When a client's domain gets spoofed, it's your ticket either way. Canny Pigeons is DMARC monitoring built for MSPs — a service you can run at scale rather than a tool for one domain: every client domain on one dashboard, hosted DMARC so policy changes stop being DNS change requests, and daily drift alerts on Pro, Business and Partner plans.
Free tier is permanent — trial the workflow on one client before you commit the book.
Google and Yahoo require DMARC from bulk senders since early 2024, and Microsoft followed for Outlook in 2025. Clients who "never had a deliverability problem" are starting to have one — and the fix lands on whoever runs their IT.
Cyber-insurance questionnaires and security frameworks increasingly ask about email authentication outright. "We have SPF" doesn't tick the box; a monitored DMARC policy at enforcement does.
Business email compromise starts with a domain that anyone can send as. Without DMARC at p=reject, a client's own name is an open tool for invoice fraud against their customers — and the cleanup call comes to you.
The hard part of client DMARC isn't the standard — it's that client DNS lives across a dozen registrars with half-lost logins. Hosted DMARC means you touch each client's DNS exactly once.
Each domain gets its own dashboard, its own report address, its own policy state. Your view is the whole book; each client's view can be just theirs.
Point _dmarc at us and we serve the policy. Every later change — p=, pct=, sp= — is a button in your dashboard, not a change window with the client's web agency.
Reports fill each dashboard, senders get identified by name, and you tighten each client's policy when their senders are aligned — the same playbook, repeated. The onboarding playbook →
Every client domain has its own senders, its own policy state, its own history — clean enough to screen-share in the client's quarterly review.
Your whole bench gets logins. Seats are never a line item, so headcount never argues with margin. Choose Admin, Member and Viewer roles on Business and Partner plans.
Client web agencies edit SPF. Migrations drop DKIM keys. On Pro, Business and Partner plans, we re-check every domain's records daily and email you the before/after diff — you find out in a day, not at renewal. Why records drift →
On Pro, Business and Partner plans, every IP in your clients' reports arrives enriched — geolocation, network owner, attacker/abuser flags — so "who is this sender?" answers itself before the client asks you.
More than 5 domains means the Bulk plan: sized to your client base, per-domain dashboards for client reporting, priority support. One email, one price, no add-on decoding.
DMARC monitoring is recurring by nature — records drift, senders change, reports never stop. That's a monthly line item on your invoice, not a one-off project. How MSPs package it →
"White label DMARC" gets used for two different things: reselling the monitoring as your own service, and rebranding the software your client logs into. The first you can do today. The second you can't — and we'd rather you knew that before you sold it.
Nothing ties a client domain to a contract with us. One Bulk plan covers the whole book, and what the client sees is your service, on your invoice, at your price. The margin between the two is yours. How MSPs package and price it →
Seats are unlimited on every plan. On Business and Partner plans, invite clients as Members or Viewers to read reports while keeping policy changes with your team. You can also keep the dashboard as your working tool and hand clients the quarterly summary yourself.
No custom domain, no logo upload, no branded report PDF: the dashboard chrome and the alert emails say Canny Pigeons, and most MSPs run it as the tool behind a service of their own name. If full white-labelling is the one thing standing between you and thirty client domains, say so on a Bulk-plan call — that's where the roadmap gets decided.
What changes between one domain and thirty — DNS access, sender inventories, drift — and what's worth systematizing before domain four.
6 minThe repeatable per-client playbook: audit, publish, inventory senders, align, tighten — with exit criteria for every stage.
4 minPackaging, pricing, the ninety-second pitch that closes in one meeting, and the objections you'll actually hear.
5 minFree covers one domain forever and Pro ($19/mo) covers up to 5 — enough to trial the workflow on real clients. Past that, the Bulk plan is custom: priced to your client base rather than a per-domain rate card. Email support@cannypigeons.com with roughly how many domains you manage and you'll hear back from the founder within a day.
Yes — seats are unlimited on every plan. Business and Partner plans include Admin, Member and Viewer roles, so you can invite clients to read reports while keeping policy changes with your team.
Not today. You can resell the monitoring as your own service line — one Bulk plan for the whole client book, your price on your invoice — but the dashboard chrome and the alert emails say Canny Pigeons, and there's no custom domain, logo upload or branded report PDF yet. If that's the blocker, say so on a Bulk-plan call: that's where the roadmap gets decided.
Remove the domain and point their _dmarc record wherever they're going next (or hand them a TXT equivalent of their current policy so nothing breaks in the handover). Domains aren't locked in — DMARC is DNS, and the DNS stays theirs.
Reading raw aggregate XML for one domain is a chore; for thirty it's a full-time job nobody actually does — which means nobody is really watching. The honest comparison isn't "tool vs. tool", it's "monitored vs. silently unmonitored".
One client domain free, no card. See pricing →