What Is DMARC, and Does Your Small Business Need It?

The problem it solves

Email was designed in a more trusting time. By default, anyone can send a message that says it is from accounts@yourcompany.com. Scammers know this. The classic move is a fake invoice or a "we changed our bank details" email that appears to come from you, sent to your own clients.

Your clients see your name and your address. They pay. By the time anyone notices, the money is gone, and the conversation becomes about whose fault it was.

What DMARC actually does

DMARC is one line of text in your domain's DNS settings. It tells every receiving mail server: "If an email claims to be from my domain but fails our authentication checks, here is what to do with it." The options are watch and report, send to spam, or reject outright.

It works alongside two other settings most businesses already have, often without knowing it: SPF, which lists the servers allowed to send your mail, and DKIM, which puts a tamper-proof signature on each message. Google Workspace and Microsoft 365 both support all three.

How to add it without breaking anything

Step one: monitor. Add DMARC in monitor mode. Nothing is blocked. Instead, mail providers start sending reports showing every service that sends email as you: your main mailbox, but also your billing system, your newsletter tool, your website contact form.

Step two: fix the stragglers. If the reports show a legitimate service failing the checks, it gets set up properly.

Step three: enforce. Once the reports are clean, usually after a week or two, switch to quarantine (send fakes to spam), and eventually to reject. From then on, fake email using your domain mostly stops reaching anyone.

Why it matters more every year

Google and Yahoo now require DMARC from businesses that send email in volume, and many cyber insurance questionnaires ask about it. More importantly, it protects the people who trust email from you. We added it this week for a law firm client whose domain had none, starting in monitor mode, with enforcement scheduled once the first reports come back clean.

Quick answers

Will adding DMARC break my email? Not if it is done in the right order. You start in monitor mode, which blocks nothing and only sends you reports. You turn on enforcement only after the reports show every service that legitimately sends your email is set up correctly.

Does DMARC cost anything? The record itself is free. Several free tools, including one from Cloudflare, will collect and summarize the reports for you.

Do I need SPF and DKIM too? Yes. DMARC builds on them. SPF lists the servers allowed to send your mail, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails both.

Keep reading

• How Much Do Managed IT Services Cost in Spokane? (2026) Real numbers: $50 to $150 per computer per month, what moves the price, and what to ask before you sign.
• Should You Let ChatGPT Read Your Business Website? Many small business websites quietly block AI crawlers. Here is what that costs you, and how to decide.
• All articles and guides