DMARC
A DNS record that tells inboxes what to do with email that fails SPF and DKIM checks, and can send you reports about who is sending as your domain.
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It’s a TXT record in your DNS that builds on SPF and DKIM. It tells receiving inboxes what to do with email that claims to be from you but fails those checks, and it can send you reports about what’s being sent using your domain.
A DMARC policy has three levels:
- p=none: just monitor and report. Nothing is blocked.
- p=quarantine: send failing mail to spam.
- p=reject: refuse failing mail entirely.
Why it matters to a small business
DMARC is your main defense against scammers sending email that looks exactly like it came from your domain, such as fake invoices to your customers. It also helps deliverability: Gmail’s sender guidelines require a DMARC record for bulk senders.
Moving straight to “reject” can block your own legitimate email if a sending service isn’t set up correctly. The safe approach is to start with “none”, read the reports, fix any gaps, then tighten.
Example
A contractor’s customers receive fake invoices from his address. His email account is clean, so it’s spoofing. He confirms SPF and DKIM are correct for all his real sending services, then moves DMARC from “none” to “quarantine” and later to “reject”. Inboxes that honor DMARC now filter the fakes.
Learn more
- What are SPF, DKIM and DMARC?
- Someone is sending emails that look like they’re from me
- The DMARC standard at dmarc.org
- Check your domain with the free email deliverability checker.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.