The pricing of the service is based on the number of DMARC Reports processed.

We can determine this based on the DMARC aggregate reports that are sent by the recipients email service provider (ISPs).  More details can be found in the article: What do DMARC Reports in the plans mean?

How do I know what volume tier fits my organization best? 

DMARC covers all outbound email volume (and a bit inbound, emails sent internally). Therefore, the total amount of emails an organization sends on a monthly basis is a good indication of the volume tier which fits an organization best.

Will spoofing attacks and malicious emails get charged? 

We do not charge for malicious emails. Since malicious emails can never be DMARC compliant, malicious emails are not counted towards your total volume.

If you believe your monthly quota count has been exceeded due to spoofing attacks which used your domain name, please contact our technical support for assistance.