What Is DMARC and How to Set It Up for Business Email

Quick answer: When asking what is DMARC (Domain-based Message Authentication, Reporting, and Conformance), it is a security protocol published in DNS that defines what receiving providers should do when a message sent on behalf of your company fails SPF or DKIM validation. It fights spoofing attempts and protects your domain reputation. To set it up, you add a TXT record to your DNS zone named _dmarc, defining a policy of monitoring (p=none), quarantine (p=quarantine), or rejection (p=reject).

What is DMARC and why did it become mandatory?

DMARC was formalized by the Internet Engineering Task Force through RFC 7489. In simple terms, it works as a formal instruction that the domain owner gives to servers such as Google, Yahoo, and Microsoft on how to handle suspicious messages using your brand's name.

Historically, email was built without native security mechanisms. Any computer connected to the network could send a message claiming to be from contato@suaempresa.com. To solve this, two earlier mechanisms were created: SPF (RFC 7208), which lists the servers authorized to send emails for your domain, and DKIM, which digitally signs the message to prove it was not altered in transit.

However, a piece was missing: what if an email fails SPF or DKIM? Should the receiving server discard the message, send it to the spam folder, or deliver it anyway? That is exactly the answer DMARC provides. If you want to understand how these three pieces connect before moving forward, check out our article with MX, SPF, DKIM, and DMARC explained without technical jargon.

In addition to closing loopholes for cybercriminals to run scams on clients and vendors using your name, DMARC is no longer optional for anyone concerned with deliverability. Google email sender guidelines and equivalent rules from Yahoo established that domains without complete authentication face severe blocks or have their messages routed straight to junk mail. Having properly configured business email is now a basic operational requirement.

How does DMARC work in practice?

To understand DMARC, you need to understand the concept of identifier alignment. When you send a professional email, two sender addresses are involved:

1. The visible header sender (From): this is the address your client sees in their email application, such as vendas@suaempresa.com.
2. The technical sender (envelope or Return-Path): this is the address used by servers to track delivery errors and evaluate SPF.

Scammers often use their own invisible domain in the Return-Path (which passes their SPF) and place your company's domain in the visible header to deceive the victim. DMARC requires alignment: the visible domain must match the one validated by SPF or by the DKIM cryptographic signature.

When a message reaches its destination, the receiving server executes the following steps:

• Checks if SPF passed and if the domain aligns with the visible sender.
• Checks if the DKIM signature is valid and if the key's domain aligns with the visible sender.
• Queries the DMARC record in the sending domain's DNS.
• If the message fails both criteria, the server applies the policy specified by the domain owner.

If your company sends legitimate messages but has not configured these steps, your business communications face a serious risk of rejection. We explain this issue in detail in our article on why my email goes to spam.

What are the DMARC policies?

The rule you publish in DNS is defined by the p= tag. There are three possible options, representing progressive levels of protection:

1. Monitoring policy (p=none)

Tells receiving servers that even if the message fails authentication, it should be delivered normally to the recipient's inbox (or follow the provider's standard spam filter). This stage exists solely to gather reports and diagnose which legitimate services use your domain without prior authorization.

2. Quarantine policy (p=quarantine)

Specifies that messages failing authentication should be treated with suspicion. Typically, the destination provider delivers them straight to the recipient's spam or junk folder, keeping them out of the main inbox.

3. Rejection policy (p=reject)

This is the highest level of defense. Instructions using p=reject instruct the receiving server to completely block and refuse the message right at the SMTP connection level. It never reaches any folder of the user. Scammers completely lose the ability to send spoofed emails under your domain's name.

DMARC Tag	Name	Function	Practical Example
v	Version	Identifies the protocol (always DMARC1)	v=DMARC1;
p	Policy	Sets the action for the main domain	p=none; or p=quarantine;
sp	Subdomain policy	Sets the action for undeclared subdomains	sp=reject;
rua	Aggregate reports	Email that will receive daily XML summaries	rua=mailto:dmarc@suaempresa.com;
pct	Percentage	Percentage of messages subject to the rule (1 to 100)	pct=100;

How to set up DMARC on your domain step by step

Before adding the DMARC record, you must make sure that your MX, SPF, and DKIM entries are already active and working properly. If you still have questions about verifying these preliminary steps, read our guide on how to verify if your domain is configured for email.

For those looking for a fast setup without technical headaches, Domailo provides an intuitive interface where you manage business inboxes and view all required records in an organized way.

Follow the procedure below to enable DMARC:

Step 1: Access your domain's DNS management zone

Open the panel where your DNS zone is hosted. This can be your website hosting company or a specialized DNS provider like Cloudflare.

Essential note for domains registered with your domain registrar: The basic, free DNS service provided directly in your domain registrar's panel has a known software limitation: it does not accept the underscore character (_) in the record name field. Because the DMARC protocol strictly requires the _dmarc entry, you cannot add it within your domain registrar's DNS. The recommended solution is to point your domain registrar's nameservers to Cloudflare (using Cloudflare's free plan) and register all DNS entries there.

Step 2: Create the initial TXT record

In your DNS zone, add a new entry with the following properties:

• Type: TXT
• Name (or Host): _dmarc (some panels require entering _dmarc.seudominio.com, while others require only _dmarc)
• Content (or Value): v=DMARC1; p=none; rua=mailto:relatorios@seudominio.com
• TTL: 3600 (or Automatic)

Replace relatorios@seudominio.com with an actual mailbox created to receive these files. Do not worry if you receive .xml.gz files: these are consolidated technical reports sent periodically by servers such as Gmail and Yahoo showing who attempted to send emails on your behalf.

Step 3: Review reports for 7 to 15 days

Monitor whether all legitimate systems sending emails for your company (such as your sales CRM, invoicing software, and support platforms) are passing SPF and DKIM. If you notice valid senders failing, fix your SPF before moving forward.

Step 4: Increase protection to quarantine and reject

Once you confirm that only authorized messages carry your domain's signature, edit the value of the TXT record:

1. First switch to quarantine: v=DMARC1; p=quarantine; rua=mailto:relatorios@seudominio.com
2. After another week without false positive incidents, switch to full rejection: v=DMARC1; p=reject; rua=mailto:relatorios@seudominio.com

From that point on, any spoofed message attempting to use your business email will be discarded by major global providers.

Common mistakes when setting up DMARC

Even though it is a straightforward record to type, a few common oversights can compromise a company's communication flow:

• Starting directly with p=reject without testing: if you have an external billing tool or automation system that has not yet been added to your SPF record, your own business emails will be blocked, and clients will not receive invoices or quotes.
• Typing the name without the underscore: adding only dmarc instead of _dmarc causes servers worldwide to simply ignore the policy, as the protocol does not look for names missing the leading character.
• Forgetting to monitor the rua address inbox: report mailboxes can fill up quickly with dozens of compressed technical messages if you send significant daily email volumes.

Straightforward business email for your team

Many email solutions on the market make managing domains and mailboxes unnecessarily challenging for small and medium-sized businesses. Complex tools charge steep per-user prices and require endless configuration inside dashboards designed for massive enterprises.

At Domailo, the value proposition is simple: you get professional email with your company's custom domain and a practical inbox accessed directly via browser (webmail). Instead of charging per employee, Domailo's pricing model is per organization. The Startup plan costs US$ 5/month for up to 2 users, the Essential plan costs US$ 9/month for 5 users and up to 3 domains, and the Team plan costs US$ 19/month supporting up to 20 mailboxes and 10 different domains. If you choose upfront annual payment, you pay for 10 months and get 12 months of service (US$ 50/year on Startup, US$ 90/year on Essential, and US$ 190/year on Team).

If your company needs an integrated office suite with cloud spreadsheets and desktop app synchronization via IMAP/POP, platforms like Google Workspace or Microsoft 365 might be the right fit. However, for the vast majority of businesses that need secure business email on their own domain, shared mailboxes with multiple team logins, and hassle-free administration, Domailo delivers the best experience with predictable costs.

Conclusion: protect your brand reputation today

Configuring DMARC is no longer an advanced server security detail; it is the mandatory baseline defense for deliverability on any professional email setup. By connecting SPF and DKIM under a clear inspection policy, you ensure your company's communications reach your clients and block malicious spoofing attempts.

If you want your business email up and running securely, simply, and cost-effectively, Domailo is the ideal choice. You connect your domain, validate records with ease, and get a 30-day free trial to explore all features hands-on.