Email Authentication for Small Business: DMARC Guide
Somewhere right now, a stranger could send an email that looks like it came from your business. It could reach one of your customers or vendors, without ever touching your inbox or your website. Most business owners assume their email provider blocks this automatically. It partially does. The missing piece is usually a policy. That policy tells other mail servers what to do when someone fails the check. It also decides whether to tell you it happened at all. That policy has a name: DMARC. Together with SPF and DKIM, it makes up what’s called email authentication. So here’s what each piece does, and what having them actually in place looks like.
What Happens When Nobody’s Watching Your Domain
Email was never built with a way to verify who actually sent a message. Anyone can type any “from” address into an outgoing email, the same way anyone can write any return address on a paper envelope. Most of the time nothing comes of it. But it means your business domain can be used to send email you never wrote. That email can reach people you actually do business with. For example, a vendor might get an invoice that looks like it’s from you. Or a customer might get a payment request that looks like it’s from your billing address.
It’s easy to assume this doesn’t apply if you don’t send marketing email or bulk newsletters. That’s a different question. This isn’t about how much email you send. It’s about whether anything stops someone else from sending email as you at all. A business that sends five emails a day is exactly as exposed to domain spoofing as one that sends five thousand.
This is also a different problem from the phishing emails that show up in your inbox. That’s its own topic, worth understanding on its own. Instead, this is about your domain being used against someone else. Often, you won’t find out until they call to ask why you’re sending them strange invoices.
SPF, DKIM, and DMARC: The Building Blocks of Email Authentication
These three sit on top of each other, and each one covers something the others don’t.
SPF (Sender Policy Framework) is a list. It’s a record published in your domain’s DNS settings. It names exactly which mail servers are allowed to send email on your behalf. That includes your email provider, and anything else you actually use to send mail. Think of it as a guest list at the door. If a server isn’t on the list, receiving mail systems get suspicious of anything claiming to be from your domain.
DKIM (DomainKeys Identified Mail) is a digital signature. Your mail server signs each outgoing message with a private cryptographic key. The receiving server then checks that signature against a public key published in your DNS. If the message was altered in transit, or wasn’t actually signed by your legitimate mail server, the signature doesn’t match. Think of it as a wax seal on an envelope. It’s proof the message wasn’t tampered with, and that it genuinely came from where it claims to.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instructions. It tells receiving mail servers what to do when a message fails SPF, fails DKIM, or both. The options are to let it through anyway, send it to spam, or reject it outright. DMARC also asks receiving servers to send you reports on what they’re seeing sent from your domain. For many businesses, that’s the first time they discover someone has been impersonating them. Using the same analogy, DMARC is what tells the doorman what to do when someone’s not on the list. It also tells him to let you know it happened.
A domain can have SPF without DKIM, DKIM without a real DMARC policy, or a DMARC record that only watches and never blocks anything. Having some of these pieces isn’t the same as having all three working together.
Why Most Small Businesses Have This Half-Configured
Most small businesses already have SPF, usually without ever setting it up on purpose. Microsoft 365 and Google Workspace both publish a baseline SPF record automatically, as part of getting your account working. That’s so outgoing mail doesn’t immediately land in spam. That’s often where setup stops. DKIM frequently isn’t turned on. DMARC, if it exists at all, is commonly set to monitor-only. That means it collects reports, but doesn’t actually block or flag anything that fails.
This isn’t negligence. It’s the natural result of setup that was done to get email sending, not to get the domain protected. Nobody sat down and decided to skip DMARC enforcement — it just wasn’t part of the original checklist. This gets worse when domain and email management are split across different providers. That’s exactly the situation a GoDaddy-plus-Microsoft-365 setup tends to create. DNS records live in one place. Mail flow is managed in another. Nobody has a clear view of both.
In practice, this is one of the first gaps we find when reviewing a new client’s domain. SPF is present from day one, because the email platform put it there automatically. DKIM is never turned on. DMARC is either missing entirely, or quietly set to monitor-only. Nobody did anything wrong. Nobody ever finished the job.
Why This Is Becoming Harder to Ignore
This used to be treated as an enterprise-only concern. That’s no longer true. Since February 2024, Google has required this for high-volume senders. Any business sending 5,000 or more daily messages to Gmail addresses needs SPF, DKIM, and at least a baseline DMARC record in place. Otherwise, those messages risk being rejected outright. Google tightened that enforcement further in November 2025. Yahoo and Microsoft have followed similar paths. The practical effect: email authentication has quietly become table stakes across the entire email system. It’s no longer a checkbox reserved for large companies with dedicated IT security teams.
The stakes on the impersonation side are real too. The FBI’s 2025 Internet Crime Report recorded phishing and spoofing as the single largest category of complaints that year, at 191,561. That’s more than any other crime type tracked, including extortion and investment fraud. Business email compromise, a category closely tied to look-alike and spoofed sender addresses, accounted for just over $3 billion in reported losses. Phishing that reaches your business is one side of that threat. Your own domain being used to phish someone else is the other side. It’s the side SPF, DKIM, and DMARC are built to close off.
What Getting This Set Up Actually Looks Like
This is a small number of DNS record changes, not new software or hardware to buy. If you’re on Microsoft 365 or Google Workspace, whoever manages that environment can typically confirm and complete SPF and DKIM in well under an hour. Most of the groundwork is already provided by the platform. Microsoft publishes its own step-by-step DMARC setup guide for exactly this scenario.
DMARC is the step worth doing carefully rather than quickly. The realistic path starts with a monitor-only policy. It does nothing but collect reports on what’s being sent from your domain, including anything you didn’t send. After a few weeks of watching those reports, you confirm every legitimate sender is accounted for. Then the policy moves to actually rejecting or quarantining anything that fails. Jumping straight to full enforcement, without that monitoring step, risks silently blocking a legitimate tool you forgot about. That could be an invoicing platform, or a marketing tool sending mail on your behalf.
If you’ve never checked whether your domain has all three of these in place, that’s worth a quick look. The same goes if you’re not sure what your current DMARC policy actually does when something fails. Better to find out now, before it’s your customers fielding the fake invoice instead of you fielding the report. Reach out here.
Frequently Asked Questions
What is DMARC and does a small business actually need it?
DMARC is a DNS record that tells receiving mail servers what to do when an email fails SPF or DKIM checks, and asks them to report that activity back to you. Any business with a domain that sends or receives email is a potential target for spoofing, regardless of how much email it sends. Without DMARC, a business typically has no visibility into whether someone else is sending email pretending to be them.
What’s the difference between SPF, DKIM, and DMARC?
SPF lists which mail servers are allowed to send email for your domain. DKIM adds a cryptographic signature proving a message wasn’t altered and genuinely came from an authorized server. DMARC sets the policy for what happens when a message fails either check, and provides reporting on spoofing attempts. They work together — SPF and DKIM do the checking, DMARC decides the consequence.
Can someone spoof my domain even if I use Microsoft 365 or Google Workspace?
Yes. Microsoft 365 and Google Workspace both publish a basic SPF record automatically, but that alone doesn’t fully protect your domain. Without DKIM and an enforced DMARC policy, someone can still send email that appears to come from your domain, and you likely won’t know it happened unless a recipient tells you directly.
Will setting up DMARC stop phishing emails from reaching me?
Not directly. DMARC protects outbound trust in your own domain — it stops (or exposes) someone using your domain to send email to others. It doesn’t screen the phishing emails landing in your own inbox from other spoofed or malicious domains; that’s a separate problem handled by email filtering and user awareness.
Is setting up SPF, DKIM, and DMARC expensive?
No. These are DNS record changes, not paid software or hardware. For most businesses on Microsoft 365 or Google Workspace, the time investment is the main cost — typically well under an hour for SPF and DKIM, plus a few weeks of monitoring before moving DMARC to full enforcement.
How do I check if my business already has SPF, DKIM, and DMARC set up?
Free online lookup tools can check your domain’s DNS records for all three in seconds. The harder part isn’t checking whether they exist — it’s confirming DKIM is actually signing outgoing mail correctly and that your DMARC policy is set to actually act on failures, not just silently monitor them.