DMARC Dojo vs Cloudflare DMARC Management
Cloudflare DMARC Management is free on Cloudflare DNS. How it compares to DMARC Dojo on hosting, sender fixes, alerts, history and reaching p=reject.
Updated October 6, 2026
Cloudflare DMARC Management is free for every Cloudflare customer whose domain uses Cloudflare DNS. Since it became generally available in June 2026 it shows which sources send as your domain and whether they pass, checks your DMARC, SPF, DKIM and BIMI records with plain-language recommendations, and audits your SPF lookups. Your records stay ordinary DNS records that you edit, and tightening the policy is up to you. DMARC Dojo works with any DNS host, hosts the records for you, tells you the exact fix for each sender from your own reports, alerts you when something breaks and walks you to p=reject with a readiness check. Cloudflare suits a domain already on Cloudflare that you’re happy to manage by hand; DMARC Dojo suits teams that want a guided path to enforcement.
At a glance
Facts about Cloudflare come from its DMARC Management documentation and its June 2026 announcement (see sources below).
| DMARC Dojo | Cloudflare DMARC Management | |
|---|---|---|
| Price | Free (1 domain); Pro $19/month or $190/year (25 domains); Teams $99/month (100 domains) | Free for every Cloudflare customer |
| Where your DNS lives | Any DNS host; one-click connection for Cloudflare and Amazon Route 53 | Must be on Cloudflare DNS; apex domains only (not subdomains) |
| Email-volume limits | None on any plan | None published |
| Setup | One-click connect, or a _dmarc CNAME, an SPF redirect= and DKIM CNAMEs | Enable in the dashboard; Cloudflare adds its own report address to your DMARC record, or offers to create one |
| Records | Hosted by DMARC Dojo; changes go live from the dashboard without another DNS edit | Regular records in your Cloudflare zone, which you edit |
| Sending sources | Grouped by provider, with network owner, location and blocklists for unknown senders, and a likely-spoofing alert | Top sources with SPF, DKIM and DMARC results; an Investigate tab with Cloudflare’s threat intelligence on each IP |
| Fix guidance | Recommended fixes per sender from your reports: the exact SPF include, custom return-path or DKIM setup each service needs | Pass, warning or fail checks on your records with plain-language recommendations |
| SPF 10-lookup limit | Refuses changes that would break it; flattening past the limit on Pro and Teams | Counts lookups and warns; you remove entries yourself |
| Path to p=reject | Belts, a readiness review before p=reject, a pct ramp and one-click quarantine once senders pass | Recommendations; you change the policy yourself, “at your own pace” |
| Report history | 12 months on every plan, plus each individual report | View a period of up to 30 days at a time; longer retention not published |
| Alerts | Email on every plan; Slack app and signed webhooks on Pro and Teams | Not mentioned in Cloudflare’s documentation |
| Forensic (RUF) reports | Pro and Teams (message bodies dropped) | Not mentioned in Cloudflare’s documentation |
| MTA-STS / TLS-RPT / BIMI | Hosted on Pro and Teams | Shows BIMI record status; MTA-STS and TLS-RPT aren’t part of DMARC Management |
| AI and MCP | AI analyst on Pro and Teams; MCP server | None mentioned |
| Agencies & MSPs | Teams: client sub-accounts and branded read-only portals | Each domain is managed in its own Cloudflare zone |
Where Cloudflare is stronger
- It’s free, with no domain cap. Every domain on Cloudflare DNS can use it at no cost. DMARC Dojo’s Free plan covers one domain; more need Pro or Teams.
- Nothing new to sign up for. It lives in the Cloudflare dashboard you already use, next to your DNS, so there’s no extra vendor to review or account to manage.
- Cloudflare’s threat intelligence. The Investigate tab shows Cloudflare’s reputation, geolocation and network data for each sending IP, drawn from one of the largest networks on the internet.
- Editing records is already easy. If your DNS is on Cloudflare, changing a record is a quick edit in the same dashboard, so hosted records save you less time than they would at a slower DNS host.
Where DMARC Dojo is stronger
- Any DNS host. Cloudflare DMARC Management needs your domain on Cloudflare DNS. DMARC Dojo works wherever your DNS is, and connects to Cloudflare or Route 53 in one click.
- The exact fix for each sender. DMARC Dojo reads which envelope domains and DKIM signatures each service actually uses in your reports and tells you what to change: add
include:mail.zendesk.comto SPF, set up a custom return-path at Amazon SES, or publish Mailchimp’s DKIM records. Missing SPF includes can be added in one click. - A guided path to p=reject. Belts track progress, quarantine is one click once every sender passes, and
p=rejectgoes through a readiness review that checks 30 days of reports first, with an optionalpctramp. Cloudflare leaves the policy change to you. - SPF that can’t break. Cloudflare warns when SPF goes over 10 lookups; DMARC Dojo refuses the change, and on Pro and Teams can flatten includes to IP ranges and keep them current.
- Alerts. Email alerts on every plan when a record breaks, a new sender starts failing or the pass rate drops, plus a one-click Slack app and signed webhooks on Pro and Teams. Cloudflare’s documentation doesn’t describe alerts for DMARC Management.
- More history and more protocols. See trends across 12 months of reports on every plan (Cloudflare’s dashboard shows up to 30 days at a time) and open any individual report, and host MTA-STS, TLS-RPT and BIMI on Pro and Teams.
- AI analyst and client portals. An AI analyst explains your reports in plain English and flags likely spoofing; Teams adds client sub-accounts and branded portals for agencies.
Using both
You don’t have to choose. A DMARC record can send reports to more than one address, so Cloudflare and DMARC Dojo can both receive the same data:
- Add your domain to DMARC Dojo and use one-click setup for Cloudflare. DMARC Dojo imports your current DMARC policy, SPF senders and DKIM keys before changing anything.
- Keep Cloudflare’s report address. The import keeps the other report addresses in your record (up to five) under “Also send reports to”, so Cloudflare keeps receiving reports.
- Use DMARC Dojo’s recommended fixes to get every sender passing SPF and DKIM, then move to
p=quarantineandp=reject. Remove Cloudflare’s address later if you no longer need it.
Not sure what your records say today? Run them through the free domain checker.
Which should you choose?
- Choose Cloudflare DMARC Management if your domains are on Cloudflare DNS, you have a few senders that rarely change, and you’re comfortable working out the fixes and tightening the policy yourself. It costs nothing.
- Choose DMARC Dojo if your DNS is elsewhere, several services send as your domain (marketing, support, transactional), or you’ve been at
p=nonefor a while and want a guided, alerted path top=reject. - Use both if you like Cloudflare’s threat intelligence on sending IPs but want DMARC Dojo’s fixes and enforcement workflow.
See free DMARC monitoring options for other free tools, and how to move from p=none to p=reject.
Frequently asked questions
Is Cloudflare DMARC Management really free?
Yes. Cloudflare says it’s available for free to every Cloudflare customer. The catch is that your domain’s DNS has to be on Cloudflare, and it works on apex domains, not subdomains.
Does Cloudflare DMARC Management move my domain to p=reject?
No. It analyzes your records and reports and recommends fixes, but you change the policy yourself. DMARC Dojo also leaves the decision to you, but adds one-click quarantine once senders pass and a readiness review before p=reject.
Do I have to leave Cloudflare DNS to use DMARC Dojo?
No. Keep your DNS on Cloudflare and connect it to DMARC Dojo in one click. DMARC Dojo publishes its records in your Cloudflare zone for you.
Can I keep using Cloudflare DMARC Management after switching?
Yes. Leave Cloudflare’s report address in your DMARC record (DMARC Dojo keeps it when it imports your settings) and both services receive the same reports.
My DNS isn’t on Cloudflare. What’s the free option?
DMARC Dojo’s Free plan covers one domain with hosted records, alerts and report processing, wherever your DNS is. See free DMARC monitoring options for others.