What Is DMARC? A Plain-English Guide for Small Businesses

If you send newsletters, invoices or sales emails from your own domain, DMARC is the setting that stops someone else pretending to be you. It's also one of the three records Gmail now expects from anyone sending in volume. It sounds technical, but the record itself is one line, and the decisions behind it are business ones.

How DMARC fits with SPF and DKIM

DMARC doesn't work alone. Google's admin help says you must turn on SPF and/or DKIM for your domain before you can use DMARC. Think of the three as a team:

Record	The question it answers	Where it lives
SPF	Is this server allowed to send email for this domain?	A TXT record listing your sending services
DKIM	Was this message signed by this domain and left unchanged?	A TXT record holding your public key
DMARC	What should happen if a message fails those checks, and who gets told?	A TXT record on your domain

If you send through Google Workspace, Google's own help pages walk through each record, and the order matters: SPF and DKIM first, DMARC last.

What a DMARC record looks like

Google's help page gives this example of a cautious starting record:

v=DMARC1; p=none; rua=mailto:[email protected], mailto:[email protected]; pct=100; adkim=s; aspf=s

Here's what each part means, in plain English.

Tag	What it does	What Google says
v=DMARC1	Says this is a DMARC record	Required, always first
p	The policy: none, quarantine or reject	Start with none and tighten over time
rua	Where daily summary reports go	Optional, but Google recommends always including it
pct	The share of failing messages the policy applies to	Without it, the policy applies to 100% of messages
sp	A separate policy for subdomains	Without it, subdomains inherit the main policy
adkim / aspf	How strictly the From domain must match DKIM and SPF	Optional alignment settings
ruf	Failure reports	Gmail doesn't support it

The three DMARC policies and when to use each

• p=none. Deliver as normal and send reports. Google recommends starting here while you learn how your email is being authenticated.
• p=quarantine. Mark failing messages as spam and send them to the recipient's spam folder.
• p=reject. Refuse failing messages outright. This is the strongest protection against spoofing.

Google's advice is to change the policy over time to quarantine or reject as you understand your reports. Jumping straight to reject on day one is how businesses accidentally block their own invoices or newsletters sent through a tool they forgot about.

How to set up DMARC, step by step

1. Set up SPF and/or DKIM first, then wait. Google says allow 48 hours after setting them up before you add DMARC.
2. Create a group or dedicated mailbox for reports. Google warns you can receive many reports every day, and large organisations can get hundreds or thousands.
3. Check every third-party service that sends email for you, such as your newsletter platform, CRM or booking system, passes SPF and DKIM. Ask each provider if you're not sure.
4. Write your record, starting with p=none and an rua address.
5. Log into your domain host and add it as a TXT record, following that host's instructions.
6. Read the reports for a few weeks, fix any service that fails, then move to quarantine and later reject.

You don't need to do anything in the Google Admin console for this. Google says DMARC is set up entirely at your domain host.

Why DMARC matters if you send to Gmail

Google's email sender guidelines say that from February 1, 2024, anyone sending more than 5,000 messages a day to personal Gmail accounts must set up SPF, DKIM and DMARC. Bulk senders also need the domain in the From header to align with either the SPF or DKIM domain, and their marketing email must support one-click unsubscribe, which sits neatly alongside the unsubscribe rules in the CAN-SPAM Act. Gmail itself has said it's using a DMARC quarantine policy, so impersonating a Gmail address in your From header can hurt delivery.

What to do with your DMARC reports

The rua address in your record is where receiving servers send summary reports about mail claiming to come from your domain. Google recommends always including it, and suggests a group or dedicated mailbox because the volume can surprise you. The reports themselves are data files rather than friendly emails, so most small businesses use a free or paid DMARC report reader to turn them into a list of who's sending as you. Look for two things: your own tools failing SPF or DKIM, which you fix before tightening your policy, and senders you don't recognise, which is exactly the spoofing DMARC is there to stop. One more rule worth knowing: if the reporting address sits on a different domain from the one with the DMARC record, Google says you must add a DNS record at that other domain too.

A detail that catches out brands with logos in the inbox

If you use BIMI to show your logo next to your emails, Google says your DMARC policy must be quarantine or reject, with a pct value of 100. A p=none record won't qualify.

My verdict

Every business sending email from its own domain should have a DMARC record, even if it's only p=none to start. It costs nothing, takes a few minutes at your domain host, and the reports show you who's sending email in your name. If your emails are already landing in spam, read my guide on why emails get marked as spam alongside this one.

Frequently asked questions

What does DMARC stand for in plain terms?

It's a DNS record that tells receiving servers what to do with email from your domain that fails SPF or DKIM checks, and where to send reports about it.

Do I need SPF or DKIM before DMARC?

Yes. Google says you must turn on SPF and/or DKIM before you can use DMARC, and to allow 48 hours after setting them up before adding DMARC.

What DMARC policy should I start with?

Google recommends starting with p=none, reading your reports, then moving to quarantine or reject over time.

Does Gmail require DMARC?

Google's sender guidelines say anyone sending more than 5,000 messages a day to personal Gmail accounts must set up SPF, DKIM and DMARC.

Does Gmail send DMARC failure reports?

No. Google says Gmail doesn't support the ruf tag used for failure reports, so use rua for summary reports.