Valimail is an email authentication company. It stops attackers from sending phishing and spoofed email that appears to come from an organisation’s own domains, by getting those domains to full DMARC enforcement and keeping them there.
It is built for organisations that send mail through many third-party services, from marketing platforms to ticketing tools, and that cannot reach enforcement without breaking legitimate email.
At A Glance
| Vendor | Valimail, a DigiCert company |
|---|---|
| Category | Email and communications security (DMARC, SPF, DKIM, BIMI) |
| Deployment | Hosted service |
| Certifications | FedRAMP, SOC 2 Type 2 |
| Scale | More than 450,000 domains reported secured by Valimail and DigiCert |
| Market classification | Email & Communications Security |
What Valimail Does
DMARC protects a domain only when it is set to enforcement, and getting there is hard because large organisations send email through many third-party services that each need to be authorised correctly. Valimail runs that work as a service: it identifies every sender, authorises the legitimate ones and keeps the records current as senders change, so the domain reaches enforcement and stays there. Once a domain is protected, the same verified identity can be shown to recipients through the brand’s mark in the inbox.
Products
Monitor
Monitor is the starting point for organisations that do not yet know which services send email as their domains. It identifies sending services by name, shows where mail passes and fails DMARC, and finds unauthorised ISPs, open routers and suspicious IP addresses sending as the domain. It also checks readiness for inbox provider sender requirements and previews how messages could look with BIMI.
Enforce
Enforce is for teams that want to reach DMARC enforcement and stay there without managing records by hand. Thousands of sending services are recognised by name and can be authorised with a single click, and configuration, updates and alerts are automated. Real-time reports show authentication status. Instant SPF, patented software, overrides the SPF lookup limit that breaks authentication for domains with many senders.
Amplify
Amplify handles BIMI for brands that want their brand mark shown beside authenticated mail. It acquires and manages the VMC or CMC certificate, configures the brand image for each domain in a single step, and lets teams assign and swap brand assets across domains. Domains already at enforcement move through BIMI faster.
How It Works
Valimail runs as a hosted service. Enforce reaches continuous DMARC enforcement without the customer editing DNS records, because the service handles configuration and updates itself.
| Component | What it does |
|---|---|
| Sender discovery | Monitor turns IP data from DMARC reports into named sending services, drawing on more than 70 million pre-decoded IP addresses. |
| Service authorisation | Administrators authorise pre-configured sending services in one click, and the company reports that 99% of sending services can be authorised this way. |
| Email platforms | Full integrations with Google Workspace and Microsoft 365, and technology partnerships with Sublime, Cloudflare and Abnormal, connect the service to the mail flow customers already run. |
Company Background
| Founders | Alexander Garcia-Tobar and Peter Goldstein. |
|---|---|
| Ownership | A DigiCert company, run as a dedicated DigiCert business unit. |
| Security and compliance | Compliance-ready for GDPR, CCPA and HIPAA, and Enforce is PCI compliant. |
| Standards work | Co-chair roles in the DMARC IETF Working Group, the M3AAWG Working Group and the BIMI Working Group, and co-author of the ARC Protocol. |
Note: This overview is compiled from Valimail’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.