Valimail
San Francisco-founded DMARC/email-authentication automation pioneer, acquired by DigiCert in September 2025 to enter the paid DMARC market.
Visit Website ↗ + Add to CompareOverview
Valimail automates DMARC, SPF, and DKIM deployment and enforcement, the email-authentication standards that determine whether a message claiming to be from a given domain can be trusted, without which brand impersonation and phishing emails can spoof a company’s domain with little friction. Founded in San Francisco in 2015 by Alexander Garcia-Tobar and Peter Goldstein, Valimail was an early mover in automating what is otherwise a notoriously fiddly, manually-managed DNS configuration process, and became a driving force behind BIMI (Brand Indicators for Message Identification), which shows verified brand logos in supported inboxes.
The company reported more than 92,000 clients as of its 2025 acquisition announcement and describes itself as the only DMARC provider with FedRAMP authorization, a specific, checkable government-authorization claim rather than generic marketing language. On September 16, 2025, digital-trust and certificate authority giant DigiCert acquired Valimail, explicitly to enter the multi-billion-dollar paid DMARC market as Google and Yahoo’s 2024 bulk-sender authentication requirements pushed more organizations to adopt DMARC as table stakes rather than best practice.
Now operating as part of DigiCert rather than as an independent company, Valimail’s near-term trajectory depends on how well DigiCert integrates DMARC automation with its certificate-issuance business; the underlying technology and FedRAMP authorization are real assets, but the acquisition introduces integration risk and reduces Valimail’s standalone strategic autonomy that a CISO evaluating it today should factor in.
Innovation Matrix Assessment
As of the September 2025 DigiCert acquisition, Valimail's product roadmap is being folded into DigiCert's broader digital-trust platform rather than continuing as an independent release cycle, making near-term standalone velocity harder to assess.
Reported more than 92,000 clients as of its acquisition announcement and is described as the only DMARC provider with FedRAMP authorization, a specific, checkable claim indicating real production scale and a government-grade compliance bar.
Being acquired by DigiCert in September 2025 specifically to enter the $4B+ paid DMARC market is a strong, independently reported momentum signal, even though it ends Valimail's run as an independent company.
Valimail was an early mover in automating DMARC/SPF/DKIM deployment and helped establish BIMI, a genuine category-shaping contribution, though DMARC automation itself is now offered by several competitors including EasyDMARC and others.
FedRAMP authorization is an independently verifiable, rigorous third-party compliance bar that few DMARC vendors have cleared, and the 92,000-client figure was reported at the time of an arm's-length acquisition rather than only in vendor marketing.
Google and Yahoo's 2024 bulk-sender authentication mandates made DMARC effectively required rather than optional, keeping automated DMARC/SPF/DKIM management commercially relevant, though Valimail's specific relevance now depends on DigiCert's integration execution.
Why CISOs Should Care
Automates a DNS-based email authentication process (DMARC/SPF/DKIM) that is notoriously easy to misconfigure manually, directly reducing domain-spoofing and brand-impersonation phishing risk.
What Makes It Different
An early, FedRAMP-authorized mover in DMARC automation and a driving force behind the BIMI standard, now being integrated into DigiCert's certificate and digital-trust platform rather than operating as a standalone point solution.
The Matrix Verdict
55/100 — INCREMENTAL INNOVATOR
A genuinely pioneering DMARC automation vendor with real government-grade compliance credentials, now in a transition period following its 2025 acquisition whose long-term product integration outcome is not yet observable.
Editorial Note: Claims vs. Verified Findings
The DigiCert acquisition, its September 2025 date, and Valimail's role in BIMI are independently confirmed via DigiCert's own announcement and multiple trade press outlets. The 92,000-client figure and 'only FedRAMP-authorized DMARC provider' claim were stated in acquisition-related press materials and have not been independently re-verified by this review.
Sources
Alternatives to Valimail
Teleport
An identity-based infrastructure access platform issuing short-lived cryptographic identities for humans, machines, and AI agents in place of…
SpecterOps
Identity attack-path security specialist behind BloodHound, the widely used open-source tool for mapping Active Directory and Entra ID…
Astrix Security
Non-human identity security platform that discovers and governs API keys, OAuth tokens, service accounts, and AI-agent credentials across…
Socure
AI-driven identity verification and fraud platform used by banks, fintechs, and government agencies to validate identities during digital…
Keyfactor
Machine identity and PKI management platform helping enterprises secure certificates, keys, and post-quantum cryptography readiness at scale.
Silverfort
Agentless unified identity protection platform that extends MFA, ITDR, and access policy to legacy and unmanaged systems traditional…