Authwright vs Palisade in 2026
Both platforms let an AI assistant work with email authentication. Authwright uses registrar credentials and documents ongoing DMARC ingestion and SPF monitoring. Palisade offers one-time provider-window deployment and optional persistent account connections, and turns report findings into proposed fixes and prioritized tickets.
Our verdict: Pick Palisade when your main task is DMARC investigation and remediation. Its one-time DNS deployment option lets you approve records in your provider’s window without leaving credentials with Palisade. Pick Authwright when you want certificates, renewals and domain purchases in the same MCP session, on one of its five supported registrars.
Samuel Chenard · CEO & Co-Founder, PalisadeSource checks through 2026-10-1415-day full-product trial. Nothing is charged until it ends.
ChatGPT
Claude
Gemini
Perplexity
Grok
Palisade
Provisional · 7/8 dimensions established
Average of established dimensions; may change as remaining dimensions are verified.
Full rubric · 8/8 dimensions established
Palisade's IT-team plans start at $19 a month, sized by email volume. Start with a 15-day full-product trial; nothing is charged until it ends.
Which one is right for you?
Best for Agencies with portfolios on five supported registrars
Best for MSPs and IT teams responsible for multiple domains
- Your domains sit on GoDaddy, Namecheap, Cloudflare, Porkbun or Route 53, the five registrars its adapters reach.
- You want one MCP session to also renew SSL certificates, buy defensive domains, and flip WHOIS privacy, which Palisade does not do.
- Storing registrar API credentials at a vendor is a trade your security review accepts.
- You want aggregate-report findings turned into prioritized tickets and provider-specific fixes for review.
- You would rather authorise a scoped, revocable connection in your own DNS provider's window than store registrar API keys at a vendor.
- Your domains are spread across providers: automatic configuration covers 64 of them.
- You need DMARC aggregate reports turned into prioritised tickets with provider-specific fix instructions, plus webhooks and ongoing monitoring.
IT-team plans start at $19 a month, sized by email volume. Start with a 15-day full-product trial; nothing is charged until it ends.
Where the day-to-day work actually differs
| Feature | Authwright | Palisade |
|---|---|---|
| DNS and credentials | ||
| Publishes approved records into your own DNS without holding your credentialsWhether approved DNS records can be published without storing registrar credentials.Authwright uses stored registrar credentials. Palisade offers one-time provider-window deployment that retains no credentials, alongside optional persistent account connections using encrypted tokens or an AWS role. Source (2026-08-20) | Stores registrar credentials | Provider-window authorization |
| Assistant can write the corrected records, not just recommend themWhether an assistant can publish corrected DNS records after approval.Both; Authwright writes at the registrar, Palisade through the connection you authorise | Registrar record writes | Approved zone writes |
| Automatic configuration across 64 DNS providersWhether automatic DNS configuration reaches providers across a domain portfolio.Authwright: five registrars (GoDaddy, Namecheap, Cloudflare, Porkbun, Route 53) Source (2026-08-20) | Five registrar adapters | Automatic provider configuration |
| Hosted records served on redundant managed DNS, so nothing is written at your registrar at allWhether email-authentication records can be hosted outside the registrar.Authwright hosts the MTA-STS policy file; other records are written into your zone Source (2026-08-20) | MTA-STS policy only | Redundant managed DNS |
| Ongoing operation | ||
| DMARC aggregate reports become prioritised tickets with provider-specific fix instructionsWhether DMARC reports become prioritised, provider-specific work items.Authwright documents report ingestion and assistant-readable findings. Prioritised tickets with provider-specific fix instructions are not established by the reviewed sources. Source (2026-08-20) | —Prioritised tickets not established | Provider-specific work tickets |
| DMARC aggregate report ingestionWhether a product receives DMARC aggregate reports for review.Both; Authwright includes it on every tier | Included on every tier | Agent analyzes reports |
| SPF flattening kept under the 10-lookup limitWhether SPF lookup chains are kept within DNS lookup limits.Both; Authwright bundles it on every tier, and Palisade serves a hosted flattened include whose live lookup budget the assistant can read through get_spf | Included on every tier | One-lookup hosted SPF |
| Webhook endpoints for your own systemsWhether a product can send event data to other systems through webhooks.Source (2026-08-20) | —Not advertised | Webhook endpoints |
| Native ConnectWise, HaloPSA and Autotask integrationsWhether a platform connects directly with the named PSA systems.Source (2026-08-20) | —Not advertised | Native PSA integrations |
| Connecting an assistant | ||
| Listed in the official MCP registryWhether a server can be discovered in the official MCP registry.The 20 August 2026 registry search returned zero Authwright results; the current registry capture was unavailable, so present listing status is unconfirmed. Source (2026-08-20) | —Current listing unconfirmed | Official registry listing |
| OAuth sign-in to connect an assistantWhether an assistant connects through an OAuth sign-in flow.Both; Authwright documents OAuth 2.1 with PKCE via Microsoft Entra ID, plus a portal-issued bridge token for editor clients Source (2026-08-20) Source 2 (2026-08-20) | OAuth with PKCE | OAuth sign-in |
| MCP access included on the entry tierWhether MCP access is available on the lowest-priced tier.The Free plan includes MCP server access for 1 domain and 1 registrar. Source (2026-10-13) | Free: 1 domain, 1 registrar | Included on every plan |
| Registrar portfolio work | ||
| SSL/TLS certificate lifecycle across a portfolioWhether SSL/TLS certificates can be managed across a domain portfolio.Authwright: 7 tools. Outside Palisade's scope | Seven certificate tools | Outside Palisade's scope |
| Domain purchasing, renewals and defensive registrationWhether a tool handles domain purchases, renewals, and defensive registrations.Authwright: 9 portfolio tools. Outside Palisade's scope | Nine portfolio tools | Outside Palisade's scope |
| WHOIS privacy and DNSSEC auditing at portfolio scaleWhether a portfolio tool manages WHOIS privacy and audits DNSSEC.Outside Palisade's scope | Supported | Outside Palisade's scope |
| Commercial terms | ||
| Published rates you can read before contacting anyoneWhether a buyer can see prices before requesting a quote.The homepage publishes Free, Pro, Team, Agency and Agency Plus rates and domain/registrar allowances. Enterprise uses a custom contract. Source (2026-10-13) | $0–$799 published; Enterprise custom | Published IT pricing |
| AI and automation access | ||
| Documented REST or GraphQL API for domain dataWhether customers can build against a published REST or GraphQL reference instead of using only the product's MCP tools.Authwright does not advertise a documented REST or GraphQL API on its public homepage or capabilities page. It describes its published programmatic interface as a Model Context Protocol server (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) | —No public API listed | REST API published |
| MCP server for connecting AI assistants to domain dataWhether an AI assistant can reach the product's domain-management tools directly.Both; Authwright publishes a 42-tool Model Context Protocol server over streamable HTTP with OAuth 2.1 and PKCE, for use from MCP-compatible clients (checked 2026-08-27). Source (2026-08-27) | MCP server published | MCP server published |
| AI assistant can run an email-authentication workflowWhether the vendor advertises an AI-driven workflow for email-authentication work and states what it does.Both; Authwright advertises its email_auth_wizard MCP tool as an LLM-driven workflow that reads the current state, diagnoses gaps, writes approved records, hosts MTA-STS, verifies propagation, and ingests DMARC reports (checked 2026-08-27). Source (2026-08-27) | LLM runs Email EasyPass | Agent drafts fixes |
| Portfolio data export without opening a dashboardWhether domain-portfolio data can leave the product through a published programmatic interface.Authwright lists export_portfolio in its MCP tool surface and describes a quarterly compliance audit export as a CSV. It does not advertise webhooks on that capabilities page (checked 2026-08-27). Source (2026-08-27) | MCP portfolio export | REST API published |
Want to compare the workflow yourself? Start a 15-day full-product trial of Palisade.
Palisade vs Authwright: score evidence and limitations
Both products are scored on the same eight dimensions the comparison hub uses, so the figures here are the figures there. Four are derived from vendor facts that each carry a source and a checked date. Four are editorial, marked as such below, and each states its reasoning and its source.
Each dimension is out of 10 and the total is the raw sum out of 80, rescaled to 100 — the raw figure is printed beside it so the conversion is checkable rather than a black box. Scored on what each vendor publishes, not on how the product feels in use. Unknown scoring dimensions are shown as Not established; provisional scores average only established dimensions and show coverage. They may change as remaining dimensions are verified. Current ranks include full and provisional scores; equal displayed scores share a rank. Historical assessments are separate. Editorial dimensions last reviewed 2026-10-15.
Provisional · 7/8 dimensions established
Average of established dimensions; may change as remaining dimensions are verified.
Full rubric · 8/8 dimensions established
How reachable the vendor's DMARC data is from your own software and AI tools. Two paths count, an API and an MCP server, and each only if it reaches DMARC data (domains, records, reports or sending sources). A path is open when it is documented and included from the cheapest paid plan; gated when it needs a higher tier, an add-on, a sales call or a request, or the vendor does not say which plans include it. 10 = both open. 9 = one open, one gated. 8 = both gated. 7 = one open, the other absent. 6 = one gated, the other absent. 5 = access claimed in marketing only, with no docs or plan listing. 4 = reachable only through a self-hosted tool's own interface or a host platform's API, such as parsedmarc's library or Splunk's REST API; a dashboard over a database you run yourself does not count. 3 = no API or MCP server reaches DMARC data.
The reviewed documentation does not establish both DMARC-data connection paths and their plan eligibility. Confirm API and MCP data scope and access terms before integrating. Source (2026-10-14)
Palisade publishes a REST API and a remote MCP server on every plan, making the same domain data and remediation workflows available to connected software. Source (2026-08-30)
How much of the report analysis is done for you. 10 = the platform turns raw report data into a prioritised, actionable queue on its own.
The published wizard reads the current authentication posture, diagnoses gaps, proposes and applies authorized record changes, and ingests aggregate reports for ongoing summaries. Source (2026-08-29)
Report data is analysed into a prioritised list of sender, SPF, DKIM and DMARC issues, so nobody reads raw XML. Source (2026-08-30)
How much of the work the vendor's own software does. 10 = it identifies the sending sources, drafts the SPF and DKIM fixes each one needs, and proposes the next policy step. 6 = it applies the records for you, but a person decides what to fix and when to advance. 3 = it reports, and every change is yours to make. A vendor whose team does the work rather than its software scores here on the software alone.
The vendor describes LLM-callable MCP workflows that compose diagnostics, DNS changeset previews, authorized writes, propagation checks, and portfolio-scale actions. Source (2026-08-29)
The agent investigates each sender, drafts the SPF and DKIM changes it needs, and proposes the next policy step; a human approves before deployment. Source (2026-08-30)
10 = full pricing published. 6 = some tiers published, rest quote-gated. 3 = quote only.
Free, Pro, Team, Agency, and Agency Plus prices are published; Enterprise is contact-sales. Source (2026-08-29)
Self-service IT-team prices are published by email volume from $19/month; MSP pricing is portfolio-based per client domain, and Enterprise pricing is custom. Source (2026-08-30)
10 = hosts the records for you. 6 = partial or add-on. 3 = you manage your own DNS.
Authwright publishes hosted MTA-STS policies and SPF flattening; its public material does not describe it hosting DMARC, DKIM, or BIMI records. Source (2026-08-29)
Yes: hosted DMARC, SPF, DKIM, BIMI & MTA-STS Source (2026-08-30)
10 = a genuine free plan. 6 = time-limited trial only. 3 = no free access.
The Free plan includes one domain, one registrar, public audits, MCP server access, and seven-day snapshots. Source (2026-08-29)
No free plan: a 15-day full-product trial; nothing is charged until the trial ends Source (2026-09-25)
10 = a real MSP program with multi-tenant management. 6 = partial. 3 = none.
Agency and Agency Plus plans provide multi-tenant workspaces for domain portfolios; published partner-program terms are not listed. Source (2026-08-29)
Yes: MSP-first, multi-tenant with native PSA integrations Source (2026-08-30)
How much work it takes to get a domain from p=none to p=reject. 10 = the platform (or the vendor's team) gets you there without manual DNS edits.
Email EasyPass diagnoses email-authentication gaps, proposes the corrected records, writes them after authorization, and verifies propagation across supported registrars. Source (2026-08-29)
The DMARC Agent detects when a domain's authentication and alignment are ready for the next policy stage and proposes the move, but a human still approves and applies it, so it is not fully hands-off. Source (2026-08-30)
Where Palisade and Authwright actually differ
Each argument keeps the product screens, sourced comparison points, and supporting analysis together.
Credential storage vs provider authorization
Who holds the keys to your DNS
This is the real decision between the two, and it is worth getting past the marketing on both sides. Authwright writes DNS records for you, and the way it reaches your zone is by holding your registrar's API credentials. Its onboarding is explicit about it: step three asks you to paste a GoDaddy API key and secret, or a Cloudflare API token, into the portal. Its FAQ says those credentials are encrypted at rest in Azure Key Vault, scoped per domain where the registrar API supports it, and never logged, and it recommends creating a dedicated API user for Authwright on each registrar.Source 1, Source 2
Authwright
A relevant product screenshot was not available in the reviewed evidence.
Palisade
A relevant product screenshot was not available in the reviewed evidence.
- Publishes approved records into your own DNS without holding your credentials: Provider-window authorization
- Assistant can write the corrected records, not just recommend them: Approved zone writes
- Automatic configuration across 64 DNS providers: Automatic provider configuration
That is a reasonable design, handled with more care than most, and it still means a vendor holds keys that can act on your registrar account. A registrar API key is rarely scoped to email authentication alone; on several registrars the same credential can move nameservers, edit unrelated records, or touch billing.
Palisade offers two DNS deployment methods. With one-time sign-in, the provider is detected from the domain’s nameservers and you approve the records in the provider’s own window; Palisade keeps no credentials afterward. Optional account connections let you connect Cloudflare or GoDaddy with an encrypted token, or Route 53 with an AWS role, for repeated and bulk publishing. Both methods require approval of the record diff. Palisade limits its writes to supported email records and related delegations, including mail-provider MX when you request setup.
Five registrars vs broader reach
Five registrars against a wider catalogue
Authwright publishes five registrar adapters: GoDaddy, Namecheap, Cloudflare, Porkbun and Route 53. Palisade’s one-time DNS deployment catalogue reaches 64 providers, while its optional account connections cover Cloudflare, GoDaddy and Route 53. Confirm that the selected connection method supports each domain in your portfolio.Source
Authwright
A relevant product screenshot was not available in the reviewed evidence.
- Published rates you can read before contacting anyone: $0–$799 published; Enterprise customSource
Palisade
A relevant product screenshot was not available in the reviewed evidence.
- Published rates you can read before contacting anyone: Published IT pricing
For a book of client domains, that gap decides how much of the book the tooling covers. Five adapters handle a portfolio consolidated at a big registrar. A mixed inheritance, which is what most agencies actually have, spreads past them.
Setup completion vs continuous operation
A setup run against an operating loop
Authwright's flagship is Email EasyPass, its email_auth_wizard tool. Its homepage sets out the sequence: read the current state, diagnose against the Gmail and Yahoo rules, write corrected records at the registrar, host the MTA-STS policy, wait for propagation, verify, then ingest DMARC reports on an ongoing basis and summarise them in plain language. The homepage transcript clocks the run at 47 seconds and moves a score from 32 to 94.Source
Authwright
A relevant product screenshot was not available in the reviewed evidence.
- DMARC aggregate reports become prioritised tickets with provider-specific fix instructions: Prioritised tickets not establishedSource
- DMARC aggregate report ingestion: Included on every tier
- SPF flattening kept under the 10-lookup limit: Included on every tier
Palisade
- DMARC aggregate reports become prioritised tickets with provider-specific fix instructions: Provider-specific work tickets
- DMARC aggregate report ingestion: Agent analyzes reports
- SPF flattening kept under the 10-lookup limit: One-lookup hosted SPF
Getting a domain to a good configuration quickly is genuinely useful, and that sequence does it. The part that decides whether a domain stays there is what happens over the following weeks, when a marketing team adds a sender nobody told you about, or an upstream provider changes its SPF include and the lookup count creeps back over ten.
Palisade is built around that second phase. Aggregate reports feed a work queue: the agent investigates each sending source, works out whether it is legitimate, drafts the fix, and files it as a prioritised ticket with instructions specific to the provider involved. Webhooks push those events into your own systems. The agent investigates every sender, drafts every fix, and proposes each policy step, and you approve before anything ships. The output is a task with an owner rather than a report to read.
Email focus vs portfolio breadth
Where Authwright is the better tool
Authwright is not really a DMARC product with extras. Of its 42 published tools, 8 are email authentication; the other 34 handle DNS records, domain portfolio lifecycle, SSL/TLS, bulk operations and health checks. Its registrar pages make the actual pitch plainly: renewals you keep forgetting, certificates expiring on inconvenient days, WHOIS privacy that flips off after a billing failure, defensive registrations that each cost a trip through a checkout flow.
Authwright
A relevant product screenshot was not available in the reviewed evidence.
- SSL/TLS certificate lifecycle across a portfolio: Seven certificate tools
- Domain purchasing, renewals and defensive registration: Nine portfolio tools
- WHOIS privacy and DNSSEC auditing at portfolio scale: Supported
Palisade
A relevant product screenshot was not available in the reviewed evidence.
- SSL/TLS certificate lifecycle across a portfolio: Outside Palisade's scope
- Domain purchasing, renewals and defensive registration: Outside Palisade's scope
- WHOIS privacy and DNSSEC auditing at portfolio scale: Outside Palisade's scope
If that is the job in front of you, Authwright covers ground Palisade does not and is not trying to. Palisade does not renew certificates, buy domains, manage WHOIS privacy, or audit DNSSEC. An agency whose real problem is a sprawling registrar portfolio should weigh that breadth seriously, and can run both: the two overlap only on the email-authentication tools.
The 20 August 2026 official MCP registry search returned no Authwright results; current listing status is unconfirmed because the latest registry capture was unavailable. Its /docs and /pricing URLs also returned 404 on that historical check. Confirm current documentation, pricing, and discovery before connecting.
What each side charges
Three points on each published range: the cheapest plan, one in the middle, and the top of what the vendor publishes. Every plan on both sides is in the pricing section further down.
- Free$0/mo
1 domain, 1 registrar, unlimited public audits, MCP server access, 7-day snapshots
- Team$99/mo
25 domains, 5 registrars, RBAC + SSO, up to 10 seats, 30-day snapshots
- EnterpriseContact sales
Minimum 500 domains, unlimited registrars, custom contract, VPC peering
- IT teams: up to 100,000 emails/mo$19/mo ($15/mo billed annually)
2 set-up domains (adding is unlimited), unlimited retention, every core feature
- IT teams: up to 1,000,000 emails/mo$99/mo ($79/mo billed annually)
Same product: 10 set-up domains, pick the tier that matches your sending
- Enterprise (more than 2.5M / month)Custom
Custom volume, retention, and terms
Dashboard access vs programmatic access
Authwright's 42-tool MCP surface, with no public REST or GraphQL API
Authwright advertises a Model Context Protocol server rather than a dashboard or a documented REST or GraphQL API. Its capabilities page lists 42 tools across email authentication, DNS, domain portfolios, SSL/TLS, bulk operations, and health diagnostics. That surface includes export_portfolio and a quarterly compliance audit export in CSV form. On its homepage, Authwright says an LLM can call email_auth_wizard to read the current state, diagnose gaps, write approved records, host MTA-STS, verify propagation, and ingest DMARC reports. The public pages cited do not advertise a REST or GraphQL reference (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27)
Authwright
A relevant product screenshot was not available in the reviewed evidence.
Palisade
- Documented REST or GraphQL API for domain data: REST API published
- MCP server for connecting AI assistants to domain data: MCP server published
- AI assistant can run an email-authentication workflow: Agent drafts fixes
Palisade publishes an MCP server at /mcp. Its agent investigates senders, drafts SPF and DKIM fixes, and proposes each policy step. A human approves before anything ships.
Reachable from your own AI tools
Palisade's MCP server exposes 42 tools over OAuth, so the assistant your team already uses can read domains, pull the exact records to publish and work the task queue. These are the clients the connection guide walks through.
- ChatGPT
- Claude
- Codex
- Cursor
- Windsurf
- Any MCP client
Still deciding between Authwright and Palisade? See what changes with Palisade.
15-day full-product trial. Nothing is charged until it ends.
Microsoft 365
Zoho Mail
The agent does the heavy lifting
Sources identified, SPF and DKIM fixes drafted, each policy step proposed. You approve; nothing ships on its own.
Connect your AI with MCP
42 tools over MCP, so your assistant reads your domains and works the queue.
Connect your DNS manager directly
One-time sign-in supports 64 providers without retaining credentials. Optional account connections support Cloudflare, GoDaddy and Route 53. You approve every change.
“We evaluated many DMARC providers before choosing Palisade. The quality of their product, the responsiveness and friendliness of their team and their rapid progress on their product roadmap made it a no-brainer for us to move forward.”
Authwright pricing explained (and how Palisade compares)
Authwright publishes per-agency monthly plans: Free $0, Pro $29, Team $99, Agency $299 and Agency Plus $799. Enterprise uses a custom contract. Domain and registrar allowances are listed alongside each rate, and all tiers include MTA-STS hosting, SPF flattening and DMARC report ingestion.
What you'd actually pay
The same five buyer sizes on every comparison, so a shape carries from one page to the next.
1 domain, up to 1,000 emails a month
Free: 1 domain and 1 registrar; no email-volume limit is published
2 set-up domains, up to 100K emails a month
Pro: 5 domains and 1 registrar; no 2-domain tier or email-volume limit is published
10 set-up domains, up to 1M emails a month
Team: 25 domains and 5 registrars; no 10-domain tier or email-volume limit is published
20 set-up domains, up to 2.5M emails a month
Team: 25 domains and 5 registrars; no 20-domain tier or email-volume limit is published
Client domains under management, any volume
Agency: 100 domains, 15 registrars, and multi-tenant workspaces; no email-volume limit is published
Palisade’s figures are derived from its published tiers. Authwright pricing or licensing source reference: vendor source citation date 2026-10-13. Plans and prices may have changed since.
How Authwright prices
- Prices are per agency, not per seat.
- Every tier includes MTA-STS hosting, SPF flattening, DMARC aggregate-report ingestion, and multi-registrar support.
- White-label is on the roadmap for Agency Plus and Enterprise.
- Plans are sized by domains and registrars; no email-volume allowance is published.
How Palisade prices
- Published rates for IT teams, metered on monthly email volume, with 2 to 20 set-up domains by tier and free unlimited domain adding.
- MSPs pay per client domain, with a rate that improves as the portfolio grows and a minimum of 5 client domains. Your own MSP domain is included as a free Not-For-Resale license.
- A 15-day full-product trial. Nothing is charged until the trial ends.
- API access and MCP access on every plan.
Authwright source reference: primary reference citation date 2026-10-13.Palisade source reference: the public pricing page citation date 2026-08-30.Plans and prices may have changed since.
Start a 15-day full-product trial of Palisade. Nothing is charged until it ends.
What each one covers, and where it stops
Published facts only, read from each vendor's own material. Neither column describes a hands-on trial, because we have not run one.
Authwright is an MCP-based domain-portfolio platform for agencies on its five supported registrars: GoDaddy, Namecheap, Cloudflare, Porkbun and Route 53. Its 42 published tools span email authentication, DNS, certificates, domain lifecycle, bulk operations and health checks, so it suits teams that want registrar work and email-authentication setup from one assistant session.
Email EasyPass reads a domain’s state, diagnoses gaps, writes authorized registrar records, hosts MTA-STS and verifies propagation. Authwright also documents ongoing DMARC report ingestion and SPF monitoring. Its published per-agency plans are Free $0, Pro $29, Team $99, Agency $299 and Agency Plus $799 per month; Enterprise is custom.
Palisade is built around an agent that does the DMARC work rather than reporting on it. It identifies every sending source, drafts the SPF and DKIM changes each one needs, and proposes the next policy step when the evidence supports it.
The agent investigates every sender, drafts every fix, and proposes each policy step, you approve before anything ships.
- Provides registrar record writes for approved DNS changes
- Includes DMARC aggregate report ingestion and SPF flattening on every tier
- Provides OAuth with PKCE and MCP access in its Free plan for one domain and one registrar
- Provides certificate lifecycle, domain portfolio, WHOIS privacy and DNSSEC tools
- The agent investigates senders and drafts the fix, so the work arrives prepared rather than as a list of findings
- Hosted SPF, DKIM and DMARC records, so an approved change can be carried out rather than handed off
- Portfolio workflow for MSPs, with ConnectWise, HaloPSA and Autotask integrations and a free NFR domain
- An MCP server and a REST API, so the same data and workflow are reachable from the AI tools a team already uses
- Does not advertise webhook endpoints
- Does not advertise native ConnectWise, HaloPSA or Autotask integrations
- Does not advertise a documented REST or GraphQL API
- Every policy change waits for a human approval, by design: nothing ships on the agent's own authority
- MSP pricing is portfolio-based per client domain, with a minimum of 5 client domains
- Plans are sized by monthly email volume, so a low-domain, high-volume sender lands on a higher tier than domain count alone suggests
- Starts at
- $0/month
- Free scope
- 1 domain / 1 registrar
- Paid entry
- $29/month for 5 domains / 1 registrar
- Agency
- $299/month for 100 domains / 15 registrars
- Enterprise
- Custom contract for At least 500 domains
- Starts at
- IT plans from $19/mo by email volume; 15-day trial
- Trial
- 15 days, full product
- MSP model
- Portfolio-based per client domain; minimum of 5 client domains
What Palisade customers say
5.0 out of 5 on G2Trusted by over 10,000 domains
“Palisade made it so easy for us to get our blue verified checkmark and achieve our BIMI compliance”
Sources and further reading
Source checks run through 2026-10-14; every entry keeps its individual check date.
- Authwright product, pricing, and FAQ
Checked 2026-10-14
- Authwright capabilities: 42 tools, six categories, transport
Checked 2026-10-14
- Authwright security: credential boundary and access control
Checked 2026-08-20
- Authwright free domain check
Checked 2026-08-20
- Official MCP registry search for authwright (zero results)
Checked 2026-08-20
- Authwright MCP capabilities
Checked 2026-10-14
- Authwright Data Processing Addendum
Checked 2026-08-29
- Authwright subprocessor list
Checked 2026-08-29
- Source
Checked 2026-08-30
Palisade vs Authwright: FAQ
What is the main difference between Authwright and Palisade?
The DNS connection method and report workflow are the main comparison points. Authwright stores registrar credentials and documents ongoing report ingestion and SPF monitoring. Palisade offers one-time provider-window sign-in as well as optional persistent account connections, and prepares prioritized tickets and provider-specific fixes for review. Confirm the credentials, permissions and approval checkpoints for the method you intend to use.
Does Authwright have OAuth?
Authwright’s capabilities page documents Streamable HTTP MCP behind OAuth 2.1 with PKCE via Microsoft Entra ID, and its portal issues a workspace-scoped bridge token. Its security page still describes those MCP tokens as planned, so confirm the current setup and revocation process. Registrar access is a separate credential boundary. Palisade’s MCP connection cannot publish DNS; approved DNS writes happen in the app through one-time sign-in or an account connection. Source (2026-08-27) Source 2 (2026-08-20)
Which registrars and DNS providers does each one support?
Authwright's adapters reach five registrars: GoDaddy, Namecheap, Cloudflare, Porkbun and Route 53, checked 20 August 2026. Palisade's automatic configuration reaches 64 DNS providers. Where a provider is not covered, Palisade returns the exact records for you to publish yourself. Palisade also offers hosted authentication records.
What does Authwright do that Palisade does not?
Certificate lifecycle, domain purchasing and defensive registration, WHOIS privacy management, and DNSSEC auditing across a portfolio. Those account for most of its 42 tools and sit outside what Palisade does. If managing a registrar portfolio is the job, that is a real advantage, and the two overlap only on email authentication, so running both is workable.
Is Authwright in the official MCP registry?
The 20 August 2026 registry search returned zero results for Authwright; the current registry capture was unavailable, so its present listing status is unconfirmed. Check the official registry before relying on server discovery.
What does Authwright cost?
Authwright publishes Free $0, Pro $29, Team $99, Agency $299 and Agency Plus $799 per month, with Enterprise custom. Plans are sized by domains and registrars. Every tier includes MTA-STS hosting, SPF flattening and DMARC report ingestion. Palisade publishes IT-team prices by monthly email volume and uses portfolio-based MSP pricing.
Can I try either one without paying?
Authwright's free workspace covers one domain and one registrar, and it runs an ungated domain audit at /check with no login or email gate. Palisade offers a 15-day full-product trial requiring a card at checkout; nothing is charged until the trial ends.
How do I switch from Authwright to Palisade?
Keep both reporting destinations configured during the overlap, verify any required external-report authorization, and confirm reports arrive in both platforms before retiring the previous service. Review hosted-record dependencies before changing DNS.
Switching from Authwright takes three steps
- 1
Connect your DNS provider instead of handing over keys
Choose a Palisade DNS connection method and review its permissions. One-time sign-in retains no credentials; optional account connections use a provider token or AWS role. Revoke the Authwright credentials after your team verifies the replacement workflow.
- 2
Run both platforms in parallel
Keep both reporting destinations configured during the overlap, verify any required external-report authorization, and confirm reports arrive in both platforms before retiring the previous service. Review hosted-record dependencies before changing DNS.
- 3
Move hosted records on your schedule
Repoint the MTA-STS policy host and the rua address to Palisade's hosted infrastructure, then retire the old setup when you are satisfied.
15-day full-product trial. Nothing is charged until it ends.
Source citations on this page run through 2026-10-14; individual claims retain their dates and evidence limitations. Spotted something out of date? Tell us and we'll fix it.