What is DMARC?

DMARC is a short DNS record that tells email providers what to do with messages that claim to come from your domain but fail authentication checks. It can ask them to deliver those messages, send them to spam, or reject them, and it sends you reports showing who is sending email using your business name.

Anyone can type your business name into the "From" line of an email. DMARC is how you tell Gmail, Outlook and other providers what to do when that happens, so a fake invoice "from" your business is more likely to land in spam instead of a customer's inbox.

How does DMARC work?

DMARC is a single TXT record published in your domain's DNS at the name _dmarc. A simple one looks like this: v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com.

When an email arrives claiming to be from yourbusiness.com, the receiving provider checks two things. Did it pass SPF or DKIM? And does the domain that passed match the "From" address people see? If neither check lines up, the provider follows your policy:

• p=none: monitor only. Deliver as normal, but send you reports.
• p=quarantine: treat it as suspicious, usually by sending it to spam.
• p=reject: refuse the message.

The rua part is the address where providers send daily summary reports.

Why does DMARC matter for small businesses?

Scammers like impersonating small businesses because customers and vendors already trust their emails. Fake payment requests, changed bank details and phishing links are all easier when your domain has no DMARC policy. This is a common route into business email compromise.

DMARC also helps your real email. Large providers increasingly expect senders to authenticate their mail, and a domain with SPF, DKIM and DMARC in place looks more trustworthy to spam filters.

How do I check or set up DMARC?

Start by checking what you have today with our free DMARC checker. It shows whether you have a record, what the policy is, and whether reports are going anywhere.

If you have no record, or your policy is stuck at p=none, follow our guide to fixing "DMARC policy not enabled". It covers GoDaddy, Cloudflare, Namecheap, Squarespace, Google Workspace and Microsoft 365. If your domain is on GoDaddy, our GoDaddy DMARC guide is a dedicated walkthrough.

The safe path is to start at p=none, read the reports for a few weeks, then move to p=quarantine and eventually p=reject.

DMARC vs SPF and DKIM

They're a team. SPF lists which servers may send your email. DKIM signs each message so it can't be forged or altered. DMARC ties them to the visible "From" address and tells providers what to do when the checks fail. You need at least one of SPF or DKIM working before DMARC can do its job, and ideally both. For the full picture, read SPF, DKIM and DMARC explained.

To see all three at once, run a free CyberVigil scan. It checks your SPF, DKIM and DMARC alongside your website settings.