How to set up DMARC, without losing your own email.

Before you start

First, run your domain through the free email security checker to see where you stand. Then you'll need:

• Access to your DNS, usually wherever you bought the domain or your web host.
• Admin access to Microsoft 365 or Google Workspace.
• A list of everything that sends email as you. Not just Outlook or Gmail, but your accounts package, CRM, newsletter tool, website contact form, helpdesk and any scanners or printers that email.

That list is the step most people skip, and it's why DMARC has a reputation for breaking things.

Step 1: SPF

SPF is a single TXT record on your domain listing the services allowed to send as you. For Microsoft 365 it starts like this:

v=spf1 include:spf.protection.outlook.com -all

For Google Workspace:

v=spf1 include:_spf.google.com ~all

Add an include: for each other service on your list, using the value from their help pages. Three rules that catch people out:

• You can only have one SPF record. Two records means both fail.
• SPF allows a maximum of 10 DNS lookups. Each include: counts, and some count more than once.
• Never use +all. It tells the world anyone may send as you.

Step 2: DKIM

DKIM adds a digital signature to every email, so the receiving server can tell it really came from you and wasn't changed on the way.

Microsoft 365

1. In the Microsoft Defender portal, go to Email & collaboration, Policies & rules, Threat policies, then Email authentication settings and the DKIM tab.
2. Select your domain. Microsoft shows two CNAME records, for selector1._domainkey and selector2._domainkey.
3. Add both to your DNS, wait for them to take effect, then switch DKIM signing on.

Google Workspace

1. In the Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email.
2. Generate a new record with a 2048-bit key. Google gives you a TXT record for google._domainkey.
3. Add it to your DNS, wait for it to take effect, then click Start authentication.

Then set up DKIM in each of the other services on your list. Most have a page in their settings that gives you records to add.

Step 3: DMARC, in monitoring mode

DMARC tells receiving servers what to do with email that fails SPF and DKIM, and sends you reports. Start by only watching. Add a TXT record at _dmarc.yourdomain.co.uk:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk

The rua address receives daily reports from Microsoft, Google and others showing everything sending as your domain. They're XML files that aren't meant for humans, so a DMARC reporting service, many of which have a free tier, makes them readable.

Leave this running for two to four weeks. Look for legitimate services failing, which means something on your list is missing from SPF or DKIM, and fix them.

Step 4: Turn on protection

Once your own email passes consistently, tighten the policy in two moves:

1. Change p=none to p=quarantine, so failing email goes to spam. Watch the reports for a couple of weeks.
2. Change it to p=reject, so failing email is refused outright. This is the setting that actually stops spoofing.

Keep an eye on the reports afterwards. When you add a new service that sends email, set up its SPF and DKIM before it goes live.

Domains you don't send email from

Criminals love spare domains, like an old company name or the .com version of your .co.uk. If a domain never sends email, lock it down completely with an SPF record of v=spf1 -all and a DMARC record of v=DMARC1; p=reject.

Why it's worth doing

Without DMARC at quarantine or reject, anyone can send email that appears to come from your exact address, which is the easiest way to send your customers a fake invoice or bank detail change. Big mailbox providers like Google, Yahoo and Microsoft now insist on it from bulk senders, and more insurers and larger customers check for it.

When you're done, run the email security checker again. If something looks wrong, or you'd rather not risk your email on a DNS change, I can set it up for you, alongside your IT provider or as part of Cyber Essentials.