DMARC setup: a step-by-step guide for small businesses

You run a small business, and your email goes through Microsoft 365 or Google Workspace. You also send invoices from a billing tool, and a form on your website emails your team. Anyone else can send mail that claims to be from you. DMARC is the setting that tells receivers what to do with that mail.

This guide walks through the setup in plain English. You do not need to be a technical person to follow it, but you will need access to the place where your domain's DNS is managed.

What is DMARC, and why does a small business need it?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a TXT record in your domain's DNS. It tells receivers two things: what to do with mail that fails the checks for your domain, and where to send you reports. The current standard is defined in RFC 9989.

Why it matters to you: without DMARC, a criminal can send a fake invoice that shows your exact address. Your customer has no clear signal that the message is fake. In 2024, business email compromise, where a criminal takes over or fakes a business email to steal money, caused about $2.77 billion in reported losses in the United States, according to the FBI's Internet Crime Complaint Center (IC3).

What do you need before you start?

Gather these four things first. The setup is much smoother when they are ready.

• Access to your DNS. This is the place where your domain is registered or managed, such as your domain registrar or your DNS host. Often it is the same company.
• Admin access to your email provider. You need it to check how SPF and DKIM are set up.
• A mailbox or a group for reports. Use one that someone reads, not a personal inbox that gets lost in the noise.
• A list of every service that sends mail as your domain. You will need it for the next step.

How do I find every service that sends email as my domain?

Start with a list of every tool that sends email with your address. Ask your team, and check your mail provider's settings. Look at your invoicing and billing tools, your newsletter service, your scheduling tool, your website contact form, and any scanner or copier that emails documents.

Each one needs to pass SPF or DKIM for your domain before you turn DMARC on. If you skip this, legitimate mail can start failing as soon as you tighten the policy. Once the reports reach a mailbox, Ward's DMARC page can also show you which services send as your domain, and it can read reports you upload by hand.

How do I set up DMARC with Microsoft 365?

You add one TXT record named _dmarc, with the value v=DMARC1; p=none; and a reporting address. Microsoft 365 does not manage DMARC records for custom domains, so you create the record at the company that hosts your domain's DNS.

1. Turn on SPF and DKIM first. In the Microsoft 365 admin center, look for the email authentication or DNS settings for your custom domain. Microsoft's guide explains how to set up SPF and DKIM for each domain.
2. Find where your DNS is managed. If the domain's DNS is hosted with Microsoft 365, the domain settings in the admin center have a DNS records area. If it is not, go to the company that manages your DNS, such as your registrar or hosting provider.
3. Add the TXT record. The name is _dmarc. The value is v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com. Use a reporting mailbox you check.
4. Save, then wait for the reports. Receivers usually send them about once a day, so the first ones take a little while.

Microsoft's guide to setting up DMARC in Microsoft 365 has the full syntax and the rollout plan. If you send only from the onmicrosoft.com address, the guide explains that case separately.

How do I set up DMARC with Google Workspace?

The steps are the same, and the record goes at your DNS host. Google's help article recommends a few preparations first.

1. Turn on SPF and DKIM first. Google's help says to let them run for a while before you move on. In the Google Admin console, look for the email authentication settings for your domain.
2. Create a reporting mailbox or group. Choose one that someone reads.
3. Check your third-party senders. Confirm that the outside services sending mail for your domain pass SPF and DKIM.
4. Add the TXT record at your DNS host. The host or name is _dmarc.yourcompany.com. A typical value is v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com; pct=100.

Google's Set up DMARC article gives the full details. Where the screens differ from what you see, follow the article rather than an older screenshot.

How do I move from p=none to p=reject without blocking real email?

Stay at p=none until you know who sends as your domain. Then move in small steps, and keep reading the reports at each stage.

Microsoft's guide suggests raising the percentage in steps when you move to quarantine or reject, for example 10, then 25, 50, 75 and 100 percent. The percentage is the pct tag. It tells receivers how much failing mail the policy applies to.

How do I read a DMARC report?

Receivers send you aggregate reports, usually once a day. Each one is an XML file, often compressed, that summarizes the mail that claimed your domain. It lists the sending server's address, how many messages it sent, whether SPF and DKIM passed, and what the receiver did.

The key question for each row is simple: does the mail line up with your domain? A message passes DMARC if SPF or DKIM passes and the domain matches your From address. Here are three typical rows and what to do with each one.

Two patterns to watch. First, a row where SPF passes but the domain does not line up. That means a real service sends mail for you, but with its own domain in the envelope. Second, a sender you do not recognize, sending a lot of failing mail. The second one is what your policy is there to stop.

Forensic reports (the ruf tag) are optional. They are sent one by one for each failure and can be a lot of mail. Microsoft's guidance is to start with aggregate reports only, and to add forensic reports later if you need them.

What mistakes should I avoid?

• Publishing two DMARC records. Keep one record that starts with v=DMARC1. Two records make receivers ignore both.
• Forgetting a service. The invoicing tool you use once a month is the one that breaks when you reach p=reject.
• Jumping to p=reject. A few weeks of reports is the minimum. Going straight to reject can block real customers.
• Making subdomains weaker than the main domain. If the sp tag is more permissive than p, forged mail from a subdomain can still get through.
• Ignoring the reports. A DMARC record that nobody reads gives you no protection and no warning.

What should I do after p=reject?

Keep reading the reports, at least once a month once things are stable. A new service, a new email tool or a changed configuration can break a legitimate sender, and the reports are how you catch it.

Also keep a short note of every tool that sends mail for your domain. When you add a new one, check that it passes SPF or DKIM before your policy starts refusing mail.

Once DMARC is in place, read Email spoofing: how to stop someone sending email as you to see what it protects against and what it does not. If the mail you send still lands in spam, why your emails go to spam covers the next checks.