Email security
DMARC Explained for Small Businesses
By PixelPrivate Security Team · Published · Updated · 6 min read
Short answer: DMARC is a DNS record that tells email receivers what to do when a message claiming to be from your domain fails SPF and DKIM alignment: nothing (p=none), treat as suspicious (p=quarantine) or refuse (p=reject).
The three policies
- p=none — monitor only. Spoofed mail is still delivered; you receive reports.
- p=quarantine — failing mail is treated as suspicious, usually the spam folder.
- p=reject — receivers are asked to refuse failing mail.
Why p=none is not protection
It is the right first step, but it does not stop spoofing. Many domains stay there for years; the goal is to move on.
Reading reports
Aggregate (rua) reports are daily XML files listing who sent mail as your domain and whether it passed. Use a free report-processing service rather than reading XML by hand.
Rollout plan
- Publish p=none with rua.
- Fix legitimate failing senders.
- Move to quarantine, optionally using pct to ramp up.
- Move to reject.
Common mistakes
- Two DMARC records
- No reporting address
- Forgetting subdomains (use sp= if they need a different policy)
- Enforcing before inventorying senders
Checklist
- ☐ Record at _dmarc
- ☐ rua set
- ☐ Senders pass
- ☐ Policy at quarantine or reject
Methodology
Based on RFC 7489. Provider behaviour varies; DMARC policy is a request, and receivers may apply local policy.