The pricing of the service is based on the number of DMARC compliant emails processed. 

We can determine this based on the DMARC aggregate reports that are sent by the recipients email service provider (ISPs).

How do I know what volume tier fits my organization best? 

DMARC covers all outbound email volume (and a bit inbound, emails sent internally). Therefore, the total amount of emails an organization sends on a monthly basis is a good indication of the volume tier which fits an organization best.

Will spoofing attacks and malicious emails get charged? 

We do not charge for malicious emails. Since malicious emails can never be DMARC compliant, malicious emails are not counted towards your total volume.