DMARC monitoring for small business, in plain English

Here is a fact that surprises most small business owners: without DMARC, anyone on the internet can send an email that claims to be from your domain. Not by hacking you — the email system was simply not built to verify senders by default. DMARC is the policy that closes that gap, and understanding it takes about five minutes.

The three pieces, each in one paragraph

SPF is a list, published in your DNS, of the servers allowed to send mail for your domain. If a server not on the list sends mail claiming to be you, receivers know it is suspicious.

DKIM is a signature. Your mail server signs outgoing mail with a private key, and receivers verify it against a public key in your DNS. If the content was tampered with in transit, the signature breaks.

DMARC ties them together. It says: mail claiming to be from this domain must pass SPF or DKIM and the passing check must align with your domain — and it tells receivers what to do with mail that fails, and where to send reports about it.

The policy ladder: none, then quarantine, then reject

DMARC policies come in three strengths. p=none means "just watch and report" — nothing is blocked, and you receive reports about who is sending as you. p=quarantine means failing mail goes to spam. p=reject means failing mail is refused outright.

The order matters. Start at p=none and watch the reports for a few weeks: you will discover legitimate senders you forgot about — a newsletter tool, a CRM, an old contact form. Add them to SPF or DKIM first. Only move to quarantine once the reports show your real mail passing consistently. Jumping straight to reject is how businesses silently block their own invoices.

Why monitoring, not just setup

DMARC is not a one-time setting. Records get dropped in DNS edits, providers change signing keys, and a host migration can quietly break alignment. The damage is invisible on your website — you only notice when customers stop receiving your mail. Watching the published records on every scan, and being alerted when any of them degrades, is what turns a one-time setup into ongoing protection.

One honest note: the aggregate reports receivers send back are XML files — thorough, but miserable to read by hand. The practical approach for a small business is to watch the records themselves and act on degradation alerts, rather than drowning in raw reports.

Run a free health scan to see your SPF, DKIM, and DMARC status today — and what, if anything, needs fixing first.