No message tiers. No guessing. €19/month, unlimited reports.
Merula is priced by the domains you monitor and what they do — never by how much mail flows through them. DMARC and TLS-RPT aggregate reports are unlimited on every paid plan.
Every plan runs the same 26 domain posture checks. Team seats are bundled; we do not meter people, and we do not meter messages.
Plans
Evaluate Merula on one domain with the same checks the paid plans run.
- 1 domain
- All 26 checks
- Critical email alerts only
- 7-day history
- No aggregate-report parsing
Everything, for your whole domain portfolio — priced by what each domain does.
- First sending domain and 2 non-sending domains included · €8/month per additional sending domain
- Non-sending domains €2/month beyond the included 2 — full monitoring, with a spoofing alert if anyone starts sending in their name
- Unlimited DMARC + TLS-RPT aggregate reports
- Technical evidence export — print-ready (PDF), CSV and JSON
- Unlimited team members
- 24-month history
- Baselines, scheduled reports, webhooks, alert groups
Multi-tenant management for agencies and MSPs running domains on behalf of clients.
- Built for managing multiple client organisations
- From €4/domain, easing down automatically as you grow
- All Pro features on every managed domain
- A separate tenant per client · one consolidated invoice
- Unlimited reports across all clients
- “Managed by you” on every client dashboard
Plan comparison
| Feature | Free | Pro | MSP |
|---|---|---|---|
| Domains | 1 | Unlimited (per-domain pricing) | Unlimited (per-domain pricing) |
| 26 posture checks | ✓ | ✓ | ✓ |
| DMARC + TLS-RPT aggregate reports | — | Unlimited | Unlimited |
| Technical evidence report (print-ready, CSV, JSON) | — | ✓ | ✓ |
| Team members | 1 | Unlimited | Unlimited |
| Email alerts | Critical only | ✓ | ✓ |
| Webhook alerts (Slack, Teams, signed JSON) | — | ✓ | ✓ |
| History | 7 days | 24 months | 24 months |
| Scheduled + advanced reports | — | ✓ | ✓ |
| Baseline / change approval | — | ✓ | ✓ |
| Multiple alert recipient groups | — | ✓ | ✓ |
| Multi-tenant client management | — | — | ✓ |
| Billing | — | Monthly or annual | Monthly |
For MSPs and agencies
One subscription covers every client account you manage: per-domain pricing, one consolidated invoice, and the full product — unlimited reports included — on every managed domain.
- Partner pricing from €4/domain/month
- Automatic volume discount as your portfolio grows
- €80/month minimum
- All Pro features, unlimited reports, on every managed domain
- One consolidated invoice across all clients
Why unlimited?
Most DMARC services price by message volume, which forces you to buy a tier far above your needs and to predict a number you cannot control. We think that's the wrong thing to price: your mail volume says nothing about the work of watching a domain, so it shouldn't set the bill.
There is also a fairness problem with metering. A domain's report volume spikes hardest when someone is spoofing it — which is precisely when you need the visibility most. Billing a spoofing victim for being attacked punishes the customer at the moment the product is doing its job. So we don't: report volume is not billed by volume and never limited by plan-tier report caps.
Report volume is never billed by volume, capped by plan tier or surcharged. If a domain's report volume deviates sharply from its own baseline, Merula surfaces that as an insight — not as an automatic bill.
Questions
What is a non-sending domain?
A domain that sends no legitimate outbound email — a defensive or brand registration, a look-alike you hold to protect your name, or a receive-only domain (live inbox, nothing sent). It gets the full product, not a cheaper subset: every check, unlimited report parsing, and an alert if anyone ever starts sending in the domain's name. It is scored against the non-sending ideal, so a locked-down SPF and a reject policy read as healthy, not as a sender's misconfiguration. Your first 2 non-sending domains are included in Pro; beyond that they are €2/month each. The lower rate reflects expected volume, not fewer features. A non-sending domain may still run a website.
What happens if a non-sending domain starts sending?
If we see authenticated mail genuinely coming from the domain — never spoofed mail, which cannot be made to look authentic — we suggest switching it to a sending domain and leave the note with you, with no deadline pressure. Nothing changes by itself: monitoring continues, parsing continues, and billing only changes when you confirm. Declining is fine; we only ask again much later if the mail persists.
What does fair use mean if reports are unlimited?
Paid plans include DMARC and TLS-RPT aggregate-report parsing without message-volume billing or plan-tier report caps. If a domain's volume deviates sharply from its own baseline, Merula surfaces that as an insight; it does not create an automatic surcharge.
Are Merula's checks based on recognised standards?
Yes. Merula monitors controls based on widely adopted internet standards — SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE/TLSA, CAA, HSTS and the DNS and TLS specifications beneath them — rather than bespoke rules. Recognised guidance points the same way: the UK's National Cyber Security Centre highlights SPF, DKIM and DMARC for reducing domain spoofing, and each check is mapped to the relevant standards and framework references on our trust pages.
Will Merula help my email reach the inbox?
It helps. Large mailbox providers now expect senders to authenticate with SPF, DKIM and DMARC, which makes correct email authentication increasingly important for deliverability and trust, not only security. Merula watches those records continuously, explains in plain language what is weak or missing, and tells you when something changes — so a misconfiguration is far less likely to send your mail to spam unnoticed.
Will my price change when list prices change?
Not because list prices change — those only ever apply to new subscriptions. Your subscription references versioned price objects that we never edit, so a list-price change cannot quietly reach you. If we ever needed to change an existing subscription — a restructuring of the model rather than a list-price change — you would get clear advance notice and the freedom to cancel before it applied. Never a surprise on an invoice.
Is there a trial?
14 days of full Pro, including the technical evidence report. No card required; if you do nothing, the account simply returns to Free with your history intact.
How does annual billing work?
Pro can be billed annually at twelve months for the price of ten, including the per-domain items. MSP is billed monthly.
How does MSP pricing work?
Partner pricing starts from €4/domain/month with a €80/month minimum, and the per-domain rate slides down automatically as your portfolio grows. The full curve is shared with partners directly — explore the MSP plan to get started.
Notes
- Eligibility: Merula is offered to EU/EEA-based businesses for use in the course of business. See Terms §2 Eligibility for the full clause.
- VAT number: required at upgrade to a paid plan. Validated through VIES via Stripe Tax. Reverse-charge VAT applies where applicable. The Free plan does not require a VAT number.
- Multi-factor authentication: required for every member on paid plans, with a 14-day grace period after upgrade. Optional on Free.
- Currency: all prices are in EUR, exclusive of VAT. Stripe Tax applies the applicable rate at checkout based on your billing country.
- Domain changes: adding, removing or reclassifying a domain adjusts the subscription with proration from that day — no new contract, no waiting for renewal.
- Team seats: bundled with the plan. Paid plans include unlimited team members. We do not meter people.
- Hosting: Merula runs in AWS, Stockholm region. This supports EU data residency, but should not be confused with full data sovereignty. The distinction is explained on the compliance page.
- Billing entity: Adspace Nordic AB, VAT-registered in Sweden.