DMARC is a setting on your domain that tells other mail servers what to do with email that claims to come from you but fails checks. Together with SPF and DKIM it makes your domain much harder to fake. For a Reading business, it takes about an hour to check and the fix is usually small.
Most owners have never looked at it. The records sit in the settings of your domain name, nobody owns them, and everything seems to work. That is exactly why a fake email from “you” can reach your customers without anyone noticing.
What are SPF, DKIM and DMARC?
Three records on your domain that work as a set. SPF lists who may send email for you. DKIM signs each message so it can be shown to be genuine. DMARC says what to do when a message fails, and sends you reports.
The NCSC describes them the same way. SPF publishes the addresses your domain trusts to send mail. DKIM signs outgoing mail. DMARC sets a policy for mail that fails those checks, including discarding it, and produces reports on how your email is being handled (NCSC, Email security and anti-spoofing, version 2.0, 7 October 2019).
One simple way to hold it in your head: SPF is the guest list, DKIM is the wax seal, and DMARC is the instruction to the doorman.
Why does this matter to a business in Reading?
Because your customers and suppliers trust your domain, not your intentions. If someone sends an invoice request from an address that looks like yours, the person receiving it sees your name.
Reading firms work with supply chains and professional clients: the offices at Thames Valley Park and Green Park, practices in the town centre and businesses out at Theale, all named on our Reading page. Many of those clients now ask suppliers how they protect email. A domain with no DMARC policy is an awkward answer to give.
It also protects your own people. A fake message that appears to come from your managing director, asking someone to change bank details, is a standard fraud. Our post on email impersonation shows how that looks in practice.
How do I check whether my domain is protected?
Use the NCSC’s free email security check, which the NCSC recommends for testing whether a domain follows its guidance (NCSC, Email security and anti-spoofing, 7 October 2019). Type in your domain and read the result. If it reports no DMARC record, or a policy set only to monitor, you have work to do.
You can also ask whoever manages your domain or your Microsoft 365. Ask three questions: is SPF published, is DKIM switched on, and what is our DMARC policy? If they cannot answer all three quickly, that is the finding.
What are the six steps to set it up?
Six steps, in this order. The order matters, because switching DMARC to strict too early can block your own genuine email.
- List everything that sends email as you. Your main mailboxes, plus the newsletter tool, the invoicing system, the website contact form and the CRM. Each one needs to be covered by SPF and DKIM.
- Publish an SPF record that includes all of them and nothing else. One SPF record per domain, not two.
- Switch on DKIM signing for each sender. Microsoft 365 can do this for your own mailboxes. Third-party tools usually give you a record to add.
- Publish a DMARC record set to monitor only. It changes nothing for your email and starts the reports.
- Read the reports for a few weeks. They show who is sending as you, including senders you forgot about.
- Tighten the policy once the genuine senders pass. Move to quarantine, then reject, so fakes are held or refused.
Cover every domain you own, including old ones you no longer use for email. The NCSC advises protecting all of them, including those on cloud email such as Microsoft 365 (NCSC, 7 October 2019).
What goes wrong when you get it wrong?
Two things, and they pull in opposite directions. With no DMARC policy, fakes of your domain are delivered as normal. With a policy that is too strict too soon, your own genuine email can be refused.
The usual culprit is a sender nobody remembered: the booking system, the payroll provider, the old marketing tool someone set up in 2022. They send as you, they are not in your SPF record, and the day the policy tightens they stop arriving. That is why steps one and five matter more than the DMARC record itself.
Two smaller mistakes are worth knowing. Publishing two SPF records for one domain makes both invalid, and forgetting a domain you own but no longer use leaves a ready-made address for someone to fake. Both take minutes to fix once you know to look.
How long does it take?
The first check takes minutes. Publishing a monitoring-only DMARC record takes about an hour if you have access to your domain settings. The reports then need a few weeks to show you the full picture, and tightening the policy is a short job once they are clean.
Plan it as a small project with one owner and a date, not a task that gets done when someone has time. A short monthly look at the reports afterwards keeps it that way, and costs a few minutes.
Who can set this up for a Reading business?
Whoever looks after your domain and email. INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, supports businesses in Reading and across Berkshire, around seventeen miles from our office via the A329 and M4 (INDIGO IT, IT support in Reading page). Email security is part of the cyber security within our managed IT support.
If you want to start on your own, run the NCSC check today and write down the result. If you would like a second pair of eyes, speak to Matt about IT support in Reading.
Frequently asked questions
What is DMARC and do small businesses need it?
DMARC is a record on your domain that tells receiving mail servers what to do with email that fails SPF and DKIM checks, and sends you reports. Any business that sends email from its own domain benefits, because it makes it harder for someone to send fake messages that look like yours.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a signature to each message so it can be verified. DMARC sets the policy for messages that fail, and reports back to you.
How do I check my DMARC record?
Use the NCSC’s free email security check and enter your domain, or ask whoever manages your domain to read out your SPF, DKIM and DMARC settings. A missing record or a policy set only to monitor means you are not yet fully protected.
Who can set up DMARC for a business in Reading?
Your IT provider or whoever manages your domain can do it. INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, supports businesses in Reading and across Berkshire, and email security forms part of its managed cyber security.
