Quick answer: DMARC is a DNS record that tells other mail servers what to do with email that claims to be from your domain but fails authentication: deliver it, put it in spam, or reject it. It works with two other records, SPF and DKIM. In our Yorkshire email security benchmark, 59% of healthcare and care providers had no DMARC record at all, and only 17% had one set to actually block fakes.
You do not need to be technical to understand DMARC, and you do not need to set it up yourself. But knowing what it does means you can ask the right questions of whoever manages your email.
Why email needs DMARC at all
Email was designed decades ago without any way to prove who sent a message. The “From” address is just text, and anyone can type anything there. SPF, DKIM and DMARC were added later to close that gap. Together they let a receiving mail server check that a message really came from you.
SPF, DKIM and DMARC in one minute
- SPF (Sender Policy Framework) is a list of the servers allowed to send email for your domain, such as Microsoft 365, your booking system and your newsletter tool.
- DKIM (DomainKeys Identified Mail) adds a digital signature to every message, so the receiver can check it was not forged or altered.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It says what to do when a message fails, and asks receivers to send you reports about who is sending email as you.
The three DMARC policies
| Policy | What happens to fakes | When to use it |
|---|---|---|
| p=none | Delivered as normal. You get reports. | The first two to four weeks, while you find every genuine sender |
| p=quarantine | Sent to spam or junk | Once reports show your genuine mail passes |
| p=reject | Refused outright | The goal. Fakes are not delivered at all |
In our benchmark, 24% of providers had DMARC set to p=none and had stopped there. That is a good start, but it does not stop a single fake email.
Setting it up in Microsoft 365
- Sign in to the Microsoft Defender portal and go to Email & collaboration, Policies & rules, Threat policies, then Email authentication settings.
- On the DKIM tab, select your domain. Microsoft shows two CNAME records (selector1 and selector2). Add both at your DNS provider.
- Once they have been published, return to the same screen and enable DKIM signing for the domain.
- Check your SPF record includes Microsoft 365 and every other service that sends as you.
- Add a DMARC TXT record at
_dmarc.yourdomain.co.uk, for examplev=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk.
Setting it up in Google Workspace
- In the Admin console go to Apps, Google Workspace, Gmail, then Authenticate email.
- Generate a new DKIM record and publish it as a TXT record at your DNS provider (usually
google._domainkey). - Return to the console and click Start authentication.
- Check your SPF record includes Google and your other senders, then add the DMARC record as above.
Menu names change from time to time, so if a step does not match what you see, your IT provider will know where it has moved.
Moving safely from monitor to reject
The reports DMARC sends are XML files that are hard to read by eye. A free or low-cost DMARC reporting service turns them into a simple list of who is sending as you. Look for anything genuine that is failing, such as a booking system, payment provider or newsletter tool, and get it added to SPF or set up with DKIM. When genuine mail passes consistently, move to p=quarantine, wait another couple of weeks, then move to p=reject.
Is it really worth it?
Phishing is by far the most common cyber attack on UK businesses: 38% experienced it in the last year according to the government’s Cyber Security Breaches Survey 2025/26. The National Cyber Security Centre recommends every organisation publishes SPF, DKIM and DMARC and moves DMARC to quarantine or reject. Gmail, Yahoo and Microsoft now expect senders to authenticate their email, so it also helps your genuine messages arrive. See why appointment reminders end up in spam.
FAQs
How long does DMARC take to set up?
The records take minutes to add. The monitoring period before you enforce usually takes two to four weeks.
Can DMARC break our email?
Only if you jump straight to reject without checking your genuine senders. Starting at p=none avoids that.
Does DMARC cost anything?
The records themselves are free. Some organisations pay a small monthly fee for a reporting service that makes the reports readable.
How do I check what we have now?
Our free email security check reads your SPF, DKIM and DMARC records and explains them in plain English.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and regulated small organisations. We check your website, cookies, email security and governance paperwork, and tell you plainly what to fix and who should fix it. We do not certify or guarantee compliance, and nothing in this article is legal advice. Read the full Yorkshire email security benchmark, or head back to the blog.
Want to see where your domain stands?
Run the free email check in seconds. If you want the full picture, book a free external audit.
Run the free email checkNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.