The DMARC Record a Small Business Should Publish First (and When to Tighten It)
If your business sends mail from its own domain ( you@yourbusiness.com ), three DNS records do the authentication work: SPF, DKIM and DMARC. SPF and DKIM prove a message came from a server you actually use. DMARC tells the receiving server what to do when a message claims to be from your domain but fails those checks, and where to send reports about it. With no DMARC record, anyone can put your…
When a small business sends emails from its own domain (you@yourbusiness.com), it must rely on three DNS records to authenticate the messages: SPF, DKIM, and DMARC. SPF and DKIM confirm that the email originated from a server owned by the business, while DMARC dictates how the receiving server should handle messages that fail these checks and where to send reports about them.
Without a DMARC record, any domain can be falsely claimed as the sender, allowing spammers to masquerade as your business. To begin, add a TXT record to your DNS host (like Cloudflare, GoDaddy, Squarespace, or Network Solutions) with the following details: Host/Name: _dmarc, Type: TXT, Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com.
Replace dmarc-reports@yourbusiness.com with a mailbox you own. The "p=none" setting is a monitoring mode that does not block or move messages to spam; it simply starts sending reports so you can see which domains are using your domain in the From: line. The fields in the TXT record indicate the policy for failing messages (none, quarantine, or reject), where to send daily aggregate reports, the percentage of failing mail to test the policy against (omit initially), and the policy for subdomains (omit, allowing subdomains to use the same policy).
Common errors include forgetting to include a rua= address for reports or having multiple DMARC TXT records. Before tightening the settings, ensure SPF and DKIM are correctly configured. SPF requires a single TXT record at the root of the domain listing every service authorized to send emails on your behalf, while DKIM needs to be enabled in your email provider's admin console and the necessary DNS records published.
Most small businesses don't need DMARC immediately, but Google recommends it for all domains, and reports provide valuable insights into who is sending emails under your domain. After a few weeks of collecting p=none reports, review them to ensure legitimate senders are passing SPF and DKIM checks. Gradually increase the policy to quarantine (25% failing mail) and eventually set it to reject (100%) once the quarantine period is clean.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
