What Is DMARC, and Why It Is No Longer Optional
DMARC is the record that decides whether criminals can send email as your business. Here is how it works, what the three policies really do, and why monitoring alone protects nothing.
Email was designed in an era when everyone on the network knew each other. Nothing in the original protocol stops a stranger from writing your company’s address in the From line of a message and sending it to your clients. DMARC is the standard that finally lets you tell the world’s mailbox providers what to do about that. This guide explains how it works, what each policy actually does, and why a DMARC record that is not enforced protects far less than most businesses believe.
The problem DMARC solves
When you receive an email, the address you see at the top is simply text the sender typed. The mail server that delivered it may have no connection to the domain in that address at all. This is not a bug that was overlooked. It is how the Simple Mail Transfer Protocol worked from the start, and the entire authentication stack built since then exists to compensate for it.
Criminals exploit this constantly. The most damaging version is not the badly spelled prize notification. It is a short, plausible message from what appears to be your accounts department, telling a client that your banking details have changed. The FBI’s Internet Crime Complaint Center recorded $2.77 billion in reported business email compromise losses in 2024, across 21,442 incidents, and that figure only covers what was reported in the United States. South African businesses face the same attack, with the same tools.
Two older standards tried to address the gap. SPF publishes a list of servers allowed to send for a domain. DKIM adds a cryptographic signature to each message. Both are useful, and both have the same blind spot: neither one checks the address your recipient actually sees.
How DMARC works
DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, is a policy you publish as a DNS TXT record at _dmarc.yourdomain. It does three jobs.
1. It requires alignment
This is the part most explanations skip, and it is the heart of the standard. A message passes DMARC only if SPF or DKIM passes and the domain that passed matches the domain in the visible From address.
Why does that matter? Because a criminal can easily send mail that passes SPF for a domain they control. If they send from their own server, authorise it in their own SPF record, and put your address in the visible From line, SPF passes for their domain, not yours. Without alignment, that pass means nothing. DMARC closes the gap by insisting the authenticated domain and the displayed domain are the same organisation.
2. It sets a policy
The p= tag tells receiving servers what to do with mail that fails: nothing, send it to spam, or refuse it.
3. It reports back
The rua= tag gives an address where mailbox providers send daily aggregate reports. These XML files list every IP address that sent email using your domain, how many messages each sent, and whether they passed or failed. This is the only reliable way to discover every system sending as you, legitimate or not.
_dmarc.yourcompany.co.za TXT "v=DMARC1; p=reject; rua=mailto:dmarc@reports.example; adkim=r; aspf=r"The three policies, and what they really do
| Policy | What receivers do with failing mail | Protection |
|---|---|---|
p=none | Deliver it as normal and send you a report | None. Visibility only. |
p=quarantine | Treat it as suspicious, usually by placing it in spam | Partial. The message still arrives and can be opened. |
p=reject | Refuse it during delivery | Full. The forged message never reaches the recipient. |
The first row deserves attention. p=none is a monitoring mode designed for the discovery phase. It exists so you can collect reports and fix your legitimate senders before enforcing anything. It was never meant to be a destination, yet a large share of domains that have DMARC published stop there. We cover why in detail in why monitoring-only DMARC is a false sense of security.
Why it is no longer optional
For years DMARC was treated as good practice for large enterprises. Three things have changed that.
The mailbox providers made it a condition of delivery
Since February 2024, Google and Yahoo require anyone sending more than 5,000 messages a day to their users to publish a DMARC record, alongside SPF, DKIM and alignment. Microsoft applied similar requirements to Outlook.com, Hotmail and Live addresses from 5 May 2025. These rules target bulk senders, and the minimum they ask for is p=none, but they settled the question of whether DMARC is mainstream. We break down exactly who is affected in our guide to the Google, Yahoo and Microsoft sender requirements.
Fraud moved to the channel businesses trust most
Invoices, quotes, remittance advice and payment instructions travel by email. That makes your domain a tool for anyone who wants to redirect a payment. An enforced policy removes the easiest version of the attack, where the criminal uses your exact address.
Your clients and suppliers are starting to check
Procurement questionnaires, cyber insurance forms and security reviews increasingly ask whether a domain enforces DMARC. It is one of the few security controls anyone can verify from the outside in seconds, which makes it an easy yes-or-no question. Try it yourself with our free DMARC checker.
What DMARC does not do
A standard this useful attracts overselling, so it is worth being precise about its limits.
- It protects your exact domain only. A criminal who registers a lookalike, such as a hyphenated version or a different extension, is not affected by your DMARC record.
- It cannot help when a real mailbox is compromised. If a criminal logs into a genuine account, their email is authentic in every technical sense. That problem is solved with strong passwords, multi-factor authentication and monitoring.
- It does not fix every delivery problem. DMARC helps receivers trust your mail, but content, blocklists and sending reputation still matter.
DMARC closes one specific door. It happens to be the door behind a large share of invoice fraud and impersonation, which is why it matters so much.
Getting from nothing to enforcement
The safe path follows the same sequence every time. Publish a monitoring policy with reporting enabled. Use the reports to identify every service sending as your domain. Fix SPF and DKIM for each legitimate one so it passes with alignment. Then step up to quarantine and, once that holds cleanly, to reject. We lay out the full process in our guide to rolling out DMARC from p=none to p=reject.
The difficulty is rarely the DNS record itself. It is the discovery work: the accounting system that emails invoices, the booking platform, the marketing tool someone signed up for two years ago. Miss one, move to reject, and that service’s email stops arriving. That is the risk a managed service exists to remove.
The short version
- Email lets anyone type your address into the From line. DMARC is how you tell receivers what to do about it.
- DMARC passes only when SPF or DKIM passes for the same domain the recipient sees.
p=nonemonitors,p=quarantinefilters,p=rejectprotects.- Google, Yahoo and Microsoft now require DMARC from bulk senders, and clients increasingly check for it.
- The safe route is monitoring, then alignment, then staged enforcement based on report data.
Frequently asked questions
Is DMARC a legal requirement in South Africa?
There is no South African law that names DMARC specifically. But POPIA requires reasonable security measures to protect personal information, the major mailbox providers now require DMARC from bulk senders, and insurers and procurement questionnaires increasingly ask about it. In practice it has become a baseline expectation rather than an optional extra.
Does DMARC work if we only have SPF or only DKIM?
Technically yes, because DMARC passes when either SPF or DKIM passes with alignment. In practice you want both, because SPF breaks when email is forwarded and DKIM is what carries authentication through forwarding and mailing lists.
Where is a DMARC record published?
As a TXT record at _dmarc followed by your domain, for example _dmarc.yourcompany.co.za. A domain may have only one DMARC record. If there are two, receivers treat it as if there were none.
How long before we can move to p=reject?
That depends on how many services send as your domain and how quickly they can be aligned. The only safe answer is to move when the report data shows every legitimate sender passing, not on a fixed date.
Sources and standards
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC). The IETF specification that defines DMARC policies, alignment and reporting.
- Google: Email sender guidelines. Gmail requirements for SPF, DKIM and DMARC, including the rules for bulk senders.
- Yahoo Sender Hub: Sender best practices. Yahoo authentication requirements for senders.
- Microsoft: Outlook’s new requirements for high-volume senders. The April 2025 announcement of SPF, DKIM and DMARC enforcement for domains sending more than 5,000 messages a day.
MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.
Keep reading
SPF Explained: Why a Pass Does Not Always Mean Safe
SPF is the oldest email authentication standard and the most misunderstood. It checks a different address to the one your recipient sees, and it breaks in ways nobody notices until mail stops arriving.
DKIM Explained: The Signature Behind Trusted Email
DKIM is the part of email authentication that survives forwarding and does most of the work for DMARC. It is also the part most often left signing with someone else's domain.
Rolling Out DMARC Safely: From p=none to p=reject
Enforcement is where DMARC protects you and where it can hurt you. This is the sequence that gets a domain to p=reject without blocking the invoices, statements and bookings your business depends on.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.