Email protection basics
What is DMARC, and does my small business need it?
You saw "DMARC" in a report, a warning from your host, or after someone sent fake emails using your name. Here's what it is in plain English, whether it matters for you, and how to set it up without breaking your email.
What is DMARC? The short answer
DMARC is a short text record you add to your domain's DNS settings. It tells email providers like Gmail and Outlook what to do with messages that claim to be from your business but fail the SPF and DKIM checks: deliver them, send them to spam, or reject them. It also sends you reports, so you can see who is sending email in your name.
(DNS is the public address book for your domain. It's where your website, email and these protection records are listed.)
Think of it like a door at a private event: SPF is the guest list, DKIM is a tamper-proof seal on each invitation, and DMARC is the instructions you give the bouncer about anyone who fails those checks. If fake emails are already going out in your name, start with what to do when someone is sending emails from your domain.
How SPF, DKIM and DMARC work together
SPF (Sender Policy Framework)
SPF is a record that lists the servers and services allowed to send email as your domain: your email provider, plus things like your invoicing or newsletter tool. Mail from anywhere else fails SPF.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to each message your services send. Receivers check it against a key you publish in DNS, which proves the message really came from your domain and wasn't changed along the way.
DMARC: the rule, plus the reports
DMARC ties the two together. A message passes DMARC when it passes SPF or DKIM and the domain that passed matches the domain your customer sees in the From line. (That matching is called alignment. It's what stops a scammer from passing SPF with their own domain while showing yours.) Your DMARC record then says what receivers should do with messages that fail, and where to send reports.
Do I need DMARC?
If anyone could pretend to be you, yes
If you send invoices, payroll notices, quotes or customer emails from your own domain, a fake message "from" you can cost real money. DMARC is the record that tells receivers to treat those fakes as fakes.
Gmail's rules
Gmail's email sender guidelines require every sender to set up SPF or DKIM. Senders who send more than 5,000 messages a day to Gmail accounts must also have DMARC (a policy of none is allowed). Google recommends SPF, DKIM and DMARC for everyone, because unauthenticated mail is more likely to be marked as spam or rejected. The same records help your real email reach inboxes.
The FTC recommends it too
The US Federal Trade Commission's guidance for small businesses recommends using SPF, DKIM and DMARC so scammers can't easily send email that looks like it came from you.
See if your domain has DMARC: free check, 10 seconds
The three DMARC settings: none, quarantine, reject
| Setting | What happens to fakes | When to use it |
|---|---|---|
p=none | Nothing changes. Receivers just send you reports. | At the start, while you find every service that sends as you |
p=quarantine | Failing messages go to the spam folder. | Once the reports show your real mail passing |
p=reject | Failing messages are refused. | The goal, after quarantine has run cleanly |
Don't jump straight to reject. If you missed a service that sends as you (say, your booking tool), its emails would be blocked too.
What a DMARC record looks like
It lives in DNS under the name _dmarc.yourbusiness.com, as a text (TXT) record. A starter record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com
v=DMARC1says "this is a DMARC record."p=noneis the policy: watch only, for now.rua=mailto:…is where receivers send the daily summary reports.
How to set up DMARC safely (step by step)
- List everything that sends email as you: your email provider, invoicing, booking, website forms and newsletter tool.
- Set up SPF with one record that includes each of those senders.
- Turn on DKIM at each sender, and publish the keys they give you.
- Publish DMARC at p=none with a reporting address.
- Read the reports for a week or two and add any real sender that's failing.
- Move to p=quarantine, keep watching, then move to p=reject.
What DMARC doesn't do
- It doesn't fix a hacked mailbox. Mail sent from your real account passes every check. If you see odd messages in your Sent folder or sign-ins you don't recognize, contact your email provider or an IT specialist right away. (Here's how to tell forged from hacked.) That's specialist work, not something a DNS record solves.
- It doesn't stop lookalike domains, like one letter off from yours, or a fake display name on a free account.
- It isn't a spam filter for your own inbox. It protects other people from fakes using your domain.
Frequently asked questions
Is DMARC free?
Yes. It's a text record in your domain's DNS, which you already pay for with your domain. Paid services exist only to make the reports easier to read.
Will DMARC break my email?
Not if you start at p=none, which changes nothing and only sends reports. Tighten the policy once the reports show all your real senders passing.
What is a DMARC report?
A summary that mail providers send to the address in your record, usually daily. It lists which servers sent email using your domain and whether those messages passed SPF, DKIM and DMARC.
What does "DMARC policy not enabled" mean?
Either your domain has no DMARC record, or it has one set to p=none, which only watches. Fakes still get through until the policy is quarantine or reject.
Do I need DMARC if I use Gmail or Microsoft 365 for my business?
Yes, for your own domain. Google Workspace and Microsoft 365 help with SPF and DKIM, but the DMARC record lives in your domain's DNS and is yours to publish.
How long does it take?
Publishing the record is quick. The safe part is watching the reports, often for a couple of weeks, before tightening the policy. It depends on how many services send email as you.
Is p=reject safe for a small business?
Yes, once your reports show every real sender passing. Getting there in stages is what makes it safe.
Does DMARC stop all phishing?
No. It stops exact forgeries of your domain at receivers that enforce it. It can't stop lookalike domains, fake display names, or mail from a hacked account.
Want the bigger picture? The free SiteSafeCheck shows your SPF, DKIM and DMARC status alongside HTTPS and other common gaps, and the About page explains what it checks.