DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email security standard that tells receiving servers how to handle messages that claim to come from your domain but fail authentication. It works alongside SPF and DKIM to stop criminals from spoofing your domain — sending fake invoices or CEO-impersonation emails that appear to come from your own business.
What DMARC is and why it exists
Email was never designed to prove who sent it. The protocol that carries mail — SMTP (Simple Mail Transfer Protocol) — lets anyone type any address into the 'From' field. That is exactly how a scammer sends an invoice that looks like it came from your finance team.
DMARC closes that gap. It is a published DNS (Domain Name System) record that does two things: it instructs receiving servers what to do with mail that fails authentication checks, and it asks those servers to send you reports on who is sending email using your domain. Nothing about your inbox changes for staff — the policing happens at the receiving end, before the message lands.
The standard has existed since 2012 and is now effectively mandatory for bulk senders. Google and Yahoo require DMARC for anyone sending volume mail to their users, and Microsoft 365 honours it too. For UK businesses that means DMARC is no longer optional housekeeping — it affects whether your legitimate email reaches customers at all.
How SPF, DKIM and DMARC work together
DMARC does not work alone. It sits on top of two older checks, SPF and DKIM, and ties them to your visible sending domain. Understanding the three together is the key to getting this right.
SPF (Sender Policy Framework) is a DNS list of the servers and services allowed to send email for your domain — your Microsoft 365 tenant, your CRM, your accounting tool. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message, proving it was not altered in transit and genuinely came from an authorised source.
DMARC is the enforcement layer. It checks that SPF or DKIM passed and that the domain they authenticated matches the one shown to the recipient — a rule called alignment. If a message fails, DMARC tells the receiver to deliver, quarantine or reject it, according to the policy you publish.
- SPF: lists which servers may send mail for your domain
- DKIM: cryptographically signs each message to prove integrity
- DMARC: enforces a policy and reports on failures, tying it to your visible domain
What happens without DMARC: spoofing and BEC
Without an enforced DMARC policy, anyone can send email that appears to come from your exact domain and most receiving servers will deliver it. That is the engine behind business email compromise (BEC) — one of the most costly scams affecting UK firms.
A typical attack: a buyer receives an email that looks like it came from your accounts team, quoting a real order number and asking them to pay a 'new' bank account. Because the From address is genuinely your domain, there is no misspelling to spot. The money is gone before anyone phones to check.
DMARC does not fix every phishing route — lookalike domains and compromised mailboxes are separate problems addressed by email security and identity protection. But it decisively shuts down the exact-domain spoofing that BEC and fake-invoice fraud rely on.
Setting a DMARC policy without blocking real mail
The biggest risk with DMARC is switching to enforcement too quickly and blocking your own legitimate email — the newsletter platform, the recruitment tool, the e-signature service that were never added to SPF or DKIM. Done carelessly, DMARC can silence mail your business depends on.
The safe route is a phased rollout. You start at p=none, which enforces nothing but collects reports showing every service sending as your domain. You then authenticate each legitimate sender properly before tightening the policy.
A sensible sequence looks like this:
- p=none — monitor only; gather reports and find all legitimate senders
- p=quarantine — failing mail goes to junk, usually at a small percentage first
- p=reject — failing mail is blocked outright, the end goal for full protection
- Add alignment and reporting addresses so you keep visibility at every stage
Why managed DMARC beats DIY
In theory you can publish a DMARC record yourself in an afternoon. In practice, the hard part is what comes after. DMARC reports arrive as raw XML files from dozens of mail providers every day — unreadable without tooling and easy to abandon after week one.
Managed DMARC turns those reports into plain dashboards, flags new or suspicious senders, and guides the move from monitoring to full enforcement without cutting off real mail. It keeps SPF within its ten-lookup limit — a technical cap that silently breaks SPF when you add too many services — and maintains DKIM keys as providers rotate them.
For most UK businesses the maths is simple. A botched DIY rollout that blocks invoices or payroll notifications costs far more than managed oversight. We run this as part of a wider cyber security programme, so DMARC sits alongside EDR, MDR and Cyber Essentials rather than as an isolated DNS tweak.
How to check your current DMARC status
You can get a rough picture in minutes. Look up your domain's DNS TXT record at _dmarc.yourdomain.co.uk. If nothing returns, you have no DMARC at all and your domain is spoofable today. If you see p=none, you are monitoring but not yet protected — a very common state for UK firms that set it up and stopped.
Also check your main SPF record exists and lists every service you send from, and confirm DKIM signing is switched on in Microsoft 365 or Google Workspace. All three need to be present and aligned for DMARC enforcement to be both safe and effective.
If you are unsure what the records mean, or you have p=none and want to reach p=reject without breaking anything, talk to our team. We will audit your current records, map every legitimate sender and set out a clear path to full compliance.