cqwerty

Blog

What is DMARC? A Plain-English Guide for Business Owners

← Back to blog
2026-04-11·5 min read

DMARC in one sentence

DMARC tells email servers what to do when someone pretends to send email from your domain.

Without it, anyone can send emails that look like they come from you, to your customers, employees, or partners.

mail flow . with and without DMARC
Without enforcement a spoofed message reaches the inbox. With p=reject the same message is refused at the receiver.

Why your business needs DMARC

  • 73% of organisations experienced phishing in 2025
  • Google and Yahoo require DMARC for bulk senders
  • Your brand reputation is at stake

    • How it works

    DMARC builds on SPF (who can send) and DKIM (cryptographic signatures). It adds a policy: 'none' (monitor), 'quarantine' (spam folder), or 'reject' (block).

    _dmarc.yourdomain.com . TXT
    p=noneMonitor onlySpoofed mail still lands.
    p=quarantineSend to spamFailing mail is held back.
    p=rejectBlock entirelySpoofing is refused.
    Climb one rung at a time once your reports are clean.

    Setting up DMARC

  • Check your current state with the free DMARC checker
  • Add a DNS TXT record: 'v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com'
  • Monitor for 2-4 weeks, then tighten to 'quarantine' then 'reject'

    • Common mistakes

  • Jumping straight to reject (blocks legitimate email)
  • Forgetting third-party senders (Mailchimp, HubSpot)
  • Not having SPF or DKIM first

    • The difference between a record that only watches and one that actually enforces:

    _dmarc.yourdomain.comDMARCno protection
    v=DMARC1; p=none
    _dmarc.yourdomain.comDMARCprotected
    v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s
    ShareTwitterLinkedInEmail

    Ready to check your domain?

    A graded scan across six surfaces in about 2 minutes. Free, no signup required.

    Check your DMARC →