What Is DMARC? How It Protects Your Business Email Domain

DMARC is an email authentication standard that lets you tell the world’s mail servers what to do with messages that claim to come from your domain but fail verification. That is the short answer to what is DMARC. It stands for Domain-based Message Authentication, Reporting, and Conformance, and for a small business it does two practical things: it makes it harder for criminals to send email that looks like it came from you, and it sends you reports showing who is sending mail in your name.

If your company’s name has ever shown up on a fake invoice, or a client has asked, “Did you really send this?”, this guide is for you. MicroSky Managed Services has helped NYC businesses with email and security since 2015. Here is how DMARC works and how to roll it out without breaking your own mail.

What is DMARC and why does it exist?

Email was designed decades ago without any built-in way to prove who sent a message. Anyone can type your company name and address into the “From” line. DMARC fixes part of that problem by building on two older standards, SPF and DKIM, and adding a policy and a reporting channel on top.

The IETF published DMARC as an Informational document in RFC 7489 in 2015. In May 2026 it was updated and published on the Standards Track as RFC 9989, which obsoletes RFC 7489. In RFC 9989’s words, DMARC permits the owner of an email’s author domain to enable validation of the domain’s use, indicate a message handling preference when validation fails, and request reports about use of the domain name.

SPF, DKIM, and DMARC: how the pieces fit

• SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send mail for your domain, such as Microsoft 365, Google Workspace, or your billing platform.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message so the receiving server can confirm it was not altered and was signed by your domain.
• DMARC checks that the domain in the visible “From” address lines up (aligns) with the domain that passed SPF or DKIM. Then it applies the policy you published and sends you reports.

The alignment check is the key. Without DMARC, an attacker can pass SPF using their own domain behind the scenes while showing your domain in the From line. DMARC closes that gap.

The three DMARC policies

A DMARC record is a single TXT record in your DNS at _dmarc.yourdomain.com. The most important setting is the policy, written as p=:

• p=none means monitor only. Receivers deliver mail as usual but send you reports. This is where everyone should start.
• p=quarantine asks receivers to treat failing messages as suspicious, usually by sending them to spam or junk.
• p=reject asks receivers to refuse failing messages outright. This is the strongest protection against direct spoofing of your domain.

A basic monitoring record might look like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The rua tag tells receivers where to send aggregate reports. Those reports are XML files, so most businesses use a reporting service or their IT provider to turn them into something readable.

Why DMARC matters for NYC small businesses

Business email compromise is expensive

The FBI’s Internet Crime Complaint Center reported 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses in 2025, according to the 2025 IC3 Internet Crime Report. DMARC will not stop every BEC scheme, because many use lookalike domains or a genuinely compromised mailbox, but it does shut down the simplest trick: sending mail that uses your exact domain.

We have written about how these schemes play out locally, including the callback step that stops most fraudulent wire requests, in BEC: call back before you wire, and about why email and identity are now the main breach path in the email identity breach path for NYC businesses. DMARC is one control in that larger picture.

Big mailbox providers now expect it

Google’s email sender guidelines state that starting February 1, 2024, senders of more than 5,000 messages per day to Gmail accounts must set up SPF, DKIM, and DMARC, with a DMARC policy that can be set to none. Microsoft announced similar requirements for high-volume senders to Outlook consumer addresses, with non-compliant mail routed to Junk starting May 5, 2025. Most small offices do not send 5,000 messages a day, but newsletters and billing platforms can add up, and having DMARC in place is quickly becoming baseline hygiene for deliverability.

Visibility you did not have before

DMARC reports often surprise people. They reveal the forgotten marketing tool, the old copier that sends scans through an outside relay, or a vendor sending invoices in your name. You cannot protect a domain if you do not know who is using it.

How to roll out DMARC without breaking your email

The biggest mistake is jumping straight to p=reject. If a legitimate system is not authenticated, its mail will start disappearing. Go in stages:

1. Inventory your senders. List every service that sends mail as your domain: Microsoft 365 or Google Workspace, your CRM, accounting software, e-signature tools, website forms, scanners, and newsletter platforms.
2. Fix SPF. Make sure your SPF record includes legitimate senders and stays within the DNS lookup limits. Remove services you no longer use.
3. Turn on DKIM everywhere you can. Enable DKIM signing in Microsoft 365 or Google Workspace and in each third-party platform that supports a custom domain.
4. Publish DMARC at p=none. Add a reporting address and start collecting data.
5. Read the reports for a few weeks. Identify legitimate sources that fail and fix them. Identify sources that should not exist.
6. Move to p=quarantine. Watch for complaints about missing mail.
7. Move to p=reject. Once legitimate mail consistently passes, enforce. Keep monitoring, because new tools get added all the time.

Do not forget domains that do not send email at all. A parked or secondary domain with no mail should publish a reject policy so criminals cannot borrow it.

What DMARC does not do

• It does not stop lookalike domains, such as a swapped letter or an extra word in the domain.
• It does not help if an attacker logs into a real mailbox in your organization. That message is legitimately authenticated.
• It does not protect you from spoofed mail if the recipient’s server ignores DMARC, though major providers honor it.
• It is not a replacement for MFA, email filtering, and staff training.

That is why we pair DMARC with layered email protection. MicroSky’s email security service focuses on phishing, business email compromise, brand impersonation, and compromised internal accounts that authentication standards alone cannot catch.

Frequently asked questions

Is DMARC required?

For bulk senders to Gmail and Outlook consumer mailboxes, providers now require it. For everyone else it is not legally required in most cases, but it is widely recommended, and U.S. federal civilian agencies were directed to reach p=reject under CISA’s Binding Operational Directive 18-01.

Will DMARC hurt my email delivery?

A monitoring policy (p=none) does not change delivery. Enforcement can block legitimate mail if senders are not properly authenticated, which is why a staged rollout matters. Done right, DMARC generally helps deliverability.

How long does it take to reach p=reject?

It depends on how many services send mail as your domain. A simple office may get there in weeks; a business with many marketing and billing tools may take longer.

Do I need DMARC if I use Microsoft 365?

Yes. Microsoft 365 handles authentication for mail it sends, but you still need to publish your own DMARC record and enable DKIM for your custom domain.

Get help locking down your domain

If you are not sure whether your domain has SPF, DKIM, and DMARC set up correctly, we can check it and walk you through a safe rollout. MicroSky’s support desk is open Monday through Friday, 8 AM to 6 PM ET, with after-hours on-call support. Call (718) 672-2177 or visit microskyms.com.