Free guide

What is DMARC, and do I need it?

DMARC tells inboxes what to do with email that fakes your domain. What it is, why Gmail, Yahoo and Outlook now expect it, and how to set it up safely.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails authentication, and where to send reports about it (RFC 7489).

Why it matters now

  • Since February 2024 Google requires anyone sending 5,000+ messages a day to Gmail to have SPF, DKIM and a DMARC record (Google); Yahoo has matching requirements (Yahoo).
  • Microsoft began enforcing the same for high-volume senders to Outlook.com in May 2025 (Microsoft).
  • Without DMARC enforcement, anyone can send email that shows your domain in the From line. That is how many fake invoice scams work: business email compromise cost US$3.05B in reports to the FBI in 2025 (FBI IC3).

How SPF, DKIM and DMARC fit together

  • SPF: a list of servers allowed to send mail for your domain.
  • DKIM: a cryptographic signature added to each message.
  • DMARC: checks that SPF or DKIM passes and matches the From domain, then applies your policy: none (report only), quarantine (spam folder) or reject.

A starter record

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

The UK NCSC recommends working towards p=reject once your reports show all legitimate mail passing (NCSC).

Set it up in 5 steps

  1. Run our free domain scan to see what you already have.
  2. Make sure SPF lists every service that sends for you (Microsoft 365, Google Workspace, your CRM, invoicing tool).
  3. Turn on DKIM in each of those services.
  4. Publish DMARC at p=none and read the reports for a few weeks.
  5. Move to quarantine, then reject.

Related: how to stop someone spoofing your email domain.

Questions

Do I need DMARC if I’m a small business?

Yes if you send email from your own domain. It costs nothing to publish and it is the only standard way to tell receiving servers to reject mail that fakes your domain.

Will DMARC stop my emails being delivered?

Not at p=none: that policy only collects reports. Problems happen when you jump to reject before every legitimate sender passes SPF or DKIM.

Is DMARC the same as SPF and DKIM?

No. SPF and DKIM authenticate a message; DMARC checks they line up with the visible From domain and says what to do when they don’t.

Check your domain in 30 seconds

Our free scan reads your SPF, DMARC, DKIM and MX records and checks about 50 lookalike variants of your domain. No signup needed for the summary.

Scan my domain freeEmail & domain protection

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.