This is going to be a little tech-heavy, but I’m going to try to make it as simple as I can, so get comfy…
DMARC is one of those technical things most business owners never think about or don’t know exists. Your email is sending, and messages from your website are arriving. Good enough, right?
Email working and your domain being properly set up are not the same thing!
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. Basically, it’s a DNS record that helps receiving mail servers decide whether an email claiming to come from your domain is legit or not.
It works alongside the SPF and DKIM records.
- SPF identifies the servers allowed to send email for your domain.
- DKIM adds a digital signature that receiving servers can verify.
- DMARC checks whether SPF or DKIM passes and matches the domain shown in the From address.
Think of SPF as the approved sender list, DKIM as the signature, and DMARC as the instructions for what should happen when those checks fail. Clear as mud?
Why should you care?
There’s a good chance your business probably sends email from more places than you realize.
Along with your inbox, messages might come from your website forms, CRM, invoicing software, ecommerce store, booking system, help desk, or marketing platform. Every one of those services may be sending email using your domain.
Here is how a DMARC record helps.
First, it makes it harder for someone to spoof your domain. Second, it gives you some visibility into which systems are sending, or appearing to send, email from your domain. DMARC doesn’t stop EVERY kind of phishing. It can’t prevent someone from registering a similar-looking domain, using a misleading display name, or gaining access to your email account.
Email providers are also paying more attention to authentication. Google requires SPF or DKIM for anyone sending to personal Gmail accounts. Senders delivering more than 5,000 messages a day must use SPF, DKIM, and DMARC.
What does a DMARC record look like?
A record might look like this –>
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- v=DMARC1 identifies the record as DMARC.
- p=none means the domain is monitoring failures without requesting that messages be blocked.
- rua=mailto:… tells email providers where to send reports.
Do not copy that example into your DNS! It’s just an example and won’t work as is. If you need help adding a proper DMARC record to your domain, contact me, and we can walk through your options!
How can you check your domain?
Head over to the Google Admin Toolbox. Enter your domain without WWW and review the DMARC result.
No result usually means there is no DMARC record published at that hostname. A result containing p=none, p=quarantine, or p=reject tells you which policy is published.
That only confirms the record exists. It does not prove that every system sending email for your business is configured correctly.
One passing email from Google Workspace does not prove that your website forms, Shopify store, invoicing software, or marketing platform will also pass. Each sending source needs to be checked.
How do you check each source?
Checking the DMARC record is the first step. The next is testing each system that sends email for your business.
Start by making a quick list. Nothing crazy!
- Your regular business inbox
- Website forms and automatic replies
- Invoicing or booking software
- Shopify order and account emails
- Your CRM or help desk
- Marketing platforms
Then send a message from each one. Send a normal email, submit your contact form, send yourself a test invoice, place a test order, etc.
Use an email address outside your business domain for these tests. A personal Gmail account works well because the message has to travel through the same external delivery process as an email sent to a customer.
Once the message arrives in Gmail, open it, click the three dots next to the Reply button, and choose Show original. Google will show the SPF, DKIM, and DMARC results for that message.
For a basic check, you want to see something like this…
SPF: PASS
DKIM: PASS
DMARC: PASS
Need help sorting this out?
If you want help checking your domain, identifying which systems are sending email, or fixing your DMARC setup without disrupting legitimate messages, send me a message. I can review what is currently set up and walk you through what needs attention.