In short: Valimail, now a DigiCert company, is a cloud platform that automates SPF, DKIM and DMARC. After a one-off set of DNS changes, you authorise sending services by name in its console instead of editing DNS, and its hosted SPF avoids the ten-lookup limit. Valimail Core covers automated enforcement; Valimail Pro adds BIMI, MTA-STS and continuous protection reporting.
What Valimail does
Most organisations send email through far more services than they realise: Microsoft 365 or Google Workspace, plus CRM, finance, HR, ticketing, e-signature and marketing platforms. Each one must pass SPF or DKIM with alignment before you can safely set DMARC to reject, and each one changes over time. Doing that by hand means reading XML reports, researching each sender and editing DNS every time something is added.
Valimail replaces most of that manual work with hosted authentication. You make a one-time set of DNS changes that hand management of your SPF and DMARC records to Valimail, and from then on the work happens in its console:
- Sender identification: DMARC report data is matched against a large library of known email services, so you see named services rather than raw IP addresses
- One-click authorisation: approve a legitimate service and Valimail updates authentication for it; ignore or block the unknowns
- Instant SPF: Valimail's hosted SPF answers each lookup with a response tailored to the sending server, so you are not constrained by SPF's ten-lookup limit
- DKIM and policy management: DKIM set-up guidance per service and DMARC policy changes made from the dashboard
- One view of every domain, with multi-tenancy and role-based access so IT, marketing and auditors each see what they need
Valimail is now part of DigiCert, the certificate authority, and describes itself as "a DigiCert company". Valimail says accounts, products and support carry on unchanged. The link matters mainly for BIMI, because DigiCert issues the Verified Mark Certificates that most large mailbox providers require before they show your logo.
Valimail Core and Valimail Pro compared
We supply Valimail in two editions designed for managed delivery, with all of your domains in one tenant that we run alongside you. The differences are about how much extra protection and reporting you need:
| Capability | Valimail Core | Valimail Pro |
|---|---|---|
| Automated SPF (Instant SPF), DKIM and DMARC | Yes | Yes |
| Sender discovery and authorisation by service name | Yes | Yes |
| Multi-domain dashboard with multi-tenancy and role-based access | Yes | Yes |
| Help meeting Google, Yahoo and Microsoft sender requirements | Yes | Yes |
| BIMI brand logo management | No | Yes |
| MTA-STS for encrypted inbound mail transport | No | Yes |
| Continuous protection reporting (DKIM key best practice, audit of unused senders) | No | Yes |
| More flexible alerting, including record changes | No | Yes |
| API access for account management, policies and reporting | No | Yes |
Core suits most organisations that need to stop spoofing and meet mailbox provider rules. Pro suits larger or fast-changing email estates, organisations that want their logo shown in supporting inboxes, and those whose auditors want evidence that authentication stays correct over time. Core also has a reporting-only licence for domains where you only want DMARC visibility rather than full managed enforcement.
On Valimail's own website you will see its direct plans described differently: Monitor (free visibility of your senders), Enforce (automated enforcement, in several tiers) and Amplify (BIMI). Core and Pro bring the same automation together in a form we can license and manage for you. Licensing detail is on Valimail licensing.
How deployment works
A typical Valimail project follows the same path as any DMARC project, but with less manual DNS work:
- Inventory every domain, including parked and legacy ones, and decide which need full management and which need reporting only.
- Connect each domain by making the one-time DNS changes Valimail specifies for SPF and DMARC.
- Review senders as reports arrive, authorise the legitimate services and set up DKIM signing for each of them with your domain.
- Enforce by stepping the DMARC policy to quarantine and then reject from the console, checking reports at each stage.
- Maintain: alerts flag new or failing senders so a new marketing tool does not silently start failing, or get spoofed.
Because the records are hosted, you do not need a DNS change ticket every time a team adopts a new service, which is where manual DMARC programmes usually slip backwards. The trade-off is a dependency: your SPF and DMARC answers come from Valimail's service, so if you ever leave you need to publish your own records again first.
Who Valimail suits
Valimail is a good fit for organisations that:
- Send from many services or have marketing, finance and HR teams adding email tools without telling IT
- Own several domains or brands, including parked domains that need locking down
- Have hit the SPF ten-lookup limit or have an SPF record nobody dares touch
- Have had customers or suppliers receive fake invoices in their name
- Need evidence for an insurer, auditor or public sector customer that DMARC is enforced and maintained
For a single domain sending only from Microsoft 365, hosted automation may be more than you need: a carefully configured record and a reporting tool can be enough. We will tell you which applies.
Valimail compared with other DMARC options
Valimail sits among a small group of DMARC services we work with, and the right one depends on how you want to manage email authentication:
| Valimail | EasyDMARC | IRONSCALES DMARC | |
|---|---|---|---|
| Core approach | Automation around a named-sender library, with Instant SPF hosting | Readable reporting plus hosted (managed) DMARC, SPF (EasySPF), DKIM, BIMI and MTA-STS records | DMARC module inside an API-based email security platform |
| Best fit | Many senders and domains, minimal manual work | Multi-domain estates wanting detailed reporting and DNS monitoring | Organisations already using IRONSCALES for inbound email |
| Licensing | Per domain | Per domain, monthly | Per domain |
None of these filters inbound phishing on its own: DMARC protects your domain in other people's inboxes. Pair it with email security such as Microsoft Defender for Office 365 for the mail your staff receive.
How we help
We license, set up and run Valimail for you. That covers the domain inventory, the DNS changes, chasing down unknown senders across your departments, the move to reject, and the ongoing reviews and alerts afterwards. If you would rather keep the console in-house, we can hand over after enforcement and stay available for changes. Pricing is per domain and depends on edition and how much management you want: ask us for a quote.
Contact us to get your domains to DMARC enforcement.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Valimail?
Valimail is a cloud service that automates SPF, DKIM and DMARC email authentication. It identifies the services sending email as your domain, lets you authorise them from a console instead of editing DNS, and helps you reach and keep a DMARC enforcement policy that stops spoofing.
What is the difference between Valimail Core and Valimail Pro?
Both automate SPF, DKIM and DMARC with sender discovery and a multi-domain dashboard. Valimail Pro adds BIMI logo management, MTA-STS, continuous protection reporting on DKIM key practice and unused senders, more flexible alerting and API access.
Who owns Valimail?
Valimail is now part of DigiCert and describes itself as a DigiCert company. Valimail says existing accounts, products and support are unchanged, and the two companies are combining DMARC enforcement with DigiCert's Verified Mark Certificates for BIMI.
What is Instant SPF?
Instant SPF is Valimail's hosted SPF service. Instead of a static record full of include statements, Valimail answers each SPF query with a response that fits the sending server, which avoids SPF's limit of ten DNS lookups.
Does Valimail work with Microsoft 365?
Yes. Microsoft 365 is one of the sending services Valimail recognises. You still enable DKIM signing for your custom domains in Microsoft 365, and Valimail manages the SPF and DMARC side and reports on alignment.
Is Valimail per user or per domain?
Valimail is licensed per domain rather than per mailbox, so the cost is driven by how many domains you protect and the edition, not by headcount. Parked domains count too, because they also need a reject policy.