DMARC setup for small businesses
Stop scammers sending email that pretends to be you.
How we fix it
DMARC is a DNS record that tells receiving mail services what to do with messages that claim to come from your domain but fail SPF and DKIM checks. Without it, anyone can send a convincing fake invoice in your name. We publish a DMARC record that starts in monitoring mode, read the reports to find every genuine service that sends as you, fix those services, and then move the policy to quarantine or reject so spoofed mail is stopped.
Cost: Every job gets a fixed, itemised quote after a free call.
Turnaround: usually within a few working days. Moving to a strict policy follows once the reports show your genuine mail passing.
What’s included
- Publishing a DMARC record at _dmarc.yourdomain
- A reporting address, with the reports turned into a readable summary
- Finding every legitimate sender, such as your accounting software, CRM and website forms
- Aligning SPF and DKIM for each of those senders
- Moving the policy from none to quarantine, then reject, once it is safe
What’s not included
- Fixing third-party services that cannot send authenticated mail (we will tell you which ones)
- Brand logos in the inbox (BIMI) and the certificates they need
- Monitoring beyond the agreed period, unless arranged
Three steps
- 1
Book a call
We ask which services send email for your business: your mailbox provider, accounting software, website and newsletters.
- 2
We set it up
We publish the record in monitoring mode, read the reports and fix any sender that fails.
- 3
You get a short summary
A note showing your current policy, which senders pass and when it is safe to tighten.
Not sure what’s wrong yet? Run the free email check on your domain first.
Common questions
What do none, quarantine and reject mean?
They are the three DMARC policies. None only collects reports. Quarantine asks receiving services to put failing mail in junk. Reject asks them to refuse it altogether.
Will DMARC stop my own emails being delivered?
Not if it is done in the right order. That is why we start with a policy of none and only tighten it once the reports show all your genuine mail passes.
Do small businesses really need DMARC?
Small firms are a common target for invoice fraud because their domains are rarely protected. The UK’s National Cyber Security Centre recommends that organisations use DMARC, and Gmail and Yahoo require it from bulk senders.
How long does it take to reach a reject policy?
It depends how many services send email for you. Most small businesses can move to a stricter policy after a few weeks of clean reports.
Other small jobs we do
Business email setup
Email on your own domain with Microsoft 365 or Google Workspace.
See what’s includedFix emails going to spam
SPF, DKIM and DMARC fixed so your mail reaches the inbox.
See what’s includedMicrosoft 365 setup
Email, Teams, OneDrive and basic security, done right first time.
See what’s includedBigger picture? See business email, domain and cloud or all services.
Want this fixed? Get a free quote.
Tell us what you want to build, fix or connect. In one short call we’ll work out the right approach and follow up with a fixed, itemised quote.