DMARC email authentication is a DNS record that stops criminals from sending fake email that appears to come from your company’s domain, and Gmail and Outlook now use it to decide whether your legitimate mail even reaches the inbox. If your domain doesn’t have one, some of your invoices, newsletters, and client replies are already landing in spam without anyone at your company noticing.
- Google and Microsoft both now reject or downgrade mail from domains that fail authentication checks, even from small senders.
- A missing or misconfigured DMARC record is one of the easiest things for a scammer to exploit when spoofing your company in a phishing email.
- Business email compromise cost victims over $3 billion in 2025 alone, and most of it started with a spoofed or look-alike sender.
- Setting up DMARC wrong can silently block your own marketing emails or invoices, so it needs a monitoring period before enforcement.
- Most Microsoft 365 and Google Workspace tenants can get a working setup in place within an afternoon, then tighten it over a few weeks.
What changed with Google and Microsoft’s rules?
In 2024, Google and Yahoo began requiring bulk senders to authenticate with SPF, DKIM, and DMARC, with a minimum policy of p=none, or face rejected or filtered mail. Microsoft followed with its own high-volume sender requirements starting May 5, 2025, rejecting non-compliant mail sent to Outlook.com, Hotmail, and Live addresses at the SMTP level. Google’s official guidance for domain owners is published on its email sender guidelines page, and Microsoft laid out its policy on the Microsoft Tech Community blog. The published thresholds target senders of 5,000+ messages a day, but the practical effect reaches smaller businesses too. Mail filters increasingly treat a missing DMARC record as a trust signal, not just a compliance checkbox, so a 20-person firm in the North End can see deliverability problems even without hitting that volume.
Why does a missing DMARC record matter for a small business?
Without DMARC, nothing stops someone from sending an email that shows your domain in the From field. A vendor’s accounting team gets a wire instruction that looks like it came from your CFO. A client gets a fake invoice with your logo. The FBI’s Internet Crime Complaint Center recorded over $3 billion in business email compromise losses in 2025, averaging roughly $123,000 per incident, according to the 2025 IC3 Annual Report. Most of those schemes rely on impersonation, not malware, which is exactly what DMARC, SPF, and DKIM are built to catch. We covered the mechanics of these scams in our post on business email compromise for Boston businesses, and DMARC is one of the few controls that stops a spoofed message before an employee ever sees it.
What does a DMARC record actually do?
SPF lists which mail servers are allowed to send on behalf of your domain. DKIM attaches a cryptographic signature to outgoing mail so receivers can confirm it wasn’t altered in transit. DMARC ties the two together and tells receiving servers what to do when a message fails both checks: let it through, quarantine it, or reject it outright. It also gives you a daily report showing every server sending mail using your domain, which is often the first time a business discovers a marketing tool or old CRM integration sending unauthenticated mail on its behalf.
How should a Boston business roll this out without breaking anything?
Start with a policy of p=none. This publishes a DMARC record and turns on reporting without blocking or filtering a single message. Over several weeks, review the aggregate reports to identify every legitimate source sending mail as your domain: your Microsoft 365 or Google Workspace tenant, a bulk-email tool like Mailchimp or Constant Contact, a QuickBooks or invoicing platform, a CRM. Once every legitimate source passes SPF or DKIM, move the policy to p=quarantine, then finally p=reject. Skipping the monitoring step is the most common way businesses accidentally block their own invoices or event emails. If your team is also cleaning up phishing exposure more broadly, our free phishing and spam link checker is a quick way to spot-check suspicious mail while the DMARC rollout is underway.
Frequently asked questions
What is DMARC in simple terms?
DMARC is a DNS record that tells receiving mail servers what to do with email claiming to be from your domain if it fails SPF or DKIM checks. It closes the gap that lets criminals send fake email that looks like it came from your company.
Do small businesses actually need DMARC, or is this just for big senders?
Google and Microsoft’s published rules technically target senders of 5,000+ messages a day, but any domain without a DMARC record is easier to spoof, and a growing share of mail without it lands in spam or gets rejected outright regardless of volume.
Will turning on DMARC break our email?
Only if it’s rushed. Start at p=none to monitor traffic without blocking anything, confirm every legitimate sending source is authenticated, then move to p=quarantine and eventually p=reject over a period of weeks.
How long does it take to set up DMARC correctly?
The DNS record itself takes minutes. Getting to a safe enforcement policy without breaking newsletters, invoicing tools, or a CRM that sends on your behalf usually takes four to eight weeks of monitoring reports first.
If your domain has never had a DMARC record reviewed, or you’re not sure which tools are sending mail on your behalf, that’s worth a direct look before a spoofed invoice reaches one of your clients. Boston Managed IT offers a free 15-minute Microsoft 365 or security review to check your domain’s authentication setup and flag anything sending unauthenticated mail as you. Call (617) 322-5155 or visit bostonmit.com/contact to get started.
— Boston Managed IT
