Email was designed without any way to prove who sent a message. That's why a scammer can send an email that appears to come from your accounts team, asking a client to pay an invoice into a new bank account. Your client sees your name, your logo and your domain, and has no reason to doubt it.
This is called email spoofing, and the fix is a short DNS record called DMARC, working together with SPF and DKIM.
The three records, in one line each
- SPF lists the servers allowed to send email for your domain.
- DKIM adds a digital signature that proves a message wasn't altered and really came from you.
- DMARC tells receiving servers what to do when a message fails those checks, and sends you reports about who is using your domain.
SPF and DKIM on their own only describe your genuine email. Without DMARC, nothing tells Gmail or Outlook to stop the fakes. If your emails are also landing in spam, our guide on why business email lands in spam covers the delivery side.
Step 1: list everything that sends email for you
Before changing anything, write down every service that sends email using your domain: your mailbox provider (Google Workspace or Microsoft 365), your website's contact form, your CRM, invoicing or accounting software, newsletters and any helpdesk tool. Forgotten senders are the main reason a DMARC rollout blocks genuine email.
Step 2: fix SPF and switch on DKIM
Make sure you have exactly one SPF record and that it includes every service on your list. Then switch on DKIM in your mailbox admin console and in each service that supports it. Many services need you to add their own DKIM record to your DNS.
Step 3: start DMARC in monitoring mode
Publish a DMARC record with the policy set to none and a reporting address. Nothing is blocked at this stage. Instead, mail providers start sending you daily reports showing every server that sent email using your domain, and whether it passed or failed.
Step 4: read the reports and fix the gaps
For two to four weeks, look for genuine services that fail. Each one needs to be added to SPF or given a DKIM key. Anything you don't recognise that is failing is likely someone pretending to be you.
Step 5: move to quarantine, then reject
Once your own email passes consistently, change the policy to quarantine, so failing messages go to spam. After another few weeks without problems, move to reject, so fake emails are refused outright. At this point, most email spoofing of your exact domain stops.
What DMARC doesn't do
DMARC protects your exact domain. It doesn't stop look-alike domains, such as a spelling with one letter changed, or messages sent from free email accounts using your company name. Staff awareness training and a simple rule, such as always confirming bank-detail changes by phone, cover those gaps.
The short version
Most businesses can reach full DMARC enforcement in four to eight weeks, with no disruption, if the rollout is done in stages. Our cyber security team sets up and monitors SPF, DKIM and DMARC as part of our email security service, and our free security health check shows where your domain stands today. For mailbox set-up and day-to-day email, see our business email service.