Two customers with the same number of domains can require very different effort. One may use a single well-managed platform; another may have many applications, slow approval routes and frequent incidents. Price the work that must be performed, then test whether the model covers its uncertainty.
Separate setup and recurring work
Track onboarding discovery, sender inventory, access verification and initial remediation separately from recurring analysis, change review, incident response and customer reporting. Include offboarding and evidence retention responsibilities. Do not count automated collection time as human effort, but do include the time people spend interpreting its output and resolving exceptions.
RFC 9990 reports can support analysis of observed traffic, but report volume alone is not a reliable measure of operational effort. A quiet sender can be business critical, and a high-volume sender can be routine. Record complexity drivers such as distinct applications, delegated DNS ownership, required approval layers and support coverage.
Use a transparent cost model
Choose a consistent currency and cost basis. Estimate labor hours by task, multiply by loaded hourly cost and add tooling and other direct delivery costs. Separate desired gross margin from markup: for a target margin m with 0 ≤ m < 1 and positive cost, price equals cost divided by one minus m. This is arithmetic, not a market recommendation. Taxes, sales expense and contractual terms need separate treatment when relevant.
The synthetic model uses recurring analysis (2 hours), change review (1.5 hours), customer reporting (1 hour) and incident allowance (2 hours), totaling 6.5 hours per month, a fictional loaded cost of USD 60 per hour and USD 90 of tools and allocation. Cost is USD 480. A 40% target gross margin produces USD 800 before taxes and other excluded charges. A two-hour incident overrun raises cost to USD 600 and lowers margin at that same price to 25%.
Review and challenge the illustrative assumptions
The example uses invented planning inputs, not measured effort, supplier quotes or recommended EmailAuth pricing. Its calculation is 6.5 × USD 60 + USD 90 = USD 480; USD 480 / 0.60 = USD 800; (USD 800 − USD 600) / USD 800 = 25%. No costing script or customer service was executed. Begin a real model by recording actual task times over a representative cycle, including failed investigations and customer coordination.
Allocate onboarding, access review, escalation drills, evidence packaging and offboarding somewhere rather than assuming they are free. Separate one-time setup charges from recurring charges. If repeated overruns come from waiting for an application owner, identify the coordination task and scope gap before changing the customer price. The model supports a review decision; it does not authorize a quote or contract.
Define scope and review triggers
State included work, coverage hours, expected customer response and how exceptional incidents are handled. Avoid incentives to skip investigations merely to meet a fixed time allowance. Use the scope review to identify chronic complexity, improve the workflow or negotiate a clearly described service change.
Compare estimated with actual cost at a defined review point. Explain variance by task rather than raising prices solely because message volume increased. Customer-specific access control and approval requirements remain necessary even when they increase cost. OWASP authorization guidance supports least privilege; commercial pressure is not a reason to bypass it. Any quote or contract should be reviewed and approved separately from this planning model.