A PowerDMARC alternative: Patchkit compared

PowerDMARC details are taken from PowerDMARC's own pages as published on October 10, 2026. Prices are shown exactly as listed there, with their currency and billing period, and they change often. A — means the official pages did not state it.

Who each product is for

PowerDMARC sells DMARC together with hosted services for the related standards: hosted DMARC, SPF, DKIM, BIMI, MTA-STS and TLS-RPT. Its pricing page offers a free plan for personal domains, a self-serve Basic plan, an Enterprise plan on quote, and a partner program for MSPs, MSSPs, resellers and hosting and domain providers, with no contracts and the option to cancel at any time.

Patchkit makes the opposite bet on hosting. It serves no records at all; it reads public DNS and your aggregate reports, explains what is wrong with SPF, DKIM and DMARC, and writes out the record you should publish. That suits whoever already edits the zone, whether an owner, a developer or the one IT person, and wants to keep doing so on the way to p=reject.

Price and plan limits

PowerDMARC's pricing is based on outbound DMARC-compliant email only, so phishing and other invalid mail sent in your name does not count. The free plan is for personal domains only and covers one active domain, 10,000 compliant emails a month, ten days of data history and one user. Basic covers five active domains, two users and a year of history, and you pick a monthly email volume from a list that runs from 50,000 to 2,000,000; the price shown in the table is for the recommended 100,000. Basic starts with a 15-day free trial, and paying annually saves up to 20 percent.

PowerDMARC's free plan is limited to one personal domain and caps mail volume. Patchkit's free plan covers 1 domain, allows business use, counts no mail and keeps 14 days of history. One step up, the trade is different: PowerDMARC's Basic includes five domains, two users and the hosted services, while Patchkit's Starter, at $9/mo or $90/yr a year (10 months charged), includes 3 domains, one login and no hosting. Larger Patchkit plans add domains, not features: 15 on Pro at $29/mo and 75 on Agency at $79/mo.

Free tools without an account

PowerDMARC's free tools include DMARC, SPF and DKIM record checkers and generators, and generators for BIMI, MTA-STS and TLS-RPT records. Its MX lookup needs no signup, and its domain analyzer grades DMARC, SPF, DKIM, BIMI, MTA-STS and TLS-RPT together and checks the Google, Yahoo, Microsoft and Apple sender requirements. Patchkit checks BIMI and MTA-STS, including the TLS-RPT record, with separate free checkers rather than in one graded report.

Patchkit's closest equivalent to that analyzer is its domain health check, which runs the SPF, DKIM and DMARC checkers and the MX lookup in one go. The full free set is the domain health check, the DMARC checker, the SPF checker, the DKIM checker, the MX lookup, the SPF generator, the DKIM generator, the DMARC generator, the DMARC report analyzer, the email header analyzer, the BIMI checker, the MTA-STS checker, the MTA-STS generator, the TLS-RPT report analyzer, the blacklist checker and the PTR checker. All of them are one-off checks that need no account. Monitoring is narrower: the scheduled health measurement scores DMARC, SPF, DKIM and MX, and record alerts watch your DMARC and SPF records. Common findings link to a generator or a guide that explains the fix, and for common senders and DNS hosts the setup guides show where each record goes. Unlike PowerDMARC's analyzer, the health check does not grade BIMI, MTA-STS or TLS-RPT.

Report monitoring and alerts

Every PowerDMARC plan, the free one included, processes both aggregate (rua) and forensic (ruf) reports and adds a geolocation report; Basic adds TLS reports. Its PowerAlerts page lists DNS, threshold, forensic, TLS-RPT threshold, security health and DNS takeover alerts. DNS alerts cover DMARC, SPF, DKIM, BIMI, MTA-STS, TLS-RPT, A, MX and NS records, and alerts can go to several recipients by email or webhook.

Patchkit watches far fewer things. Its record alerts cover your DMARC and SPF records only, flagging one that disappears or changes, plus SPF going over its lookup limit; the rest come from your reports: a new unknown sender, a drop in alignment, and reports that stop arriving. There are no forensic, TLS or DNS takeover alerts and no webhook, and reports are aggregate only. In return the set is the same on every plan: dashboard alerts on Free, email alerts from Starter and a weekly summary email for everyone.

The path to p=reject

PowerDMARC's Hosted DMARC, included on every plan, hosts your DMARC policy so you can change it from the dashboard without editing DNS after the first setup, and PowerDMARC presents it as a way to move to p=reject faster. Basic and Enterprise also list an AI agent.

PowerDMARC's Hosted DMARC guide describes the setup: you delete your DMARC TXT record and publish a CNAME at _dmarc, and from then on policy, alignment and report recipients are edited in the portal. Hosted DMARC also supports the testing-mode tag t=y and the np= tag from the new DMARC standard. Patchkit hosts nothing. Its path-to-p=reject roadmap reads your reports, says which readiness criteria are not met yet and gives you the next TXT record to publish, so a policy change is a DNS edit you make, not a click in a portal.

Where PowerDMARC is the better fit

If you would rather have a vendor serve your authentication records than maintain them yourself, PowerDMARC offers a hosted option for most of them, along with features Patchkit lacks:

• Forensic (ruf) report processing on every plan, including the free one.
• Hosted SPF, which keeps your SPF record within the lookup limit for you, as an add-on on Basic and included on Enterprise.
• Hosted BIMI on every plan, and hosted MTA-STS and TLS-RPT from Basic.
• Hosted DMARC with support for the DMARCbis t=y and np= tags, edited from the portal.
• More than one user from Basic, and SIEM support, SPF and DKIM analytics and lookalike domain monitoring on Enterprise.
• A partner program for MSPs and resellers with a multi-tenant control panel, white-labelling the whole portal (Patchkit's Agency plan brands the PDF reports only, not the portal), APIs, PSA integration and pay-as-you-go billing.

Patchkit fits people who want the reverse arrangement: every record stays a plain entry in their own zone, readable by anyone and owned by nobody else, and the product's job is to read the reports and say what to change. Its SPF generator is the do-it-yourself counterpart to Hosted SPF.

How to switch, or try both

If you publish your own DMARC TXT record and only send reports to PowerDMARC, switching is the usual one-tag change: add the Patchkit address from the setup screen next to PowerDMARC's in rua, compare for a week or two, then remove PowerDMARC's. With Hosted DMARC there is more to it, because the record you publish is a CNAME that points to PowerDMARC.

1. To try both first, add the Patchkit address in the portal. The Hosted DMARC guide lists additional aggregate report (rua) recipients among the settings you can edit there.
2. When you decide to leave, copy the policy, subdomain policy, alignment and report settings from the portal.
3. Build an equivalent TXT record with the DMARC generator, including the Patchkit address.
4. Delete the _dmarc CNAME and publish the TXT record straight after, since the two cannot coexist.

Hosted SPF, BIMI and MTA-STS records need the same treatment before you cancel, because Patchkit does not host records. Check the new SPF record with the SPF checker, then run the domain health check once everything is live.

How the PowerDMARC facts were gathered

PowerDMARC's plans come from its pricing page, its features from its tools, MX lookup, domain analyzer, alerts, hosted DMARC, hosted SPF and partner pages, and the setup details from its support article on Hosted DMARC, all read on the date at the top. Basic's price changes with the email volume you select, so the table quotes the default shown on the page. Corrections go to support@patchkit.app.