What is DMARC and does my business need it?

If someone can send an email that appears to come from your domain, they can pretend to be you. They might send a fake invoice to a client, a "change of bank details" message to a supplier, or a password reset lure to your own staff. DMARC is one of the main tools that makes this harder.

This guide explains what DMARC is and whether your business needs it.

What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a short text record that you publish in your domain's DNS, at the name _dmarc.yourdomain.co.uk. The standard is documented in RFC 7489.

A DMARC record does two jobs:

1. It tells receiving mail servers what to do with email that claims to be from your domain but fails authentication checks. You choose a policy: none (take no action, just report), quarantine (treat it as suspicious, usually by sending it to spam) or reject (refuse it).
2. It asks those servers to send you reports. These aggregate reports show which systems are sending email using your domain name and whether that email passed or failed authentication.

A simple starting record looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]

How DMARC works with SPF and DKIM

DMARC builds on two older checks.

• SPF (Sender Policy Framework) is a DNS record listing the servers that are allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each email, which the receiving server checks against a public key published in your DNS.

On their own, SPF and DKIM have a gap: they can pass for a domain that is different from the one your recipient sees in the "From" line. DMARC closes that gap with a rule called alignment. To pass DMARC, an email must pass SPF or DKIM, and the domain that passed must match the domain in the visible From address.

That is why the three are usually mentioned together. DMARC does not replace SPF and DKIM; it relies on them.

Does my business need DMARC?

If your business sends email from its own domain, the answer is almost always yes. Here is why.

It is part of UK government guidance. The National Cyber Security Centre (NCSC) recommends that organisations configure SPF, DKIM and DMARC on their domains, and that they protect all of their domains, including where they use common cloud email providers.

Large mailbox providers expect it. Google's email sender guidelines require all senders to Gmail accounts to set up SPF or DKIM. Since February 2024, anyone sending 5,000 or more messages a day to Gmail accounts must also have SPF, DKIM and a DMARC record, with a policy of at least none. Yahoo publishes similar requirements. Google recommends SPF, DKIM and DMARC for all domains, whatever their volume.

It gives you visibility. DMARC reports often reveal services you had forgotten send email for you: a booking system, an accounting package, a newsletter tool. Knowing this helps you keep your email set-up tidy.

Domains that never send email need it too. If you own a domain that is not used for email, a DMARC record with p=reject tells receivers that any email claiming to come from it should be refused.

How to set up DMARC without breaking your email

The biggest risk with DMARC is moving to a strict policy before all of your legitimate email is authenticated. The NCSC recommends a gradual approach, which in summary looks like this:

1. Check SPF and DKIM first. Make sure every service that sends email for you is included in SPF and signs with DKIM. Google advises that SPF and DKIM should be in place for at least 48 hours before you turn on DMARC.
2. Publish a p=none policy. This is a monitoring phase. It does not change how your email is delivered, but reports start arriving, usually within 24 hours.
3. Review reports for at least two weeks. Look for legitimate services that fail SPF or DKIM and fix them. DMARC reports are XML files, so a reporting tool makes them much easier to read.
4. Move to p=quarantine. Start with a small percentage using the pct tag, then increase it to 100. The NCSC suggests monitoring for at least four weeks at 100% before moving on.
5. Move to p=reject. Again, increase gradually and keep monitoring. This is the policy that gives the strongest protection against spoofing.

How to check your current DMARC record

You can look up your DMARC record with any DNS lookup tool by querying the TXT record at _dmarc.yourdomain.co.uk. The NCSC also offers a free Email Security Check that tests your domain's anti-spoofing and email privacy settings using public information. Only check domains you own or are authorised to check.

When you look at the result, ask three questions:

• Is there a DMARC record at all?
• What is the policy: none, quarantine or reject?
• Is there a rua address, and is anyone actually reading the reports?

Common mistakes

• Stopping at p=none forever. It gives visibility but no protection against spoofing.
• Sending reports to a mailbox nobody checks. Reports are only useful if someone reviews them.
• Forgetting third-party senders. New tools are added over time, and each one needs SPF and DKIM set up.

Summary

DMARC lets you tell the world how to treat email that pretends to be from your domain, and shows you who is sending email in your name. If your business uses email, it is worth setting up, carefully and in stages. It will not stop every phishing attempt, but it removes one of the easiest ways to impersonate you.

Haj Tech's free one-off security check looks at your SPF, DKIM, DMARC and MX records, along with your website and domain, and explains the results in plain English. Request one for a domain you are authorised to have checked at hajtech.uk.

Sources

• NCSC, Email security and anti-spoofing
• NCSC, Implement a DMARC policy of 'none'
• NCSC, Monitor, analyse and update your DNS records
• NCSC, Mark spoof emails as spam
• NCSC, Reject spoof emails
• NCSC, Check your email security
• Google, Email sender guidelines
• Google, Email sender guidelines FAQ
• Google Workspace, Set up DMARC
• Yahoo, Sender best practices
• IETF, RFC 7489 (DMARC)