What DMARC means
DMARC is what actually stops criminals from sending email as your domain. Start by monitoring, fix legitimate senders, then move to quarantine or reject. Major mailbox providers now require it for bulk senders, so it also protects deliverability.
Why it matters for your website
DMARC helps stop criminals from sending fake emails that look like they come from your business. It also improves deliverability, since major mailbox providers expect bulk senders to have a DMARC record. The reports show you every service sending email as your domain, which often uncovers tools you forgot about.
Example
A property management company starts with a DMARC policy of none and reads the reports. It finds its billing software is not authenticated, fixes it, then moves to a stricter policy.
Tips
- Start with a policy of none to collect reports without blocking any mail.
- Use a DMARC report tool to turn the raw reports into something readable.
- Move to quarantine and then reject once all your legitimate senders pass.
Common mistakes
- Jumping straight to reject and blocking your own invoices or newsletters.
- Publishing a record with no reporting address, so you never see what is failing.
Questions about DMARC
What is DMARC?
A DNS policy that tells mail servers what to do with email that fails SPF or DKIM checks, and sends you reports.
What DMARC policy should I use?
Begin with none while you monitor, then tighten to quarantine and finally reject once you are confident all real email passes SPF or DKIM.
Can DMARC stop all phishing emails?
It stops direct spoofing of your exact domain. It cannot stop lookalike domains, so watch for those separately.
