E-commerce and payments
What is DMARC?
DMARC is a DNS record telling receiving mail servers what to do with messages claiming to be from your domain that fail SPF or DKIM checks. It is the record that actually stops others spoofing your domain, and most small businesses leave it unenforced.
Also called: email authentication · SPF DKIM DMARC
The three policy levels
- p=none
- Monitor only. Reports arrive, nothing is blocked. A starting point, not a destination.
- p=quarantine
- Failing mail goes to spam. The sensible target for most businesses.
- p=reject
- Failing mail is refused outright. Correct once you are confident every legitimate sender is authorised.
Why leaving it at none matters
A domain with p=none is spoofable. Anyone can send mail appearing to come from your business, and receiving servers have been told to take no action. For a business that emails invoices, that is a fraud exposure rather than a technical detail.
How to move up safely
- Publish p=none with a rua reporting address and collect reports for a few weeks
- Identify every legitimate sender — your host, your mail provider, any marketing tool
- Authorise each one in SPF and DKIM
- Move to quarantine, watch the reports, then consider reject
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.