How to Set Up DMARC: Step-by-Step for Small Business

🛡️Free DMARC Record Generator
Create a DMARC record to stop email spoofing.Open tool →

What DMARC actually checks

When an email arrives, the receiving server checks SPF (was it sent from an approved server?) and DKIM (does it carry your domain's signature?). DMARC adds two things: the result must match the domain in the visible From address, and you tell the receiver what to do when it doesn't.

That last part is the policy: none (do nothing, just report), quarantine (send to spam) or reject (refuse it).

Step 1: get SPF and DKIM working first

List every service that sends email as you – your mailbox provider, website contact form, newsletter tool, invoicing or booking software. Each needs to be in your SPF record and, ideally, have DKIM switched on in its settings.

Use the SPF Record Generator to build the SPF record, then check the result with the Email Spoofing Checker.

Step 2: publish a monitoring record

Open the DMARC Record Generator, enter your domain and a mailbox for reports, and leave the policy on none. Add the result as a TXT record with the host _dmarc at your DNS provider.

Nothing is blocked at this stage. You simply start receiving daily summary reports from Google, Microsoft and others showing who sends mail using your domain.

Step 3: tighten the policy

After two to four weeks, look at the reports. When every legitimate sender passes, change p=none to p=quarantine. A few weeks later, move to p=reject.

If a real sender is failing, fix its SPF or DKIM before tightening – otherwise your own invoices or newsletters will go to spam.

Common mistakes

Publishing two DMARC records (only one is allowed), adding the record at the root instead of _dmarc, and jumping straight to reject on day one.

Frequently asked questions

How long does DMARC take to work?

The record is live within minutes to a few hours. Reports start arriving within a day or two.

Do I need DMARC if I only send a few emails?

Yes – it protects your name from being used by scammers, regardless of how much you send.

Can you set it up for me?

Yes – the Email Spoofing Fix service covers SPF, DKIM and DMARC end to end.