Do small businesses need DMARC?
If you send fewer than 5,000 emails a day, no mail provider requires DMARC from you yet. It is still worth setting up, because it is the only one of the three email records that can tell receiving servers to refuse email forged from your domain. Here is what the rules say and how to switch it on safely.
- Required for bulk senders since 2024
- Free to publish
- Safe to start in watch-only mode
- Works with Microsoft 365 and Google Workspace
What the rules actually say.
Since 1 February 2024, Google has required anyone sending more than 5,000 messages a day to Gmail addresses to publish a DMARC record, alongside SPF and DKIM. The weakest policy, p=none, is enough to meet the rule. Yahoo brought in matching rules at the same time.
Microsoft followed on 5 May 2025 for Outlook.com, Hotmail and Live addresses: domains sending more than 5,000 messages a day need SPF, DKIM and DMARC, or their email is rejected.
Below 5,000 a day, Google asks every sender for SPF or DKIM, but not DMARC. A shop, a practice or a charity sending a few dozen emails a day is not breaking any rule without it.
That is the rule. Whether you should have it is a different question.
What DMARC does that the others don’t.
SPF lists the services allowed to send email for your domain. DKIM signs each message so the receiver can check it came from one of them. Both are useful, but neither one tells a receiving server what to do with a message that fails. A forged email claiming to be from your accounts address can fail both checks and still be delivered.
DMARC closes that gap in two ways:
- It checks that the domain your customer sees in the From line is the same domain that passed SPF or DKIM. Without it, a scammer can pass SPF on a domain they own and still put your name in the From line.
- It publishes your instruction for failures: deliver anyway, send to spam, or refuse.
It also sends you reports. Each day, mail providers that support reports, including Google and Yahoo, send a summary of the servers that sent their users email using your domain, and whether each passed. For a small business that is often the first time anyone has seen a full list of what sends email in its name: the mailbox, the accounts software, the website’s contact form, the newsletter tool, and occasionally something nobody recognises.
Reasons to set it up, and its limits.
What it gives you
- Once the policy is
quarantineorreject, a fake invoice sent from your exact domain is sent to spam or refused by the mail providers that check DMARC - Reports that show every service sending as your domain, including ones that are set up wrongly
- Your domain already has the DMARC record the bulk-sender rules ask for, if your sending ever grows past 5,000 a day
- The UK’s National Cyber Security Centre recommends it for organisations
What it does not do
- It does not stop look-alike domains, such as your name with one letter changed
- It does not filter the phishing that arrives in your own inbox
- At
p=noneit only reports. It protects nobody until the policy is tightened - It does not fix a missing SPF or DKIM record. It depends on them
Switching it on without breaking anything.
-
Check SPF and DKIM first
DMARC passes when SPF or DKIM passes for your own domain. Make sure your mailbox provider signs with DKIM for your domain, and that every other service sending as you is in SPF. Our SPF, DKIM and DMARC guide covers both.
-
Publish a watch-only record
A TXT record at
_dmarcon your domain:v=DMARC1; p=none; rua=mailto:followed by an address for reports. This changes nothing about delivery. -
Read the reports
They arrive as XML attachments. A report service turns them into a list of senders. Add any genuine service that is failing to SPF and DKIM.
-
Tighten the policy
When everything genuine passes, move to
p=quarantine, then top=reject. Only then does DMARC stop forged email.
What can go wrong.
Moving straight to p=reject before reading any reports is how businesses block their own invoices. An accounts package or booking system that sends as your domain, but is not in SPF and does not sign with DKIM, fails DMARC, and its messages are refused.
Forwarded email can fail SPF, because the forwarding server is not on your list. DKIM signatures survive forwarding as long as the message is not changed, which is one reason to make sure DKIM is set up and not only SPF.
Leaving the record at p=none for good is the other problem. It meets the bulk-sender rule and produces reports, but it never stops anyone sending email as you.
DMARC questions
Ask us something else →Does DMARC cost anything?
The record itself is free: it is a line of text in your domain’s DNS. Report services that make the daily reports readable range from free tiers to paid plans.
How do I know if I already have DMARC?
Look up the TXT record for _dmarc.yourdomain.co.uk with nslookup on Windows or dig on a Mac. No result means no DMARC. Or ask us for a free check.
Will DMARC get my emails out of spam?
It can help receivers trust genuine email from your domain, but spam filtering looks at much more than authentication. If your email is landing in spam now, the cause may be elsewhere.
Should I use quarantine or reject?
Quarantine first, so any mistake sends genuine email to spam rather than refusing it. Move to reject once the reports have been clean for a few weeks.
Is this part of IT Care?
Yes. Every IT Care plan sets up SPF, DKIM and DMARC and keeps an eye on the reports.
We can set it up for you.
Send us your domain. We will check SPF, DKIM and DMARC for free and tell you what needs fixing before the policy can be tightened.
Get a free email check →