The short answer

DMARC tells receiving email services, such as Gmail and Outlook, what to do with a message that claims to be from your domain but fails authentication: deliver it anyway, put it in junk, or reject it. It also sends you reports showing who is sending email using your domain. It only works properly once SPF and DKIM are set up correctly.

How DMARC works with SPF and DKIM

  • SPF lists which services may send email for your domain.
  • DKIM adds a digital signature that proves a message wasn’t changed and came from an approved sender.
  • DMARC checks that at least one of those passes and matches the domain in the “from” address people see. This matching is called alignment, and it is what stops someone putting your domain in the “from” line while sending from elsewhere.

What a DMARC record looks like

DMARC is a TXT record published at _dmarc.yourdomain.co.uk. A typical starting record is:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk

  • p=none means monitor only: nothing is blocked yet.
  • rua is where receivers send the daily summary reports.

The three policies

  • none: deliver as normal and send reports. Use this to find every service that sends email for you.
  • quarantine: messages that fail go to junk.
  • reject: messages that fail are refused. This gives the strongest protection against fake emails in your name.

A safe way to set it up

  1. Check SPF and DKIM first. Make sure your main email service and every tool that sends email for you (website forms, invoicing, newsletters) is covered. Our free email check shows what your domain has today.
  2. Publish DMARC with p=none and a mailbox for reports.
  3. Read the reports for a few weeks. They list every source sending as your domain. Fix any genuine sender that fails.
  4. Move to quarantine, watch for problems, then to reject once you are confident every genuine sender passes.

Jumping straight to reject before every sender is covered is the classic mistake: genuine invoices or website enquiries can start disappearing.

Why it matters now

Since 2024, Gmail and Yahoo require bulk senders to have a DMARC record, and Microsoft has introduced similar requirements for high-volume senders to Outlook.com addresses. Even if you send small volumes, a domain with SPF, DKIM and DMARC in place looks more trustworthy to every receiving service. For hands-on help, see DMARC setup for small businesses.