,000 items". The maximum size of an unarchived report it will store is 3MB, and larger ones have their metadata extracted before the report itself is discarded. Report metadata is retrievable through the API "for up to 2 weeks".

The paid tier, DMARC Digests, covers "All mail sources and IPs" with 60 days of history, a web dashboard alongside email, user management, and weekly and monthly digests, at "$14 a month per domain" following a 14-day trial.

Free monitoringNo account required

• Top 10 sources, 5 IPs each
• 7 days of history
• Email only, weekly
• No user management

DMARC Digests$14 a month per domain

• All mail sources and IPs
• 60 days of history
• Web dashboard and email
• Weekly and monthly, with user management

Why Postmark's own sending can fail DMARC

This is a different question that arrives under the same search, and the answer is in Postmark's documentation rather than in anything you configured wrongly.

Like most sending platforms, Postmark collects bounces using a Return-Path on a domain it controls, pm.mtasv.net. DMARC's SPF check compares the Return-Path domain against the visible From domain, so a message sent through the platform with your From address fails SPF alignment by construction. Postmark's FAQ says so plainly, and adds the part that keeps this from being a crisis: "DMARC only requires either SPF or DKIM to be aligned."

So the message still passes DMARC as long as DKIM is signing on your domain. The fix, if you want SPF alignment too, is a custom Return-Path domain on your own domain, which Postmark documents separately.

The general lesson travels beyond this vendor. Any platform sending as you will fail SPF alignment unless you give it a Return-Path on your domain, and DKIM is what carries DMARC in the meantime. That is the first entry in the six causes of DMARC failure, and it is why DKIM alignment is worth more attention than SPF once you have several senders.

Reading the digest without over-reading it

A weekly digest is a summary of what receivers reported, and three habits keep it useful.

Treat an unfamiliar source as a question rather than an attack. Most new entries turn out to be a marketing platform somebody connected, a forwarding arrangement, or a monitoring service, and genuine spoofing looks the same in the report as any of those until you check. The useful move is to name every source you can account for and shrink the unexplained list, rather than reacting to each week's arrivals.

Expect gaps, and do not read one as good news. Postmark's FAQ notes that a digest is sent only if a report was received during the period, so a silent week means no reports arrived, which is a different statement from no problems occurring. On a sending domain that runs in waves, silence is the normal state between campaigns.

And remember what the report is measuring. Aggregate reports describe authentication results, not what happened to the message afterwards. A domain can show a clean sheet across every receiver and still be landing in spam folders, because placement is a separate question with separate causes.

Whether it fits an outbound domain portfolio

For a company with one domain that wants to know who sends as it, the free tier answers the question at zero cost and is hard to argue with.

For an outbound programme running many sending domains, the arithmetic changes in two places. Per-domain pricing multiplies: the paid tier across a portfolio is a per-domain line item repeated as many times as you have domains, which is worth pricing out against volume-based competitors before committing. And the free tier's seven-day history is short relative to how these domains actually behave, since a sending domain that runs in waves can be quiet for longer than the retention window.

The top-ten truncation cuts the other way and is less of a problem than it sounds for this use case. A dedicated cold-email domain typically has very few legitimate sources, so ten is generous. It is the primary company domain, with its CRM and invoicing and helpdesk and marketing platform, where ten sources runs out.

Alternatives across the category, including the volume-priced and self-hosted ones, are compared in seven DMARC tools on what they actually do.

We authenticate every sending domain before it carries a message and run one message per campaign, so there is no second attempt at the same person if a domain is failing. Monitoring exists to catch the drift after launch rather than to find problems at launch, which is a different job from the one a checker does. If you would rather not own that layer, we run the sending infrastructure as part of the engagement.

The short version

Postmark's free DMARC tool needs no account, generates the record for you, and emails a readable weekly digest, with the free tier capped at ten sources and seven days of history. Add your own mailbox to the rua tag while you are setting it up so you keep the raw files. The paid tier at fourteen dollars a month per domain lifts those caps and adds a dashboard, which prices differently for one domain than for thirty. And if the question that brought you here was why mail sent through Postmark fails DMARC, the answer is SPF alignment against pm.mtasv.net, solved by DKIM signing on your own domain.

Vendor figures verified as of August 2026 against Postmark's published DMARC tool pages and support FAQ, and specification behaviour against RFC 9989. Verify current pricing and limits with the vendor before relying on them.