ELK DMARC alternative
ELK DMARC vs Palisade in 2026
ELK DMARC is a public GitHub project that unpacks DMARC aggregate reports, parses them with a Go program, and puts the results into an Elasticsearch and Kibana stack you run yourself. Palisade is a hosted, agentic workflow that investigates senders, drafts authentication fixes, and proposes each policy step for your approval.
Our verdict: Choose ELK DMARC if your requirement is a self-hosted Elasticsearch and Kibana dashboard for DMARC report data and your team is prepared to operate the Docker stack, parser, storage, and follow-up work. Choose Palisade if you want an AI agent to investigate senders, draft SPF and DKIM fixes, and carry domains toward p=reject with your approval at every step.
Samuel Chenard · CEO & Co-Founder, PalisadeSource checks through 2026-08-261 domain free up to 1,000 emails/month
ChatGPT
Claude
Gemini
Perplexity
Grok
Palisade
Palisade is free for one domain, up to 1,000 emails a month. Paid IT-team plans are sized by email volume. Start a 15-day full-product trial with no credit card.
Which one is right for you?
Best for Teams prepared to operate a self-hosted deployment
Best for MSPs and IT teams responsible for multiple domains
- You want to keep the report files, Elasticsearch data, and Kibana dashboard inside infrastructure your team operates.
- You have an engineer comfortable with Docker Compose, Elasticsearch, Kibana, Go, local volumes, credentials, and the maintenance work around a self-hosted deployment.
- Your immediate goal is to parse DMARC aggregate XML and inspect the resulting dashboard, with DNS remediation handled in a separate process.
- You want an AI agent to investigate every sender, draft SPF and DKIM fixes, and propose policy steps toward p=reject instead of assembling the remediation workflow around a dashboard.
- You want hosted SPF, DKIM, DMARC, BIMI, and MTA-STS records on redundant managed DNS, with each change reviewed before it ships.
- You manage internal or client domains and want a hosted operating model with native ConnectWise, HaloPSA, or Autotask integrations.
Free for one domain, up to 1,000 emails a month. Paid IT-team plans are sized by email volume. Start a 15-day full-product trial with no credit card.
Where the day-to-day work actually differs
| Feature | ELK DMARC | Palisade |
|---|---|---|
| Reporting and visualization | ||
| DMARC aggregate report ingestion from ZIP and GZ archivesWhether compressed DMARC aggregate report archives can be unpacked for processing.The README directs operators to place zipped DMARC aggregation reports in a project folder, and the start script unpacks .gz and .zip files before processing them (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Unpacks ZIP and GZ | Agent analyzes reports |
| DMARC XML parsing and flattened JSON outputWhether DMARC XML reports are converted into structured data records.The Go parser finds XML files, unmarshals DMARC reports, flattens report entries, and writes each entry as a JSON file in the output directory (checked 2026-08-26). Source (2026-08-26) | Flattens XML to JSON | Not offered |
| Kibana dashboard for the parsed DMARC dataWhether parsed report data is available in a dashboard for inspection.The README sends operators to Kibana's Dashboards area to see the DMARC Dashboard; the Compose file exposes Kibana on a configurable host port (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Kibana dashboard | Not offered |
| Elasticsearch-backed report storageWhether report data is stored in an Elasticsearch data store.The Compose file includes an Elasticsearch service with a persistent local data volume, and the README identifies Elasticsearch as the data store underneath the tool (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Persistent Elasticsearch volume | Not offered |
| Deployment and operations | ||
| Docker Compose deployment for Elasticsearch, Kibana, and the parserWhether the reporting components can be deployed together from a Compose configuration.The repository supplies a Docker Compose file for setup, Elasticsearch, Kibana, and parser services, plus a parser Dockerfile based on the Go image (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Docker Compose services | Hosted service |
| Operator-controlled report files, storage volumes, and service credentialsWhether operators control report inputs, persistent storage, and service credentials.The setup instructions have the operator create environment files, provide report archives in local directories, and use Docker volumes for certificates, Elasticsearch data, and Kibana data (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Operator-managed local volumes | Hosted service |
| Enforcement workflow | ||
| AI agent that investigates senders, drafts authentication fixes, and proposes policy steps toward p=rejectWhether an agent investigates senders, drafts fixes, and proposes policy steps for approval.The public project materials describe report unpacking, parsing, JSON output, Elasticsearch, and Kibana dashboards; they do not advertise an AI enforcement agent or a sender-remediation workflow (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Not advertised | Agent drafts and proposes |
| Hosted records and DNS | ||
| Hosted DMARC, SPF, DKIM, BIMI, and MTA-STS recordsWhether the named email-authentication records are hosted as a service.The repository documents a self-hosted report-processing and dashboard stack and does not advertise hosted authentication records or a managed DNS service (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Not advertised | Hosted on managed DNS |
| SPF flattening and lookup-limit managementWhether SPF DNS lookups are reduced and kept within the lookup limit.The README and repository deployment files do not advertise SPF flattening or SPF lookup-limit management (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Not advertised | Hosted SPF flattening |
| MSP operations | ||
| Native ConnectWise, HaloPSA, and Autotask integrationsWhether the platform connects directly to the named PSA tools.The public repository documents Docker, Elasticsearch, Kibana, local report directories, and parser scripts but does not advertise ConnectWise, HaloPSA, or Autotask integrations (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Not advertised | Native PSA integrations |
| Managed multi-tenant client workspaces and white-label reportingWhether MSPs can separate client workspaces and brand client reports.The project describes a self-hosted ELK deployment and does not advertise managed client workspaces, tenant separation, or white-label reporting (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Not advertised | Workspaces and white-label reports |
| Commercial service model | ||
| Published subscription plans, hosted trial, vendor support plan, or SLAWhether a vendor publishes commercial plans, evaluation terms, support, or service commitments.The public repository has no published pricing page, subscription plan, trial, commercial support plan, or SLA; its About panel provides no separate website or product link (checked 2026-08-26). Source (2026-08-26) | No commercial plan published | Published plans and trial |
| AI and automation access | ||
| Documented ELK DMARC API for programmatic accessWhether a customer can build against a documented REST or GraphQL API.ELK DMARC does not advertise a customer REST or GraphQL API reference in its public README or repository. Its sample environment exposes Elasticsearch's HTTP API for the self-hosted stack, but that is not documented as an ELK DMARC integration API (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) | No product API listed | REST API published |
| MCP server for connecting AI assistants to domain dataWhether an AI assistant can reach the product's data directly.ELK DMARC does not advertise an MCP server or an AI-assistant integration in its public README or repository (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) | No MCP server listed | MCP server published |
| Advertised AI assistance for investigating and drafting fixesWhether the vendor advertises AI that investigates senders or prepares authentication changes.ELK DMARC does not advertise an AI or machine-learning feature in its public README or repository. Those materials describe Docker deployment, report files, parsing, Elasticsearch, and a Kibana dashboard (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) | No AI features listed | Agent drafts fixes |
| Report output outside the dashboardWhether report information can leave the product without using the web interface.ELK DMARC's Go parser writes each flattened DMARC report entry to a JSON file in its ./output directory before ELK loading. Its public project materials do not advertise scheduled customer exports, webhooks, or a hosted data-feed endpoint (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) | Local JSON file output | REST API published |
Want to compare the workflow yourself? Try Palisade free with one domain and up to 1,000 emails a month.
Palisade 96 vs ELK DMARC 44, and why
Both products are scored on the same eight dimensions the comparison hub uses, so the figures here are the figures there. Four are derived from vendor facts that each carry a source and a checked date. Four are editorial, marked as such below, and each states its reasoning and its source.
Each dimension is out of 10 and the total is the raw sum out of 80, rescaled to 100 — the raw figure is printed beside it so the conversion is checkable rather than a black box. Scored on what each vendor publishes, not on how the product feels in use. Editorial dimensions last reviewed 2026-08-30.
How reachable the product is from your own software and AI tools. 10 = a documented API on every plan plus a published MCP server. 6 = an API, gated to a tier or to a sales conversation. 3 = no programmatic access advertised.
The repository publishes no ELK DMARC integration API or MCP server (checked 2026-08-28). Source (2026-08-28)
Palisade publishes a REST API and a remote MCP server on every plan, making the same domain data and remediation workflows available to connected software. Source (2026-08-30)
How much of the report analysis is done for you. 10 = the platform turns raw report data into a prioritised, actionable queue on its own.
It automates file transformation into Elasticsearch and Kibana, but report placement and loader execution are manual. Source (2026-08-28)
Report data is analysed into a prioritised list of sender, SPF, DKIM and DMARC issues, so nobody reads raw XML. Source (2026-07-29)
How much of the work the vendor's own software does. 10 = it identifies the sending sources, drafts the SPF and DKIM fixes each one needs, and proposes the next policy step. 6 = it applies the records for you, but a person decides what to fix and when to advance. 3 = it reports, and every change is yours to make. A vendor whose team does the work rather than its software scores here on the software alone.
The software loads aggregate report data into Kibana and leaves operators to investigate senders and make authentication record and policy changes. Source (2026-08-28)
The agent investigates each sender, drafts the SPF and DKIM changes it needs, and proposes the next policy step; a human approves before deployment. Source (2026-08-30)
10 = full pricing published. 6 = some tiers published, rest quote-gated. 3 = quote only.
The repository is publicly available and publishes no commercial plan or vendor subscription. Source (2026-08-28)
Published: free plan, then flat monthly plans by email volume from $19/mo Source (2026-08-30)
10 = hosts the records for you. 6 = partial or add-on. 3 = you manage your own DNS.
The project imports reports and does not host authentication records. Source (2026-08-28)
10 = a genuine free plan. 6 = time-limited trial only. 3 = no free access.
The self-hosted repository is publicly available without a vendor subscription. Source (2026-08-28)
Free plan: one domain, up to 1,000 emails/mo, 14-day report history, no credit card, plus a 15-day full-product trial Source (2026-08-30)
10 = a real MSP program with multi-tenant management. 6 = partial. 3 = none.
No MSP programme or hosted multi-tenant service is published for the project. Source (2026-08-28)
How much work it takes to get a domain from p=none to p=reject. 10 = the platform (or the vendor's team) gets you there without manual DNS edits.
The repository is a reporting stack and does not publish any record management, policy guidance, simulation, or enforcement work. Source (2026-08-28)
The DMARC Agent detects when a domain's authentication and alignment are ready for the next policy stage and proposes the move, but a human still approves and applies it, so it is not fully hands-off. Source (2026-07-29)
Self-hosted data vs hosted reporting
ELK DMARC's zip-to-Kibana pipeline, not a hosted reporting account
ELK DMARC starts with files on the operator's filesystem. Its README tells you to place zipped DMARC aggregation reports in the parser's input directory, and the start script unpacks .gz and .zip archives before moving the XML files into an ingest directory. The Go program then finds those XML files, unmarshals the DMARC reports, flattens their entries, and writes JSON files for the next stage of the pipeline. That is a concrete, inspectable path from receiver report archive to structured data. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
The dashboard layer is the other half of the project. Docker Compose starts Elasticsearch and Kibana with local volumes, while the README tells the operator to open Kibana's Dashboards area to view the DMARC Dashboard. This is genuine parity on report visualization: a technical team can see sender and policy evidence in a search-and-dashboard stack it controls. It is also a different operating model from signing up for a hosted account and adding domains to a managed workspace. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
- Unpacks ZIP and GZ
- Flattens XML to JSON
- Kibana dashboard
- Agent analyzes reports
- Not offered
- Not offered
Infrastructure control vs operating responsibility
What the README's 8GB Elasticsearch requirement means for ownership
The README says the maintainer's experience points to a minimum of 8GB of memory, because Elasticsearch is a powerful search-engine database underneath the system. The sample environment also exposes memory variables for Elasticsearch, Kibana, and Logstash, while Docker Compose persists certificates, Elasticsearch data, and Kibana data in local volumes. Those details make the trade visible: ELK DMARC gives the operator control over where the stack runs, but the operator also owns capacity planning, disk growth, credentials, backups, and access to the dashboard. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
The repository's configuration is useful for a proof of concept or an engineering-led internal deployment. The parser Dockerfile provides a Go runtime and the project includes scripts for starting the ELK pieces and loading the generated data. The public materials do not advertise a hosted retention policy, uptime commitment, support queue, or upgrade service, so a team evaluating the project should budget for the runbook around the code as well as the machine that runs it. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) Source 4 (2026-08-26)
- Docker Compose services
- Operator-managed local volumes
- Hosted service
- Hosted service
Report parsing vs enforcement workflow
The parser gets reports into ELK; your team owns enforcement
ELK DMARC's documented boundary is report processing. The source code turns incoming DMARC XML into flattened JSON, and the repository's shell scripts hand that output to the ELK side of the stack. The README does not describe a sender owner queue, authentication-fix generator, DNS connector, or policy-readiness workflow. That is not a claim that an engineer could never extend the project; it is the limit of what the public project describes and packages for an operator today. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
Palisade takes responsibility for the work after the finding. Its agent investigates every sender, drafts every fix, and proposes each policy step; your team approves before anything ships. It can configure the SPF and DKIM work, identify when a domain is ready for a stricter DMARC policy, and keep the approval checkpoint explicit. With ELK DMARC, the dashboard is the starting point for the operator's remediation runbook. With Palisade, the investigation and configuration workflow is the product around the report data. Source (2026-08-26)
- Not advertised
- Agent drafts and proposes
- Investigates. Works out what is sending as your domain, and which of it is legitimate.
- Drafts the fix. Prepares the SPF and DKIM record changes each sender needs, rather than describing them.
- Proposes the policy step. Moves toward p=reject when the evidence supports it. You approve before anything ships.
Operator control vs MSP workflow
A Kibana dashboard you operate, not an MSP control plane
ELK DMARC fits an organization that wants to own a report stack and already has someone who can operate it. The repository uses a project directory, local report archives, environment files, Docker services, and a Kibana endpoint. That makes the deployment understandable to an infrastructure team and leaves room for that team to decide how to secure, retain, export, or extend the data. The narrow fit is clear: control of the components matters more than having a packaged client-service workflow. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
An MSP needs a different kind of repeatability. Each client domain needs an intake path, a clear ownership record, report access, ticket handoff, DNS remediation, and a way to present progress back to the client. ELK DMARC does not advertise managed multi-tenancy, white-label reporting, PSA integrations, or partner pricing in the repository. Palisade's hosted model is designed around that operating shape, with multi-tenant client management and native ConnectWise, HaloPSA, and Autotask integrations alongside the agent-led enforcement workflow. Source (2026-08-26) Source 2 (2026-08-26)
Native PSA integrations
Palisade imports client domains straight from these three. ELK DMARC's own coverage is stated above, from their site.
- ConnectWise PSA
- Autotask
- HaloPSA
- Not advertised
- Not advertised
- Native PSA integrations
- Workspaces and white-label reports
Dashboard access vs programmatic access
ELK DMARC writes local JSON files, but no product API or MCP server is listed
ELK DMARC's public README is an installation and dashboard guide. It tells operators to start the Docker stack, browse to Kibana, place compressed reports in the parser directory, and run the parser. That parser writes each flattened DMARC report entry as a JSON file in its output directory. The sample environment exposes Elasticsearch's HTTP API for the self-hosted stack, while included scripts call Elasticsearch and Kibana endpoints to load it. Those are deployment paths, not a documented ELK DMARC REST or GraphQL reference for customer integrations. The published README and repository do not advertise an MCP server, AI-assistant integration, AI or machine-learning feature, scheduled customer export, webhook, or hosted data-feed endpoint (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) Source 4 (2026-08-27) Source 5 (2026-08-27)
Palisade publishes an MCP server and a REST API. Its agent investigates senders, drafts SPF and DKIM fixes, and proposes each policy step. A human approves before anything ships.
Reachable from your own AI tools
Palisade's MCP server exposes 30 tools over OAuth, so the assistant your team already uses can read domains, pull the exact records to publish and work the task queue. These are the clients the connection guide walks through.
- Claude
- ChatGPT
- Cursor
- Windsurf
- Any MCP client
- No product API listed
- No MCP server listed
- No AI features listed
- REST API published
- MCP server published
- Agent drafts fixes
Still deciding between ELK DMARC and Palisade? See what changes with Palisade.
1 domain free up to 1,000 emails/month
Microsoft 365
Zoho Mail
The agent does the heavy lifting
Sources identified, SPF and DKIM fixes drafted, each policy step proposed. You approve; nothing ships on its own.
Connect your AI with MCP
30 tools over MCP, so your assistant reads your domains and works the queue.
Connect your DNS manager directly
Approved records go into your own zone at your own provider, across 64. No credentials reach us.
“We evaluated many DMARC providers before choosing Palisade. The quality of their product, the responsiveness and friendliness of their team and their rapid progress on their product roadmap made it a no-brainer for us to move forward.”
ELK DMARC pricing: a self-hosted GitHub project, not a published SaaS rate card
ELK DMARC does not publish a commercial pricing page or hosted subscription tier in its public project presence. The repository gives you Docker Compose files, an Elasticsearch and Kibana stack, and a Go parser. The cost question is therefore the infrastructure and operator time required to run that stack, not a monthly plan that the project publishes.
What you'd actually pay
The same five buyer sizes on every comparison, so a shape carries from one page to the next.
1 domain, up to 1,000 emails a month
2 set-up domains, up to 100K emails a month
10 set-up domains, up to 1M emails a month
20 set-up domains, up to 2.5M emails a month
Client domains under management, any volume
Palisade’s figures are derived from its published tiers. ELK DMARC figures read from their pricing page on 2026-08-28. Plans and prices may have changed since.
How ELK DMARC prices
- The repository does not publish a hosted tier, domain allowance, email-volume quota, trial, paid support package, or SLA (checked 2026-08-26).
- The README reports a minimum of 8GB of memory from the maintainer's experience because the stack uses Elasticsearch. That is a deployment recommendation, not a vendor-hosted service limit (checked 2026-08-26).
- The sample environment pins Elastic products to version 8.11.3, exposes Elasticsearch and Kibana ports, and offers a basic or trial license setting. These are local deployment settings, not a published ELK DMARC commercial plan (checked 2026-08-26).
- No separate product, pricing, documentation, integrations, or support site is linked from the repository's public About panel. The README and project files are the available first-party source set checked here (checked 2026-08-26).
How Palisade prices
- Palisade publishes a Free plan for one domain and up to 1,000 emails/month, plus flat monthly IT-team plans sized by email volume from $19/month with 20% off on annual billing.
- Paid IT tiers cap set-up domains at 2, 3, 6, 10, or 20 by volume tier; adding domains remains free and unlimited. MSP pricing is quoted per client domain, with no client email metering and a free NFR domain for the provider.
- Palisade is hosted and includes unlimited report retention on paid plans, API access on every plan, and a 15-day full-product trial with no credit card. ELK DMARC leaves storage, retention, access, and maintenance to the operator running the stack.
- Palisade's agent investigates senders, drafts SPF and DKIM fixes, and proposes policy steps toward p=reject for approval. The ELK DMARC repository documents the report pipeline and dashboard, not that enforcement workflow.
ELK DMARC pricing read from their public pricing page on 2026-08-26.Plans and prices may have changed since.
Try Palisade free on one domain, or start a 15-day full-product trial with no credit card.
What each one covers, and where it stops
Published facts only, read from each vendor's own material. Neither column describes a hands-on trial, because we have not run one.
ELK DMARC is a public GitHub project for technical teams that want to run their own DMARC reporting stack. It unpacks compressed aggregate reports, converts DMARC XML into JSON, and loads the data into Elasticsearch and Kibana. The project suits teams comfortable operating Docker Compose, local storage, credentials, and the related maintenance.
ELK DMARC keeps report archives, Elasticsearch data, Kibana data, and service configuration inside infrastructure operated by the team using it. Its public repository provides source files and deployment configuration, rather than a hosted subscription tier or published service plan. The operator supplies the capacity, storage, report-delivery path, backups, security, and support.
Palisade is built around an agent that does the DMARC work rather than reporting on it. It identifies every sending source, drafts the SPF and DKIM changes each one needs, and proposes the next policy step when the evidence supports it.
The agent investigates every sender, drafts every fix, and proposes each policy step, you approve before anything ships.
- Unpacks ZIP and GZ DMARC aggregate-report archives before processing
- Flattens DMARC XML reports into local JSON files
- Provides a Kibana dashboard for parsed DMARC data
- Runs Elasticsearch, Kibana, and the parser through Docker Compose services
- Stores report data in a persistent Elasticsearch volume
- The agent investigates senders and drafts the fix, so the work arrives prepared rather than as a list of findings
- Hosted SPF, DKIM and DMARC on redundant managed DNS, so an approved change can be carried out rather than handed off
- Portfolio workflow for MSPs, with ConnectWise, HaloPSA and Autotask integrations and a free NFR domain
- An MCP server and a REST API, so the same data and workflow are reachable from the AI tools a team already uses
- Does not advertise an AI agent for sender investigation, authentication fixes, or policy steps
- Does not advertise hosted DMARC, SPF, DKIM, BIMI, or MTA-STS records
- Does not advertise SPF flattening or lookup-limit management
- Does not advertise ConnectWise, HaloPSA, or Autotask integrations
- Does not publish a commercial subscription plan, hosted trial, support plan, or SLA
- Every policy change waits for a human approval, by design: nothing ships on the agent's own authority
- MSP pricing is quoted per client domain rather than published as a rate card
- Plans are sized by monthly email volume, so a low-domain, high-volume sender lands on a higher tier than domain count alone suggests
- Starts at
- No subscription price published
- Memory guidance
- 8GB minimum
- Hosted tier
- Not published
- MSP model
- Not published at 25 domains
- Starts at
- Free, then $19/mo
- Free tier
- 1 domain, up to 1,000 emails/month
- Trial
- 15 days, full product, no credit card
- MSP model
- Quoted per client domain, portfolio-based
“Palisade made it so easy for us to get our blue verified checkmark and achieve our BIMI compliance”
Sources and further reading
Source checks run through 2026-08-26; every entry keeps its individual check date.
- ELK DMARC public GitHub repository and About panel
Checked 2026-08-26
- ELK DMARC README: installation, report ingestion, and dashboard
Checked 2026-08-26
- ELK DMARC Docker Compose deployment
Checked 2026-08-26
- ELK DMARC Go parser
Checked 2026-08-26
- ELK DMARC report-unpacking start script
Checked 2026-08-26
- ELK DMARC parser Dockerfile and runtime
Checked 2026-08-26
- ELK DMARC sample environment settings
Checked 2026-08-26
- ELK DMARC public repository: AI and access review
Checked 2026-08-27
- ELK DMARC README: AI and access review
Checked 2026-08-27
- ELK DMARC Go parser: AI and access review
Checked 2026-08-27
- ELK DMARC sample environment: AI and access review
Checked 2026-08-27
- ELK DMARC ELK data-loading script: AI and access review
Checked 2026-08-27
Palisade vs ELK DMARC: FAQ
What is ELK DMARC?
ELK DMARC is a public GitHub project for processing DMARC aggregate reports through an Elasticsearch and Kibana stack. Its README describes a Docker-based deployment, a parser that handles zipped report archives, and a Kibana dashboard for viewing the resulting DMARC data. It is a self-hosted project rather than a published hosted SaaS account.
How does ELK DMARC process reports?
You place zipped DMARC aggregation reports in the project's input directory. The start script unpacks .gz and .zip files, moves XML files into the ingest directory, and runs the Go parser. The parser unmarshals and flattens DMARC reports into JSON files before the ELK scripts load the data for Kibana dashboards.
Does ELK DMARC change DNS or move domains to p=reject?
The public README, parser, and deployment files describe report ingestion, parsing, storage, and Kibana visualization. They do not advertise an AI enforcement agent, hosted DNS records, a DNS deployment service, or a policy-readiness workflow. A team using ELK DMARC should plan its own sender investigation, SPF/DKIM changes, and DMARC policy process.
How much does ELK DMARC cost?
ELK DMARC does not publish a subscription price, hosted plan, or commercial rate card in its public repository. The project files are available for a self-hosted deployment, but you provide the machine, Elasticsearch and Kibana storage, report-delivery path, credentials, security, backups, maintenance, and support. The README reports an 8GB minimum from the maintainer's experience for the stack.
Does ELK DMARC include MSP features or PSA integrations?
The public project does not advertise managed multi-tenant client workspaces, white-label reporting, ConnectWise, HaloPSA, or Autotask integrations. An MSP could build service-management and client-reporting layers around a self-hosted ELK deployment, but those layers are not described as packaged ELK DMARC features in the repository.
Can I run ELK DMARC and Palisade at the same time?
Yes. DMARC reporting supports multiple recipients, so you can send reports to both systems during an evaluation period. Keep DNS and policy changes coordinated, compare the sender evidence and operator workload, and retire the self-hosted pipeline only after your team is comfortable with the Palisade workflow.
Switching from ELK DMARC takes three steps
- 1
Batch-import your domains
Bring your client domains into Palisade in bulk, or let your ConnectWise, HaloPSA, or Autotask integration sync them automatically.
- 2
Run both platforms in parallel
DMARC reporting supports multiple recipients, so Palisade and ELK DMARC receive the same reports during the overlap window. Nothing breaks while you compare.
- 3
Cut DNS over on your schedule
Point records at Palisade's hosted infrastructure (redundant managed DNS), then retire the old setup when you're satisfied.
Our onboarding team handles the technical transition with you.
Competitor information on this page was last reviewed against public sources on 2026-08-26. Spotted something out of date? Tell us and we'll fix it.