DMARC for UK small businesses: a step-by-step guide
DMARC tells receiving mail servers what to do with email that claims to come from your domain but fails authentication. Without it, anyone can send convincing invoices "from" you.
The three records, in one minute
| Record | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | TXT record on yourdomain |
| DKIM | Adds a cryptographic signature to each email | TXT record on selector._domainkey.yourdomain |
| DMARC | Says what receivers should do when SPF or DKIM fails, and where to send reports | TXT record on _dmarc.yourdomain |
Step 1: List everything that sends email as you
Most small businesses have more than they think: Microsoft 365 or Google Workspace, a website contact form, an invoicing tool (such as Xero or QuickBooks), a newsletter tool, and a booking system. Write them all down. Each one needs to pass SPF or DKIM.
Step 2: Fix SPF
You can only have one SPF record. Combine your senders' include: mechanisms into it, and end it with ~all while you test or -all once you're confident. SPF also has a 10-DNS-lookup limit. If you use a lot of tools, you may hit it.
Example: v=spf1 include:spf.protection.outlook.com include:_spf.xero.com ~all (check the exact include value in each provider's documentation).
Step 3: Turn on DKIM in every tool
Each provider gives you either a CNAME or a TXT record to publish. Google Workspace: Admin console, then Apps, Gmail, Authenticate email. Microsoft 365: Defender portal, then Email authentication settings, DKIM.
Step 4: Publish DMARC in monitoring mode
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk
p=none doesn't block anything. It only collects reports, which arrive as XML files. Leave it running for 2–4 weeks and check that every legitimate sender passes.
Step 5: Tighten to quarantine, then reject
Once the reports show only legitimate, passing senders, move to p=quarantine, optionally with pct=25 to start with. After a few clean weeks, move to p=reject. That's the point at which spoofed email using your domain is actually blocked.
Common mistakes
- Two SPF records, which makes SPF invalid
- Using +all, which allows anyone to send
- Staying on p=none for ever
- Forgetting the website contact form or invoicing tool
Sources
Is your email set up to be trusted?
Free, passive and no sign-up. About ten seconds.