ELK DMARC vs Palisade in 2026
ELK DMARC is a public GitHub project that unpacks DMARC aggregate reports, parses them with a Go program, and puts the results into an Elasticsearch and Kibana stack you run yourself. Palisade is a hosted, agentic workflow that investigates senders, drafts authentication fixes, and proposes each policy step for your approval.
Our verdict: Choose ELK DMARC if your requirement is a self-hosted Elasticsearch and Kibana dashboard for DMARC report data and your team is prepared to operate the Docker stack, parser, storage, and follow-up work. Choose Palisade if you want an AI agent to investigate senders, draft SPF and DKIM fixes, and carry domains toward p=reject with your approval at every step.
Samuel Chenard · CEO & Co-Founder, PalisadeSource checks through 2026-10-1415-day full-product trial. Nothing is charged until it ends.
ChatGPT
Claude
Gemini
Perplexity
Grok
ELK DMARC
Palisade
Full rubric · 8/8 dimensions established
Full rubric · 8/8 dimensions established
Palisade's IT-team plans start at $19 a month, sized by email volume. Start with a 15-day full-product trial; nothing is charged until it ends.
Which one is right for you?
Best for Teams prepared to operate a self-hosted deployment
Best for MSPs and IT teams responsible for multiple domains
- You want to keep the report files, Elasticsearch data, and Kibana dashboard inside infrastructure your team operates.
- You have an engineer comfortable with Docker Compose, Elasticsearch, Kibana, Go, local volumes, credentials, and the maintenance work around a self-hosted deployment.
- Your immediate goal is to parse DMARC aggregate XML and inspect the resulting dashboard, with DNS remediation handled in a separate process.
- You want an AI agent to investigate every sender, draft SPF and DKIM fixes, and propose policy steps toward p=reject instead of assembling the remediation workflow around a dashboard.
- You want hosted SPF, DKIM, DMARC, BIMI, and MTA-STS records, with each change reviewed before it ships.
- You manage internal or client domains and want a hosted operating model with native ConnectWise, HaloPSA, or Autotask integrations.
IT-team plans start at $19 a month, sized by email volume. Start with a 15-day full-product trial; nothing is charged until it ends.
Where the day-to-day work actually differs
| Feature | ELK DMARC | Palisade |
|---|---|---|
| Reporting and visualization | ||
| DMARC aggregate report ingestion from ZIP and GZ archivesWhether compressed DMARC aggregate report archives can be unpacked for processing.The README directs operators to place zipped DMARC aggregation reports in a project folder, and the start script unpacks .gz and .zip files before processing them (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Unpacks ZIP and GZ | Agent analyzes reports |
| DMARC XML parsing and flattened JSON outputWhether DMARC XML reports are converted into structured data records.The Go parser finds XML files, unmarshals DMARC reports, flattens report entries, and writes each entry as a JSON file in the output directory (checked 2026-08-26). Source (2026-08-26) | Flattens XML to JSON | Not offered |
| Kibana dashboard for the parsed DMARC dataWhether parsed report data is available in a dashboard for inspection.The README sends operators to Kibana's Dashboards area to see the DMARC Dashboard; the Compose file exposes Kibana on a configurable host port (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Kibana dashboard | Not offered |
| Elasticsearch-backed report storageWhether report data is stored in an Elasticsearch data store.The Compose file includes an Elasticsearch service with a persistent local data volume, and the README identifies Elasticsearch as the data store underneath the tool (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Persistent Elasticsearch volume | Not offered |
| Deployment and operations | ||
| Docker Compose deployment for Elasticsearch, Kibana, and the parserWhether the reporting components can be deployed together from a Compose configuration.The repository supplies a Docker Compose file for setup, Elasticsearch, Kibana, and parser services, plus a parser Dockerfile based on the Go image (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | Docker Compose services | Hosted service |
| Operator-controlled report files, storage volumes, and service credentialsWhether operators control report inputs, persistent storage, and service credentials.The setup instructions have the operator create environment files, provide report archives in local directories, and use Docker volumes for certificates, Elasticsearch data, and Kibana data (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | Operator-managed local volumes | Hosted service |
| Enforcement workflow | ||
| AI agent that investigates senders, drafts authentication fixes, and proposes policy steps toward p=rejectWhether an agent investigates senders, drafts fixes, and proposes policy steps for approval.The public project materials describe report unpacking, parsing, JSON output, Elasticsearch, and Kibana dashboards; they do not advertise an AI enforcement agent or a sender-remediation workflow (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | —Not advertised | Agent drafts and proposes |
| Hosted records and DNS | ||
| Hosted DMARC, SPF, DKIM, BIMI, and MTA-STS recordsWhether the named email-authentication records are hosted as a service.The repository documents a self-hosted report-processing and dashboard stack and does not advertise hosted authentication records or a managed DNS service (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | —Not advertised | Hosted on managed DNS |
| SPF flattening and lookup-limit managementWhether SPF DNS lookups are reduced and kept within the lookup limit.The README and repository deployment files do not advertise SPF flattening or SPF lookup-limit management (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) | —Not advertised | Hosted SPF flattening |
| MSP operations | ||
| Native ConnectWise, HaloPSA, and Autotask integrationsWhether the platform connects directly to the named PSA tools.The public repository documents Docker, Elasticsearch, Kibana, local report directories, and parser scripts but does not advertise ConnectWise, HaloPSA, or Autotask integrations (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | —Not advertised | Native PSA integrations |
| Managed multi-tenant client workspaces and white-label reportingWhether MSPs can separate client workspaces and brand client reports.The project describes a self-hosted ELK deployment and does not advertise managed client workspaces, tenant separation, or white-label reporting (checked 2026-08-26). Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) | —Not advertised | Workspaces and white-label reports |
| Commercial service model | ||
| Published subscription plans, hosted trial, vendor support plan, or SLAWhether a vendor publishes commercial plans, evaluation terms, support, or service commitments.The public repository has no published pricing page, subscription plan, trial, commercial support plan, or SLA; its About panel provides no separate website or product link (checked 2026-08-26). Source (2026-08-26) | No commercial plan published | Published plans and trial |
| AI and automation access | ||
| Documented ELK DMARC API for programmatic accessWhether a customer can build against a documented REST or GraphQL API.ELK DMARC does not advertise a customer REST or GraphQL API reference in its public README or repository. Its sample environment exposes Elasticsearch's HTTP API for the self-hosted stack, but that is not documented as an ELK DMARC integration API (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) | —No product API listed | REST API published |
| MCP server for connecting AI assistants to domain dataWhether an AI assistant can reach the product's data directly.ELK DMARC does not advertise an MCP server or an AI-assistant integration in its public README or repository (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) | —No MCP server listed | MCP server published |
| Advertised AI assistance for investigating and drafting fixesWhether the vendor advertises AI that investigates senders or prepares authentication changes.ELK DMARC does not advertise an AI or machine-learning feature in its public README or repository. Those materials describe Docker deployment, report files, parsing, Elasticsearch, and a Kibana dashboard (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) | —No AI features listed | Agent drafts fixes |
| Report output outside the dashboardWhether report information can leave the product without using the web interface.ELK DMARC's Go parser writes each flattened DMARC report entry to a JSON file in its ./output directory before ELK loading. Its public project materials do not advertise scheduled customer exports, webhooks, or a hosted data-feed endpoint (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) | Local JSON file output | REST API published |
Want to compare the workflow yourself? Start a 15-day full-product trial of Palisade.
Palisade 86 vs ELK DMARC 44, and why
Both products are scored on the same eight dimensions the comparison hub uses, so the figures here are the figures there. Four are derived from vendor facts that each carry a source and a checked date. Four are editorial, marked as such below, and each states its reasoning and its source.
Each dimension is out of 10 and the total is the raw sum out of 80, rescaled to 100 — the raw figure is printed beside it so the conversion is checkable rather than a black box. Scored on what each vendor publishes, not on how the product feels in use. Unknown scoring dimensions are shown as Not established; provisional scores average only established dimensions and show coverage. They may change as remaining dimensions are verified. Current ranks include full and provisional scores; equal displayed scores share a rank. Historical assessments are separate. Editorial dimensions last reviewed 2026-10-15.
Full rubric · 8/8 dimensions established
Full rubric · 8/8 dimensions established
How reachable the vendor's DMARC data is from your own software and AI tools. Two paths count, an API and an MCP server, and each only if it reaches DMARC data (domains, records, reports or sending sources). A path is open when it is documented and included from the cheapest paid plan; gated when it needs a higher tier, an add-on, a sales call or a request, or the vendor does not say which plans include it. 10 = both open. 9 = one open, one gated. 8 = both gated. 7 = one open, the other absent. 6 = one gated, the other absent. 5 = access claimed in marketing only, with no docs or plan listing. 4 = reachable only through a self-hosted tool's own interface or a host platform's API, such as parsedmarc's library or Splunk's REST API; a dashboard over a database you run yourself does not count. 3 = no API or MCP server reaches DMARC data.
The repository publishes no ELK DMARC integration API or MCP server (checked 2026-08-28). Source (2026-08-28)
Palisade publishes a REST API and a remote MCP server on every plan, making the same domain data and remediation workflows available to connected software. Source (2026-08-30)
How much of the report analysis is done for you. 10 = the platform turns raw report data into a prioritised, actionable queue on its own.
It automates file transformation into Elasticsearch and Kibana, but report placement and loader execution are manual. Source (2026-08-28)
Report data is analysed into a prioritised list of sender, SPF, DKIM and DMARC issues, so nobody reads raw XML. Source (2026-08-30)
How much of the work the vendor's own software does. 10 = it identifies the sending sources, drafts the SPF and DKIM fixes each one needs, and proposes the next policy step. 6 = it applies the records for you, but a person decides what to fix and when to advance. 3 = it reports, and every change is yours to make. A vendor whose team does the work rather than its software scores here on the software alone.
The software loads aggregate report data into Kibana and leaves operators to investigate senders and make authentication record and policy changes. Source (2026-08-28)
The agent investigates each sender, drafts the SPF and DKIM changes it needs, and proposes the next policy step; a human approves before deployment. Source (2026-08-30)
10 = full pricing published. 6 = some tiers published, rest quote-gated. 3 = quote only.
The repository is publicly available and publishes no commercial plan or vendor subscription. Source (2026-08-28)
Self-service IT-team prices are published by email volume from $19/month; MSP pricing is portfolio-based per client domain, and Enterprise pricing is custom. Source (2026-08-30)
10 = hosts the records for you. 6 = partial or add-on. 3 = you manage your own DNS.
The project imports reports and does not host authentication records. Source (2026-08-28)
Yes: hosted DMARC, SPF, DKIM, BIMI & MTA-STS Source (2026-08-30)
10 = a genuine free plan. 6 = time-limited trial only. 3 = no free access.
The self-hosted repository is publicly available without a vendor subscription. Source (2026-08-28)
No free plan: a 15-day full-product trial; nothing is charged until the trial ends Source (2026-09-25)
10 = a real MSP program with multi-tenant management. 6 = partial. 3 = none.
No MSP programme or hosted multi-tenant service is published for the project. Source (2026-08-28)
Yes: MSP-first, multi-tenant with native PSA integrations Source (2026-08-30)
How much work it takes to get a domain from p=none to p=reject. 10 = the platform (or the vendor's team) gets you there without manual DNS edits.
The repository is a reporting stack and does not publish any record management, policy guidance, simulation, or enforcement work. Source (2026-08-28)
The DMARC Agent detects when a domain's authentication and alignment are ready for the next policy stage and proposes the move, but a human still approves and applies it, so it is not fully hands-off. Source (2026-08-30)
Where Palisade and ELK DMARC actually differ
Each argument keeps the product screens, sourced comparison points, and supporting analysis together.
Self-hosted data vs hosted reporting
ELK DMARC's zip-to-Kibana pipeline, not a hosted reporting account
ELK DMARC starts with files on the operator's filesystem. Its README tells you to place zipped DMARC aggregation reports in the parser's input directory, and the start script unpacks .gz and .zip archives before moving the XML files into an ingest directory. The Go program then finds those XML files, unmarshals the DMARC reports, flattens their entries, and writes JSON files for the next stage of the pipeline. That is a concrete, inspectable path from receiver report archive to structured data. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
ELK DMARC
A relevant product screenshot was not available in the reviewed evidence.
Palisade
- DMARC aggregate report ingestion from ZIP and GZ archives: Agent analyzes reports
- DMARC XML parsing and flattened JSON output: Not offered
- Kibana dashboard for the parsed DMARC data: Not offered
The dashboard layer is the other half of the project. Docker Compose starts Elasticsearch and Kibana with local volumes, while the README tells the operator to open Kibana's Dashboards area to view the DMARC Dashboard. This is genuine parity on report visualization: a technical team can see sender and policy evidence in a search-and-dashboard stack it controls. It is also a different operating model from signing up for a hosted account and adding domains to a managed workspace. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
Infrastructure control vs operating responsibility
What the README's 8GB Elasticsearch requirement means for ownership
The README says the maintainer's experience points to a minimum of 8GB of memory, because Elasticsearch is a powerful search-engine database underneath the system. The sample environment also exposes memory variables for Elasticsearch, Kibana, and Logstash, while Docker Compose persists certificates, Elasticsearch data, and Kibana data in local volumes. Those details make the trade visible: ELK DMARC gives the operator control over where the stack runs, but the operator also owns capacity planning, disk growth, credentials, backups, and access to the dashboard. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
ELK DMARC
A relevant product screenshot was not available in the reviewed evidence.
Palisade
A relevant product screenshot was not available in the reviewed evidence.
- Docker Compose deployment for Elasticsearch, Kibana, and the parser: Hosted service
- Operator-controlled report files, storage volumes, and service credentials: Hosted service
The repository's configuration is useful for a proof of concept or an engineering-led internal deployment. The parser Dockerfile provides a Go runtime and the project includes scripts for starting the ELK pieces and loading the generated data. The public materials do not advertise a hosted retention policy, uptime commitment, support queue, or upgrade service, so a team evaluating the project should budget for the runbook around the code as well as the machine that runs it. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26) Source 4 (2026-08-26)
Report parsing vs enforcement workflow
The parser gets reports into ELK; your team owns enforcement
ELK DMARC's documented boundary is report processing. The source code turns incoming DMARC XML into flattened JSON, and the repository's shell scripts hand that output to the ELK side of the stack. The README does not describe a sender owner queue, authentication-fix generator, DNS connector, or policy-readiness workflow. That is not a claim that an engineer could never extend the project; it is the limit of what the public project describes and packages for an operator today. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
ELK DMARC
A relevant product screenshot was not available in the reviewed evidence.
Palisade
- AI agent that investigates senders, drafts authentication fixes, and proposes policy steps toward p=reject: Agent drafts and proposes
Palisade takes responsibility for the work after the finding. Its agent investigates every sender, drafts every fix, and proposes each policy step; your team approves before anything ships. It can configure the SPF and DKIM work, identify when a domain is ready for a stricter DMARC policy, and keep the approval checkpoint explicit. With ELK DMARC, the dashboard is the starting point for the operator's remediation runbook. With Palisade, the investigation and configuration workflow is the product around the report data. Source (2026-08-26)
Operator control vs MSP workflow
A Kibana dashboard you operate, not an MSP control plane
ELK DMARC fits an organization that wants to own a report stack and already has someone who can operate it. The repository uses a project directory, local report archives, environment files, Docker services, and a Kibana endpoint. That makes the deployment understandable to an infrastructure team and leaves room for that team to decide how to secure, retain, export, or extend the data. The narrow fit is clear: control of the components matters more than having a packaged client-service workflow. Source (2026-08-26) Source 2 (2026-08-26) Source 3 (2026-08-26)
ELK DMARC
A relevant product screenshot was not available in the reviewed evidence.
Palisade
A relevant product screenshot was not available in the reviewed evidence.
- Native ConnectWise, HaloPSA, and Autotask integrations: Native PSA integrations
- Managed multi-tenant client workspaces and white-label reporting: Workspaces and white-label reports
An MSP needs a different kind of repeatability. Each client domain needs an intake path, a clear ownership record, report access, ticket handoff, DNS remediation, and a way to present progress back to the client. ELK DMARC does not advertise managed multi-tenancy, white-label reporting, PSA integrations, or partner pricing in the repository. Palisade's hosted model is designed around that operating shape, with multi-tenant client management and native ConnectWise, HaloPSA, and Autotask integrations alongside the agent-led enforcement workflow. Source (2026-08-26) Source 2 (2026-08-26)
Native PSA integrations
Palisade imports client domains straight from these three. ELK DMARC's own coverage is stated above, from their site.
- ConnectWise PSA
- Autotask
- HaloPSA
Dashboard access vs programmatic access
ELK DMARC writes local JSON files, but no product API or MCP server is listed
ELK DMARC's public README is an installation and dashboard guide. It tells operators to start the Docker stack, browse to Kibana, place compressed reports in the parser directory, and run the parser. That parser writes each flattened DMARC report entry as a JSON file in its output directory. The sample environment exposes Elasticsearch's HTTP API for the self-hosted stack, while included scripts call Elasticsearch and Kibana endpoints to load it. Those are deployment paths, not a documented ELK DMARC REST or GraphQL reference for customer integrations. The published README and repository do not advertise an MCP server, AI-assistant integration, AI or machine-learning feature, scheduled customer export, webhook, or hosted data-feed endpoint (checked 2026-08-27). Source (2026-08-27) Source 2 (2026-08-27) Source 3 (2026-08-27) Source 4 (2026-08-27) Source 5 (2026-08-27)
ELK DMARC
A relevant product screenshot was not available in the reviewed evidence.
- Documented ELK DMARC API for programmatic access: No product API listedSource 1, Source 2, Source 3
- MCP server for connecting AI assistants to domain data: No MCP server listedSource 1, Source 2
- Advertised AI assistance for investigating and drafting fixes: No AI features listedSource 1, Source 2, Source 3
Palisade
- Documented ELK DMARC API for programmatic access: REST API published
- MCP server for connecting AI assistants to domain data: MCP server published
- Advertised AI assistance for investigating and drafting fixes: Agent drafts fixes
Palisade publishes an MCP server and a REST API. Its agent investigates senders, drafts SPF and DKIM fixes, and proposes each policy step. A human approves before anything ships.
Reachable from your own AI tools
Palisade's MCP server exposes 42 tools over OAuth, so the assistant your team already uses can read domains, pull the exact records to publish and work the task queue. These are the clients the connection guide walks through.
- ChatGPT
- Claude
- Codex
- Cursor
- Windsurf
- Any MCP client
Still deciding between ELK DMARC and Palisade? See what changes with Palisade.
15-day full-product trial. Nothing is charged until it ends.
Microsoft 365
Zoho Mail
The agent does the heavy lifting
Sources identified, SPF and DKIM fixes drafted, each policy step proposed. You approve; nothing ships on its own.
Connect your AI with MCP
42 tools over MCP, so your assistant reads your domains and works the queue.
Connect your DNS manager directly
One-time sign-in supports 64 providers without retaining credentials. Optional account connections support Cloudflare, GoDaddy and Route 53. You approve every change.
“We evaluated many DMARC providers before choosing Palisade. The quality of their product, the responsiveness and friendliness of their team and their rapid progress on their product roadmap made it a no-brainer for us to move forward.”
ELK DMARC pricing: a self-hosted GitHub project, not a published SaaS rate card
ELK DMARC does not publish a commercial pricing page or hosted subscription tier in its public project presence. The repository gives you Docker Compose files, an Elasticsearch and Kibana stack, and a Go parser. The cost question is therefore the infrastructure and operator time required to run that stack, not a monthly plan that the project publishes.
What you'd actually pay
The same five buyer sizes on every comparison, so a shape carries from one page to the next.
1 domain, up to 1,000 emails a month
2 set-up domains, up to 100K emails a month
10 set-up domains, up to 1M emails a month
20 set-up domains, up to 2.5M emails a month
Client domains under management, any volume
Palisade’s figures are derived from its published tiers. ELK DMARC pricing or licensing source reference: vendor source citation date 2026-08-28. Plans and prices may have changed since.
How ELK DMARC prices
- The repository does not publish a hosted tier, domain allowance, email-volume quota, trial, paid support package, or SLA (checked 2026-08-26).
- The README reports a minimum of 8GB of memory from the maintainer's experience because the stack uses Elasticsearch. That is a deployment recommendation, not a vendor-hosted service limit (checked 2026-08-26).
- The sample environment pins Elastic products to version 8.11.3, exposes Elasticsearch and Kibana ports, and offers a basic or trial license setting. These are local deployment settings, not a published ELK DMARC commercial plan (checked 2026-08-26).
- No separate product, pricing, documentation, integrations, or support site is linked from the repository's public About panel. The README and project files are the available first-party source set checked here (checked 2026-08-26).
How Palisade prices
- Palisade publishes flat monthly IT-team plans sized by email volume from $19/month with 20% off on annual billing.
- Paid IT tiers cap set-up domains at 2, 3, 6, 10, or 20 by volume tier; adding domains remains free and unlimited. MSP pricing is quoted per client domain, with a minimum of 5 client domains, no client email metering, and a free NFR domain for the provider.
- Palisade is hosted and includes unlimited report history on IT-team and MSP plans (Enterprise retention follows custom terms), API access on every plan, and a 15-day full-product trial. ELK DMARC leaves storage, retention, access, and maintenance to the operator running the stack.
- Palisade's agent investigates senders, drafts SPF and DKIM fixes, and proposes policy steps toward p=reject for approval. The ELK DMARC repository documents the report pipeline and dashboard, not that enforcement workflow.
ELK DMARC source reference: primary reference citation date 2026-08-26.Palisade source reference: the public pricing page citation date 2026-08-30.Plans and prices may have changed since.
Start a 15-day full-product trial of Palisade. Nothing is charged until it ends.
What each one covers, and where it stops
Published facts only, read from each vendor's own material. Neither column describes a hands-on trial, because we have not run one.
ELK DMARC is a public GitHub project for technical teams that want to run their own DMARC reporting stack. It unpacks compressed aggregate reports, converts DMARC XML into JSON, and loads the data into Elasticsearch and Kibana. The project suits teams comfortable operating Docker Compose, local storage, credentials, and the related maintenance.
ELK DMARC keeps report archives, Elasticsearch data, Kibana data, and service configuration inside infrastructure operated by the team using it. Its public repository provides source files and deployment configuration, rather than a hosted subscription tier or published service plan. The operator supplies the capacity, storage, report-delivery path, backups, security, and support.
Palisade is built around an agent that does the DMARC work rather than reporting on it. It identifies every sending source, drafts the SPF and DKIM changes each one needs, and proposes the next policy step when the evidence supports it.
The agent investigates every sender, drafts every fix, and proposes each policy step, you approve before anything ships.
- Unpacks ZIP and GZ DMARC aggregate-report archives before processing
- Flattens DMARC XML reports into local JSON files
- Provides a Kibana dashboard for parsed DMARC data
- Runs Elasticsearch, Kibana, and the parser through Docker Compose services
- Stores report data in a persistent Elasticsearch volume
- The agent investigates senders and drafts the fix, so the work arrives prepared rather than as a list of findings
- Hosted SPF, DKIM and DMARC records, so an approved change can be carried out rather than handed off
- Portfolio workflow for MSPs, with ConnectWise, HaloPSA and Autotask integrations and a free NFR domain
- An MCP server and a REST API, so the same data and workflow are reachable from the AI tools a team already uses
- Does not advertise an AI agent for sender investigation, authentication fixes, or policy steps
- Does not advertise hosted DMARC, SPF, DKIM, BIMI, or MTA-STS records
- Does not advertise SPF flattening or lookup-limit management
- Does not advertise ConnectWise, HaloPSA, or Autotask integrations
- Does not publish a commercial subscription plan, hosted trial, support plan, or SLA
- Every policy change waits for a human approval, by design: nothing ships on the agent's own authority
- MSP pricing is portfolio-based per client domain, with a minimum of 5 client domains
- Plans are sized by monthly email volume, so a low-domain, high-volume sender lands on a higher tier than domain count alone suggests
- Starts at
- No subscription price published
- Memory guidance
- 8GB minimum
- Hosted tier
- Not published
- MSP model
- Not published at 25 domains
- Starts at
- IT plans from $19/mo by email volume; 15-day trial
- Trial
- 15 days, full product
- MSP model
- Portfolio-based per client domain; minimum of 5 client domains
What Palisade customers say
5.0 out of 5 on G2Trusted by over 10,000 domains
“Palisade made it so easy for us to get our blue verified checkmark and achieve our BIMI compliance”
Sources and further reading
Source checks run through 2026-10-14; every entry keeps its individual check date.
- ELK DMARC repository
Checked 2026-08-28
- ELK DMARC README: AI and access review
Checked 2026-08-27
- ELK DMARC Docker Compose deployment
Checked 2026-08-26
- ELK DMARC Go parser: AI and access review
Checked 2026-08-27
- ELK DMARC report-unpacking start script
Checked 2026-08-26
- ELK DMARC parser Dockerfile and runtime
Checked 2026-08-26
- ELK DMARC sample environment: AI and access review
Checked 2026-08-27
- ELK DMARC ELK data-loading script: AI and access review
Checked 2026-08-27
- ELK DMARC commit history
Checked 2026-08-28
- ELK DMARC demonstration video
Checked 2026-08-28
- Source
Checked 2026-08-26
- Source
Checked 2026-08-30
- Source
Checked 2026-10-14
Palisade vs ELK DMARC: FAQ
What is ELK DMARC?
ELK DMARC is a public GitHub project for processing DMARC aggregate reports through an Elasticsearch and Kibana stack. Its README describes a Docker-based deployment, a parser that handles zipped report archives, and a Kibana dashboard for viewing the resulting DMARC data. It is a self-hosted project rather than a published hosted SaaS account.
How does ELK DMARC process reports?
You place zipped DMARC aggregation reports in the project's input directory. The start script unpacks .gz and .zip files, moves XML files into the ingest directory, and runs the Go parser. The parser unmarshals and flattens DMARC reports into JSON files before the ELK scripts load the data for Kibana dashboards.
Does ELK DMARC change DNS or move domains to p=reject?
The public README, parser, and deployment files describe report ingestion, parsing, storage, and Kibana visualization. They do not advertise an AI enforcement agent, hosted DNS records, a DNS deployment service, or a policy-readiness workflow. A team using ELK DMARC should plan its own sender investigation, SPF/DKIM changes, and DMARC policy process.
How much does ELK DMARC cost?
ELK DMARC does not publish a subscription price, hosted plan, or commercial rate card in its public repository. The project files are available for a self-hosted deployment, but you provide the machine, Elasticsearch and Kibana storage, report-delivery path, credentials, security, backups, maintenance, and support. The README reports an 8GB minimum from the maintainer's experience for the stack.
Does ELK DMARC include MSP features or PSA integrations?
The public project does not advertise managed multi-tenant client workspaces, white-label reporting, ConnectWise, HaloPSA, or Autotask integrations. An MSP could build service-management and client-reporting layers around a self-hosted ELK deployment, but those layers are not described as packaged ELK DMARC features in the repository.
Can I run ELK DMARC and Palisade at the same time?
Yes. DMARC reporting supports multiple recipients, so you can send reports to both systems during an evaluation period. Keep DNS and policy changes coordinated, compare the sender evidence and operator workload, and retire the self-hosted pipeline only after your team is comfortable with the Palisade workflow. Source (2026-10-14)
Switching from ELK DMARC takes three steps
- 1
Batch-import your domains
Bring your client domains into Palisade in bulk, or let your ConnectWise, HaloPSA, or Autotask integration sync them automatically.
- 2
Run both platforms in parallel
Keep both reporting destinations configured during the overlap, verify external-report authorization where required, and confirm reports arrive in both platforms before retiring ELK DMARC. Review hosted-record dependencies before changing DNS.
- 3
Cut DNS over on your schedule
Point records at Palisade's hosted infrastructure, then retire the old setup when you're satisfied.
15-day full-product trial. Nothing is charged until it ends.
Source citations on this page run through 2026-10-14; individual claims retain their dates and evidence limitations. Spotted something out of date? Tell us and we'll fix it.