Valimail vs.
DMARC-SRG in 2026

Valimail recognized Microsoft 365 and Google Workspace quickly after DNS traffic arrived, and it grouped SendGrid and Mailchimp into service names we could map to owners. The unknown sender took a manual check because the UI showed the source before it knew the business owner, but the unauthorized spoof sample was easy to separate from approved senders. The SPF pass with visible From mismatch was handled as a DMARC failure case rather than a generic mail source, which made enforcement planning more concrete.

DMARC-SRG parsed aggregate reports into domain, month, organization, DKIM, and SPF views, and that was enough to confirm Microsoft 365 and Google Workspace authentication results. SendGrid and Mailchimp did not become clear sender names without our own notes, and the unknown sender stayed an IP and reporting organization until we investigated it. The DKIM pass on a subdomain was visible in the raw details, but the tool did not turn that edge case into a policy recommendation.

Valimail onboarding for the corporate domain, marketing subdomain, and parked domain took under an afternoon because the DNS steps were sequenced and the first reports appeared in a single domain view. The unknown sender was findable through sender views, but assigning ownership still required our notes from SendGrid, Mailchimp, and the support desk. The forwarded mail SPF failure was visible as a failure pattern, although the explanation was not as plain as a junior operator would need.

DMARC-SRG started with infrastructure work before analysis: web server, PHP, database, IMAP ingestion, cleanup settings, and upload limits. Once reports arrived, the three domains were filterable, but moving between the parked domain and marketing subdomain felt like database inspection through a web UI rather than a guided workflow. The forwarded mail SPF failure was present in the SPF result, but the tool did not explain forwarding as the likely reason.

During setup, Valimail's DNS handoff was the cleaner option for a team that has separate security and DNS owners. The free tier covered monitoring, while paid tiers introduced onboarding assistance, account manager support, and escalation paths that fit larger DMARC programs. For enterprise onboarding, the tradeoff was price discovery: we could see the free tier and the $5,000 per year entry point, but Premium and Enterprise details required a sales step.

DMARC-SRG did not create a support handoff, which was expected for open-source software but still mattered in the test. If the parser stopped ingesting reports, the owner would need to debug IMAP, PHP limits, MariaDB or MySQL, cron, and storage. DNS questions also stayed outside the product because it reports on authentication results rather than managing records.

Valimail made the most sense for enterprise and mid-market teams with a clear domain inventory and a budget for enforcement. Account separation and portfolio-style views were better suited to internal business units than high-churn MSP client work in our test, and recurring reporting improved once the senders were classified. Client handoff notes still needed our own writing when we documented why the support desk sender was approved but the spoof sample was not.

DMARC-SRG fit a small technical team that values local storage and has time to operate the stack. It did not give us client grouping, recurring executive reports, or clean handoff notes for MSP work, so each customer-style summary had to be built outside the product. SMBs with one domain can accept that tradeoff if they have an administrator who understands DMARC results.