DMARC in South Africa: The Complete 2026 Guide for Businesses

DMARC is a DNS record that tells receiving servers what to do with email that claims to come from your domain but fails authentication. For South African businesses in 2026 it is no longer optional: major mailbox providers expect it, invoice and banking-detail fraud depends on spoofing it would block, and it is a reasonable technical safeguard under POPIA.

What DMARC does, and what it does not

DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of two older standards. SPF lists the servers allowed to send for a domain. DKIM adds a cryptographic signature to each message. DMARC adds the two things they were missing: a rule that the authenticated domain must align with the domain the recipient actually sees in the From line, and a published policy telling receiving servers what to do when a message fails.

The record lives in DNS at _dmarc.yourcompany.co.za and looks something like this:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.co.za

The p tag is the policy. p=none means “deliver as normal, but send me reports”. p=quarantine means “treat failures as suspicious”, which usually means the junk folder. p=reject means “refuse failures outright”. The rua tag tells receiving servers where to send daily aggregate reports, which are the raw material for everything else in this guide. Reading them well is a skill in its own right.

It is equally important to be clear about the limits. DMARC protects the exact domain you publish it on. It does not stop a criminal registering yourcompany-za.com, it does not stop display-name tricks where the visible name says your MD but the address is a free webmail account, it does not help if a real mailbox has been compromised, and it does nothing about inbound spam or malware. It closes one door completely. That door happens to be the one most invoice fraud walks through first.

Why South African businesses are a target

The local fraud pattern is well known to every finance manager who has been on the receiving end of it. A supplier, or someone pretending to be one, emails to say the banking details have changed. The next payment goes to a mule account and is gone within hours. A variant targets the other direction: your clients receive an invoice that appears to come from you, with a new account number at the bottom.

Business email compromise is a global problem, not a local one. The FBI’s Internet Crime Complaint Center reported roughly US$2.77 billion in business email compromise losses for 2024. South Africa has the same ingredients that make the scam profitable: widespread EFT payments, supplier relationships run almost entirely over email, and a large number of small and medium businesses whose domains have never been configured beyond “the email works”.

Spoofing your exact domain is the cheapest version of this attack. It requires no registration, no compromised password and no lookalike. If your domain has no DMARC record, or sits on p=none indefinitely, a receiving server has no instruction to refuse a forged message. We cover the mechanics in detail in how email spoofing leads to invoice fraud and CEO impersonation.

The global mailbox rules that changed the baseline

For years DMARC was a security recommendation that most businesses could defer. That changed when the large mailbox providers started enforcing authentication as a condition of delivery.

• Google and Yahoo, February 2024: senders of more than 5,000 messages a day to their users must have SPF, DKIM and a DMARC record in place, with alignment, plus easy unsubscribe for marketing mail. All senders are expected to have at least SPF or DKIM.
• Microsoft, May 2025: similar requirements were applied to high-volume senders delivering to Outlook.com, Hotmail and Live consumer addresses.

Most South African SMEs do not send 5,000 messages a day to Gmail users. That misses the point. These rules signalled that unauthenticated mail is now treated as a deliverability risk across the board, and filtering systems at every scale take authentication into account. A newsletter run, a month-end statement batch or a busy accounts department can push a domain into territory where weak authentication costs inbox placement. Authentication is now part of the price of reliable delivery.

Where POPIA fits

The Protection of Personal Information Act does not mention DMARC, and nobody should tell you that publishing a record makes you compliant. What POPIA does say, in section 19, is that a responsible party must secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures to prevent loss, damage and unlawful access. Section 22 requires notification to the Information Regulator and affected data subjects when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

Email impersonation is a common route to exactly that kind of exposure: a spoofed request for a staff list, a payroll file or client records. DMARC at enforcement is a low-cost, widely recognised control that directly reduces that risk, which makes it a reasonable inclusion in a POPIA security programme. It should sit alongside multi-factor authentication, staff awareness training and payment verification procedures, not replace them. Treat this as context, not legal advice.

The five-stage path from nothing to p=reject

The single biggest mistake we see is a business jumping straight to p=reject without knowing who sends on its behalf. The payroll provider, the accounting package, the website contact form and the marketing platform all send as your domain, and a premature reject policy can quietly block them. The opposite mistake is just as common: publishing p=none and never moving, which leaves you with reports but no protection.

A disciplined rollout follows five stages:

The Observe stage deserves patience. Many senders only appear at month-end (statements, payslips, debit order notifications) or quarterly. Moving to enforcement before you have seen a full cycle is how legitimate invoices end up rejected. The step-by-step mechanics are covered in our guide to the DMARC policy rollout from p=none to p=reject.

Two often-overlooked details belong in every rollout. First, parked domains: defensive registrations and old brand names that never send mail should be locked down with v=spf1 -all and p=reject immediately, because nobody legitimate will be affected. Second, SPF hygiene: SPF has a hard limit of 10 DNS lookups and 2 void lookups, and a record that exceeds them produces a permanent error that undermines the whole setup.

What it costs and how to choose help

There are three broad ways to get DMARC done, each with a different cost profile:

• Do it yourself. The DNS records are free. The cost is time: reading XML reports, identifying senders, chasing vendors for DKIM keys, and remembering to check back after every new tool is adopted.
• Self-service DMARC software. Dashboards that parse reports for you, often priced in dollars. Useful if you have an in-house email administrator, but the interpretation and remediation work remains yours.
• A managed service. Someone else reads the reports, fixes the senders and recommends each policy step. You approve the changes.

Our article on how much DMARC costs in South Africa breaks these down with a decision table. Whichever route you choose, use this checklist to judge a provider or plan:

1. Does it cover every domain you own, including parked ones?
2. Who reads the reports, and how often?
3. Who contacts third-party senders to fix alignment?
4. Is the move to enforcement evidence-based and approved in writing, with a rollback path?
5. What happens when a new sender appears six months later?
6. Does it require mailbox passwords? (It should not. DMARC is DNS work.)
7. Is pricing in rand, and are there setup fees?

How MailMarq helps

MailMarq runs this five-stage process as a managed service for South African businesses, agencies and IT providers, on annual rand pricing with no setup fees. We start with a free assessment of your DMARC, SPF, DKIM, MX and parked domains, then take you to enforcement with your written approval at each step. You can check your domain now, or talk to us about your setup.

Frequently asked questions

MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.