Mimecast pricing: what is published and what drives cost

How the options were evaluated

The criteria below were checked against Mimecast and Palisade first-party pages on August 12, 2026:

• Published price: whether the vendor provides a dollar amount, currency, rate, or range that a buyer can use without requesting a quote.
• Scope: whether the documented product is email security, insider-risk management, security behaviour management, or DMARC operations.
• Quantity and service levers: documented limits, included capabilities, migration costs, implementation services, or modules that can affect the final commercial scope.
• Deployment: whether the product uses MX routing, an API connection, or another documented deployment choice.
• Boundary: what the documented offering does not establish or perform.

Mimecast plans and quote-based pricing

Mimecast's plans page names threat-protection tiers as Critical, Advanced, and Premium. It names insider-risk-management tiers as Professional, Enterprise, and Gov, and security-behaviour-management tiers as Core and Pro. The same page does not publish a dollar price for any of them. Its price fields direct buyers to contact Mimecast or describe custom pricing or options.

• Best fit: Teams buying a broader email-security, insider-risk, or security-behaviour package and prepared to scope it with Mimecast sales.
• Relevant evidence: Mimecast plans describes Critical as the broad email-security tier, with features such as AI-powered BEC protection, URL analysis, attachment sandboxing, malware scanning, spam filtering, continuity, and collaboration-tool protection. Advanced adds data protection, while Premium extends across collaboration tools, checked August 12, 2026.
• Tradeoff: A buyer cannot calculate a vendor-supported annual or per-user cost from the public plans page. Any public figure from a reseller or review site is not a Mimecast-published list price.

Plan timing also matters. Mimecast states that, from August 15, 2025, new customers must purchase the new email-security plans, while existing purchases remain online, uninterrupted, and unchanged. Mimecast also states that migration to the new plans can involve an additional cost and that standard price-increase terms apply. Ask sales which plan structure applies to the account, whether migration is included, and which terms govern renewal.

The public route to a number is Mimecast's quote-request page, which offers a customised plan and quote without publishing a price or range.

Mimecast deployment and DMARC costs

Mimecast's integrated cloud email security page documents two deployment models. MX-based deployment routes incoming mail through Mimecast's gateway. API-based deployment connects without MX-record changes and is described as avoiding mail-flow disruption. The correct model depends on the email environment and desired controls, so it belongs in the quote request.

• Best fit: Buyers who need Mimecast's documented gateway or integrated cloud email-security capabilities as part of the commercial scope.
• Relevant evidence: Mimecast Email Security MX Based Protection is documented as a cloud-native secure email gateway that scans inbound, outbound, and internal mail, including attachments and URLs, checked August 12, 2026.
• Tradeoff: A DMARC requirement should be scoped separately. A gateway purchase does not state a public price for DMARC reporting or show that every DMARC-related service is included.

Current Mimecast plans allow customizable bundles. Confirm whether DMARC Analyzer, managed deployment and onboarding services are included in the specific quote.

Mimecast’s current DMARC Analyzer product page describes domain-authentication analysis and management. Confirm the selected modules, implementation service and support entitlement in the quote; an older packaging matrix does not establish current inclusion.

Do not assume that a generated DMARC, SPF, or DKIM record is deployed. Mimecast documents analysis, generation, and recommendations for DMARC Analyzer. The domain owner must still control and validate the DNS change.

Palisade for DMARC automation

Palisade is a narrower fit for teams buying DMARC operations rather than inbound email filtering. It is agentic DMARC software for IT teams and MSPs that analyzes DMARC aggregate-report data, identifies sending sources and authentication or alignment issues, creates prioritized remediation tickets, and proposes the next policy step for human review.

• Best fit: Teams that want an AI agent to do the DMARC work across one domain or many domains.
• Relevant evidence: Palisade pricing publishes IT-team plans priced by monthly email volume, MSP pricing per client domain with a minimum of five client domains and a free NFR domain, and enterprise custom terms, checked September 25, 2026.
• Tradeoff: The published pricing describes an AI agent that drafts changes and requires approval for each policy step. Evaluate that DMARC workflow separately from Mimecast’s inbound email-security scope.

Palisade's published pricing provides a starting point that Mimecast's public plans page does not. That does not make it a substitute for Mimecast filtering plans. The products solve overlapping DMARC visibility needs, but different email-security jobs.

How to choose

Start by writing down the operational problem, then request a quote only after the required product scope is clear.

• Choose Mimecast when the purchase includes documented secure email gateway controls, API-connected cloud email security, insider-risk management, security-behaviour management, or a combined security package.
• Choose Palisade when the requirement is recurring DMARC analysis, source identification, remediation prioritisation, and human-reviewed progression toward DMARC enforcement.
• Ask Mimecast whether DMARC Analyzer is included, separately priced, or subject to an additional service fee for the exact package.
• Ask which deployment model is proposed, what migration costs apply, and whether onboarding or managed deployment assistance is separately charged.
• Record every quantity limit, retained-history period, API entitlement, and collaboration-tool scope in the quote.

option: Mimecast
checked_on: 2026-08-12
best_fit: "Broad email security and separately scoped DMARC operations"
verified_evidence:
  - "Public plans have no published dollar price or range"
  - "MX-based and API-based deployment are documented"
  - "DMARC Analyzer is a named product with no published price"
open_question: "Quoted price, minimum commitment, included modules, and implementation fees"

option: Palisade
checked_on: 2026-09-25
best_fit: "DMARC automation for IT teams and MSPs"
verified_evidence:
  - "Published IT team, MSP, and enterprise pricing paths"
  - "DMARC aggregate-report analysis and prioritised remediation workflow"
  - "Human review before policy changes"
open_question: "Exact monthly-volume or multi-domain scope for the account"

Check the domain controls behind the quote

Before treating a DMARC module as the answer, run the domain through Palisade's Email Security Score. It checks publicly resolvable email-security controls, which helps identify whether DMARC, SPF, DKIM, BIMI, MX, MTA-STS, or TLS-RPT has an obvious public DNS gap before you scope a remediation workflow.

A public scan does not prove which production senders fail alignment, confirm Mimecast packaging, monitor later DNS changes, or guarantee inbox placement. Those questions require message evidence, vendor confirmation, and DMARC reporting over time.