EasyDMARC Setup Guide: What It Costs to Stop Attackers From Spoofing Your Business Email
By UVIDSTUDIO · September 30, 2026 · 8 min read · Cybersecurity
EasyDMARC is free for a single domain up to 1,000 emails a month, then roughly $36-$45/month once you add a second domain or outgrow the free report history — the tool that stops criminals from sending fake invoices and wire-fraud emails that look like they came from your own address. The real cost math, the setup order, and why this is different from spam filtering.
Most small businesses assume their email is either "hacked" or "fine" — there is no third option in their mental model. But the fraud that actually drains small-business accounts rarely requires hacking anything: an attacker just types your domain into the "From" field and sends an invoice, a wire request, or a W-2 form that looks exactly like it came from you, because nothing on the internet was stopping them from claiming your address. EasyDMARC exists to close that specific gap — it does not scan your inbox for spam, it publishes the record that tells every mail server in the world "only these servers are allowed to send as us," then shows you, in plain language, who is actually doing it. Here is what it costs, the setup order that gets it protecting your domain this week, and where it stops being the whole answer.
The cost structure
EasyDMARC's free plan covers one domain, up to 1,000 monitored emails a month, and 14 days of report history — enough for a single-location small business to see who is sending as their domain and start building a real DMARC record. That free tier is not a crippled trial; it is a genuinely usable starting point, which matters because the alternative to a tool like this is reading raw DMARC aggregate reports by hand, an XML format no small-business owner should have to parse.
Once a business needs a second domain (a separate brand, a nonprofit's program site, an old acquired domain still capable of sending mail), needs longer report history for an insurer or funder audit, or wants managed enforcement help, the Plus plan runs roughly $36-$45/month depending on annual vs. month-to-month billing, covering two domains. Premium runs roughly $72/month for four domains and adds MTA-STS and TLS-RPT, which harden the transport layer itself so mail cannot be silently downgraded to an unencrypted connection between servers. For the typical Jersey City storefront or Hudson County nonprofit running one or two domains, the free tier or the Plus tier is the realistic range — the enterprise multi-domain pricing above that is built for agencies and MSPs managing client portfolios, not a single small business.
Setup: the this-week version
1. Sign up free and add your primary sending domain first — EasyDMARC generates the exact DNS records you need, which matters because a hand-typed DMARC record with one wrong character silently fails to protect anything.
2. Publish a DMARC record in "monitor only" mode (p=none) before enforcing anything — this is the step people skip and regret. Monitor mode collects real data on every server sending as your domain for one to two weeks without blocking a single legitimate email, which is how you catch the invoicing tool or the newsletter platform you forgot was sending on your behalf.
3. Read the aggregate reports EasyDMARC turns into a readable dashboard and confirm SPF and DKIM are passing for every legitimate sender — your Google Workspace mail, your CRM's email sends, your invoicing tool, your marketing platform — before moving to enforcement.
4. Move to quarantine mode (p=quarantine) once legitimate senders are all passing clean, so spoofed mail lands in recipients' spam folders instead of their inbox, with almost zero risk to your own deliverability at this stage.
5. Move to full enforcement (p=reject) after quarantine runs clean for a few weeks — this is the setting that actually stops a criminal from successfully sending as your domain at all, and it is the step that protects your customers and vendors from fraud dressed as you, not just your own inbox.
6. Set EasyDMARC's alerts for new, unrecognized sending sources so a future integration — a new payment processor, a new SMS or email platform — gets noticed and approved rather than silently blocked or silently ignored.
Where it fits — and where it stops
EasyDMARC earns its place because it solves a problem almost nothing else on a typical small-business tool stack addresses: it is not a spam filter protecting your inbox, it is a domain-authentication record protecting your reputation and everyone who receives mail claiming to be from you. For the restaurants, contractors, and nonprofits we work with across Jersey City, Hudson County, and the wider NYC metro, this is frequently the single highest-leverage cybersecurity fix available, because a spoofed invoice email costs a real customer real money and does lasting damage to the business's name — long after the actual attacker is unreachable.
It stops being the whole answer the moment the conversation shifts from "who is sending as our domain" to "did someone actually get into our mailbox." That is a different threat entirely, and it is where phishing-resistant MFA, strong Google Workspace security settings, and team training on verification habits take over. DMARC stops someone else from impersonating you; it does nothing if your own account gets phished. The two problems look similar from the outside and need completely different fixes.
The honest summary: if your business sends invoices, receipts, or any email a customer might act on financially, a DMARC record is a one-time setup with a real payoff, and EasyDMARC's free tier removes any excuse not to start this week. Budget for Plus once you have a second domain or need more than two weeks of history. If you would like help moving your domain from monitor mode to full enforcement without breaking legitimate mail along the way, that is exactly the kind of cybersecurity work we do for small businesses across Jersey City, Hudson County, and the wider NYC metro.