DMARC for Small Business: A simple guide

2025-12-15

You've probably heard that you need DMARC to protect your email. You may have also heard it's complicated, technical, and requires an IT team to implement.

Here's the truth: DMARC is straightforward once you understand what it actually does. And for small businesses, it might be the single most important security measure you're not using.

Let's break it down.

---

What DMARC actually does

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. In plain language, it's a rule you publish that tells email servers worldwide: "Here's how to verify emails from my domain, and here's what to do if verification fails."

Think of it like caller ID for email. When someone calls from a spoofed phone number, you have no way to verify who's really calling. DMARC gives email the verification that phone calls lack.

Without DMARC, anyone can send emails that appear to come from your domain. Your accountant's email address, your CEO's email address, your company's support address, all can be impersonated with no technical barrier.

With DMARC, receiving email servers check whether incoming messages are actually from you. Fakes get flagged, quarantined, or rejected entirely.

---

The three-part foundation

DMARC works with two other protocols: SPF and DKIM. Think of them as a three-legged stool, you need all three for stability.

SPF (Sender Policy Framework) is a list you publish saying "these specific servers are allowed to send email for my domain." When an email arrives claiming to be from you, the receiving server checks whether it came from an approved server. If not, SPF fails.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing emails. It's like a wax seal on a letter, it proves the message wasn't tampered with after you sent it, and it came from someone with access to your private key.

DMARC ties these together and adds instructions. It tells receiving servers: "Check SPF and DKIM. If both fail, here's what I want you to do with the message. And send me reports about what you're seeing."

---

Why small businesses need this

"We're too small to be targeted" is the most dangerous assumption in email security.

Attackers specifically seek out domains without DMARC because they're easy to spoof. A domain without DMARC is like a house with the front door unlocked,you might not be targeted because you're special, but because you're accessible.

Here's what's at stake:

Your clients receive phishing emails "from you." Imagine your best client gets an invoice from your domain with fraudulent payment details. They pay. You never see the money. They blame you.

Your vendor relationships get exploited. Attackers research your business relationships through LinkedIn and public records, then impersonate your partners to request sensitive information or payment changes.

Your own emails get filtered as spam. Major email providers increasingly penalize domains without authentication. Your legitimate messages may land in spam while spoofed versions reach inboxes.

Your reputation suffers quietly. You may never know that spoofed emails using your domain are circulating, until a client mentions they "got a weird email from you."

---

The DMARC record explained

A DMARC record is a simple text entry you add to your domain's DNS settings. Here's what a basic one looks like:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Let's decode that:

v=DMARC1 identifies this as a DMARC record.

p=none is the policy, what to do with emails that fail authentication. Options are:

• none: Take no action, just send me reports (monitoring mode)
• quarantine: Send failures to spam
• reject: Block failures entirely

rua=mailto: specifies where to send aggregate reports about emails using your domain.

That's the foundation. There are additional options for more granular control, but many small businesses operate perfectly well with these basics.

---

Implementation: the safe approach

Here's the process that minimizes risk:

Step 1: Check your current state

Before adding anything, see what you have. Search for "DMARC lookup" online and enter your domain. You'll see whether records exist for DMARC, SPF, and DKIM.

Many small businesses discover they have partial configurations, perhaps SPF exists but DKIM doesn't, or records exist but are misconfigured.

Step 2: Inventory your Email senders

List every service that sends email using your domain name. Common ones include:

• Your email provider (Google Workspace, Microsoft 365, etc.)
• Your website (contact forms, notifications)
• Email marketing platforms (Mailchimp, ConvertKit, etc.)
• CRM systems (HubSpot, Salesforce, etc.)
• Accounting software (QuickBooks, FreshBooks, etc.)
• Helpdesk tools (Zendesk, Intercom, etc.)

Each of these needs to be properly configured for SPF and DKIM. Missing one means legitimate emails from that service might fail authentication.

Step 3: Configure SPF

Your SPF record lists all servers authorized to send email for your domain. It looks something like:

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

This example authorizes Google Workspace and Mailchimp. The -all at the end means "reject everything else."

Important: SPF has a 10-lookup limit. If you include too many services, it breaks. This is a common issue for growing businesses with many tools.

Step 4: Configure DKIM

DKIM requires generating a key pair and adding the public key to your DNS. Most email services provide step-by-step instructions:

• Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email
• Microsoft 365: Defender portal → Email authentication → DKIM
• Third-party services: Usually in settings under "Domain authentication" or "Email authentication"

Each sending service needs its own DKIM configuration.

Step 5: Deploy DMARC in monitoring mode

Start with a permissive policy that won't affect email delivery:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

This tells servers: "Check authentication and send me reports, but don't take action on failures yet."

Add this as a TXT record for _dmarc.yourdomain.com in your DNS settings.

Step 6: Analyze reports

Within days, you'll start receiving DMARC reports. These XML files contain data about every email sent using your domain:

• Which servers sent it
• Whether it passed SPF and DKIM
• What domain it claimed alignment with

The raw XML is dense. Many businesses use DMARC reporting services or tools to visualize this data. You're looking for:

• Legitimate emails that are failing (configuration issues to fix)
• Unknown sources sending as your domain (potential spoofing)
• The overall volume of authentication passes vs. failures

Step 7: Fix issues

Reports often reveal surprises. That old contact form you forgot about. The accounting software sending invoices without DKIM. The forwarded emails that break SPF.

Address each failure. Update SPF to include missing legitimate senders. Configure DKIM for services that lack it. Some failures (like email forwarding) may require accepting that certain messages will never fully authenticate.

Step 8: Gradually Enforce

Once legitimate emails consistently pass authentication, tighten your policy:

First, move to quarantine:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

Monitor for a few weeks. Check that nothing legitimate is landing in spam.

Then, move to reject:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com

At this point, spoofed emails using your domain will be blocked by receiving servers worldwide.

---

Common mistakes to avoid

Jumping straight to enforcement. Starting with p=reject before reviewing reports often blocks legitimate emails. Always start with p=none.

Forgetting a sending service. That marketing automation you set up three years ago? It's probably still sending emails without proper authentication.

Exceeding SPF limits. Too many include statements break SPF. If you're approaching the 10-lookup limit, consider consolidating services or using SPF flattening.

Ignoring reports. DMARC reports reveal ongoing spoofing attempts. Even after enforcement, review them periodically.

Setting and forgetting. When you add new tools or change email providers, authentication needs to be updated.

---

What if this seems like too much?

You're not wrong that this requires attention to detail. A misconfigured DNS record can break your email entirely.

Options for small businesses:

DIY carefully. Follow your email provider's documentation exactly. Test thoroughly before enabling enforcement.

Use your domain registrar's tools. Some registrars (like Cloudflare or Namecheap) offer guided DMARC setup.

Hire a specialist. For a one-time fee, a consultant can configure everything correctly.

Use a DMARC management service. These services handle reporting analysis and guide you through implementation.

The cost of proper implementation is far less than the cost of a successful spoofing attack against your clients.

---

Want to see where you stand? Ṣọ Email Security can analyze your domain's current DMARC, SPF, and DKIM configuration and show you exactly what's working, what's missing, and what's at risk. We detect spoofing attempts in real-time and help small businesses implement enterprise-grade email protection.

Check your domain's email security →