Is your DMARC record actually stopping spoofing?

What DMARC does

Anyone can put your domain in the From line of an email. SPF and DKIM let receivers check whether a message really came from a server you approve, but on their own they don't say what to do when that check fails, and SPF doesn't even look at the From address people see. DMARC (Domain-based Message Authentication, Reporting and Conformance) closes that gap.

A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the domain in the visible From address. If it fails, your DMARC policy tells the receiver to deliver it anyway, send it to spam, or reject it. DMARC also asks receivers to send you reports, so you can see who is sending email as your domain.

Reading a DMARC record

DMARC lives in a TXT record at _dmarc. in front of your domain. A typical record looks like this:

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"

• v=DMARC1: required, and must come first.
• p: the policy. none only monitors, quarantine sends failing mail to spam, reject refuses it outright.
• rua: where receivers send daily aggregate reports (XML files that list the servers sending as your domain and whether they passed).
• sp: an optional separate policy for subdomains. Without it, subdomains follow p.
• pct: the percentage of failing mail the policy applies to. It defaults to 100.
• adkim / aspf: alignment mode. Relaxed (r, the default) lets mail.example.com align with example.com; strict (s) needs an exact match.

Why p=none isn't protection

Most domains that have DMARC at all are stuck on p=none. It's the right place to start, because it collects reports without affecting delivery, but it tells receivers to deliver spoofed mail as normal. If your record says p=none, a criminal can still send invoices "from" your domain and your policy asks for them to be delivered. Our free check flags p=none for exactly this reason.

Moving from none to reject without losing email

1. List everything that sends email as you. Your mailbox provider (Microsoft 365, Google Workspace), plus newsletters, invoicing, CRM, help desk and website contact forms.
2. Get SPF and DKIM passing for each one. See our SPF guide and DKIM guide. DKIM matters most, because it survives forwarding.
3. Publish p=none with a rua address and read the reports for two to four weeks. Any legitimate sender that fails shows up there.
4. Move to p=quarantine once your own services pass. You can use pct=25 first to apply it to a quarter of failing mail.
5. Move to p=reject when the reports show nothing legitimate failing. Keep reading the reports occasionally, because new services get added.

Domains that never send email are easier: publish v=DMARC1; p=reject straight away, alongside an SPF record of v=spf1 -all.

Do I need DMARC if I'm a small business?

Yes. Since 2024 Google and Yahoo have required DMARC from anyone sending more than 5,000 messages a day to their users, and Microsoft followed for Outlook.com in 2025. Smaller senders aren't forced to have it, but they are exactly who invoice fraud targets, and without DMARC there is nothing telling Gmail or Outlook to stop a fake email from your exact domain.

What DMARC doesn't cover

DMARC protects your exact domain. It doesn't stop lookalike domains (examp1e.com) or a fake display name on a free webmail account. Staff training and a clear rule for confirming payment changes by phone still matter.