Guides › DMARC

DMARC record for small business: what to set

If your business sends email from its own domain (you@yourbusiness.com), you need three DNS records: SPF, DKIM and DMARC. SPF and DKIM prove that a message really came from a server you use. DMARC tells receiving mail servers what to do when a message claims to be from your domain but fails those checks, and where to send reports about it.

Without a DMARC record, anyone can put your domain in the From: line of a phishing email, and the receiving server gets no instructions from you about it. You also never find out it happened.

The record to publish first

Add one TXT record at your DNS provider (GoDaddy, Cloudflare, Squarespace, Network Solutions, or wherever your domain's DNS is hosted):

Host / Name:  _dmarc
Type:         TXT
Value:        v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com

Replace dmarc-reports@yourbusiness.com with a mailbox you actually own. Some DNS providers want the full name, _dmarc.yourbusiness.com, instead of just _dmarc.

That's the whole first step. p=none is monitoring mode: it doesn't block or junk anything, so it can't break your email. It starts the reports flowing so you can see who is sending as your domain.

You can build a record with the free DMARC record generator and confirm it's live with the SPF/DKIM/DMARC checker.

What each tag means

The two most common mistakes

1. p=none with no rua=. A record like v=DMARC1; p=none; is valid, but it does nothing useful: it doesn't protect you, and it doesn't send you any reports. Mail checkers mark it "present", so it looks done when it isn't. Add a rua= address.

2. Two DMARC records. If _dmarc.yourbusiness.com has two TXT records that start with v=DMARC1, receivers treat it as if you have no DMARC at all. Merge them into one. This often happens when a website builder or email provider adds its own record next to one you added earlier.

Make sure SPF and DKIM are in place too

DMARC passes when a message passes SPF or DKIM and the passing domain matches the domain in the From: line. So before you tighten the policy:

• SPF: one TXT record at the root of your domain starting with v=spf1, listing every service that sends as you (for example include:_spf.google.com for Google Workspace or include:spf.protection.outlook.com for Microsoft 365). Only one SPF record is allowed, and it must stay under 10 DNS lookups.
• DKIM: turned on in your email provider's admin console, with the DNS records it gives you published. See the guides for Google Workspace and Microsoft 365.

Don't forget the other tools that send email as your domain: your newsletter tool, invoicing or booking software, CRM, and website contact forms. Each needs SPF or DKIM set up for your domain, or it will fail DMARC once you enforce it.

Do I really need DMARC if I'm a small sender?

Gmail's sender guidelines require all senders to personal Gmail accounts to use SPF or DKIM, and senders of more than 5,000 messages a day to also publish DMARC (a p=none policy is acceptable). Most small businesses are well under 5,000 a day, so DMARC isn't strictly required for them. Google still recommends setting up SPF, DKIM and DMARC for every domain, and DMARC reports are the only way to see who is sending mail using your domain name.

The cost is one DNS record, and with p=none there's no risk to your own mail.

When to move from p=none to quarantine and reject

Give it at least two to four weeks of reports at p=none, then:

1. Check that every legitimate sender passes. In the reports, every service you use (your mailbox provider, newsletter tool, invoicing software) should show SPF or DKIM passing and aligned. Fix any that don't.
2. Move to quarantine gradually, for example v=DMARC1; p=quarantine; pct=25; rua=mailto:..., then raise pct to 100 over a couple of weeks while watching the reports.
3. Move to reject once quarantine at 100% has run cleanly: v=DMARC1; p=reject; rua=mailto:....

The step-by-step rollout guide covers each stage in more detail.

What about the reports?

Aggregate reports arrive as compressed XML attachments, typically one per day from each large mailbox provider that received mail from your domain. They're hard to read by hand. You can open them yourself (see reading DMARC rua reports), or point rua= at a service that reads them for you.

MailGuard is one option: add its reporting address to your rua= tag (you can keep your own address too; DMARC allows several, separated by commas) and you get a dashboard and a weekly plain-English email showing who sent mail as your domain and what failed. It's $7 per domain per month with a 14-day free trial, and no card is needed to start.

Quick checklist

• ☐ One TXT record at _dmarc.yourbusiness.com starting with v=DMARC1
• ☐ p=none to start
• ☐ rua=mailto: pointing at a mailbox you read (or a monitoring service)
• ☐ One SPF record, under 10 lookups, listing every service that sends as you
• ☐ DKIM turned on with your email provider and with each sending tool
• ☐ Reports reviewed for 2-4 weeks before moving to p=quarantine

Check your domain now to see what's published today.

Sources: Gmail Email sender guidelines (support.google.com/a/answer/81126, read 2026-10-19); DMARC tag definitions and multiple-record handling per RFC 7489 §6.3 and §6.6.3.

Related