What is DMARC and Why Does Your Business Need It?
What is DMARC? How it stops email spoofing and protects deliverability
DMARC is a record in your domain's DNS that tells mail servers what to do with email that claims to come from your business but fails SPF or DKIM checks: deliver it, send it to junk or reject it. It also sends you reports showing everyone who sends email as your domain.
Somebody can send an email that looks exactly like it came from your business. Your domain, your name, your reputation. It lands in a customer's inbox asking them to pay an invoice to a new bank account, and there is nothing about it that looks wrong. That is spoofing, and DMARC is the mechanism that stops it.
What is DMARC? The short answer
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a small record you publish in your domain's DNS. It does two jobs. First, it tells every receiving mail server in the world what to do with email that claims to be from your domain but fails authentication: deliver it anyway, send it to junk, or reject it outright. Second, it makes those servers report back to you, so you can see exactly who is sending email as your domain, legitimate or not.
DMARC sits on top of two older checks, SPF and DKIM, which do the actual verifying. If you want the full picture of how the three work together, read SPF, DKIM and DMARC Explained in Plain English.
Why it matters more than it used to
Two reasons.
• The big providers now expect it. Since 2024, Google, Yahoo and Microsoft have tightened requirements for inbound mail. Domains without DMARC increasingly find their legitimate email treated as suspicious. If your deliverability has slipped and you can't explain why, this is the first place to look. Our guide on why emails go to spam covers the other causes.
• Invoice fraud runs on spoofing. Criminals don't need to hack your systems to impersonate you. Without an enforced DMARC policy, they can send as your exact domain and most receiving servers will let it through. UK businesses lose millions to payment diversion fraud every year, and the spoofed invoice is its favourite vehicle.
The three policy levels
• p=none. Monitoring only. Failing mail is still delivered, but you receive reports. The right place to start, the wrong place to stay.
• p=quarantine. Failing mail goes to junk.
• p=reject. Failing mail is refused entirely. This is full protection: nobody can send as your domain and reach an inbox.
Here is the uncomfortable statistic from our own audits: most businesses that have DMARC are stuck at p=none, often for years. They believe they're protected. They're not. The record is there, the reports pile up unread, and spoofed mail still gets delivered. Not sure which camp your domain is in? Scan your domain and find out in 20 seconds.
What the reports actually tell you
DMARC reports arrive daily as XML files from every major mail provider. Decoded, they show every IP address and service sending email as your domain. Businesses are routinely surprised by what turns up: the CRM nobody registered, the invoicing tool a supplier set up, a marketing platform from three years ago, and sometimes senders in countries you've never traded with. You cannot safely move to reject until every legitimate sender in that list passes authentication, which is why the reports matter and why ignoring them stalls the whole project. Reading them is not a one-off task either: it is how you find out, before your customers do, that a sender you'd forgotten about has started failing.
How to get it done
If you run Microsoft 365, our step-by-step DMARC setup guide walks through the whole thing, from SPF and DKIM to publishing the record. Budget 6 to 8 weeks to do it properly, and don't expect the work to end once you enforce: the reports need checking for as long as the record exists, because a forgotten or newly added sender that starts failing at p=reject doesn't get quietly junked, its mail is refused outright.
If you'd rather it were simply handled, Flo Verified Mail is our managed DMARC service: we set everything up, check the reports every day, indefinitely, and take your domain to full enforcement so your email arrives and nobody else can send as you. It is part of how we think about email deliverability as a whole, not a box-ticking exercise.
DMARC questions we’re asked most
Is DMARC the same as SPF and DKIM?
No. SPF and DKIM do the actual checking. DMARC sits on top of them, tells receiving mail servers what to do with email that fails those checks, and sends you reports on everything sent as your domain.
Is p=none enough to protect my domain?
No. At p=none failing mail is still delivered, so spoofed email still reaches inboxes. It is the right place to start, but full protection only comes at p=reject.
How long does it take to set up DMARC properly?
Budget 6 to 8 weeks to reach enforcement, and keep checking the reports for as long as the record exists, because a forgotten sender that starts failing at p=reject has its mail refused.
Further reading
What does DMARC stand for?
What is the difference between SPF, DKIM and DMARC?
Which DMARC policy should my business use?
Does DMARC affect email deliverability?
What do DMARC reports show?
Schedule a Free IT Audit & Cost Breakdown
Want it fixed and kept that way? From just £14 a month, we verify your domain and monitor it 24/7, so your email lands and nobody else can send as you.
