How to Set Up DMARC for a Small Business – A Step‑by‑Step Guide

Email spoofing remains one of the easiest ways for cyber‑criminals to target small businesses. A well‑configured DMARC (Domain‑based Message Authentication, Reporting & Conformance) policy tells receiving servers which messages are legitimate and what to do with unauthorised ones. For UK small businesses, DMARC also helps demonstrate the email security controls required for Cyber Essentials, which is issued via an accredited body.

Why DMARC matters for a small business

Without DMARC, a malicious actor can send an email that appears to come from your domain – for example, a fake invoice or a phishing link. The UK Government Cyber Security Breaches Survey repeatedly highlights that phishing is the most common attack vector for SMEs. By publishing a DMARC record you:

• Reduce the risk of brand damage and financial loss.
• Improve deliverability of legitimate mail, because receivers trust your domain.
• Gain visibility through aggregate reports that show who is sending mail on your behalf.
• Support compliance with Cyber Essentials, which expects SPF, DKIM and DMARC to be in place.

Prerequisites before you start

Before you touch DNS, make sure you have:

• Access to your domain’s DNS management console (often via your registrar or hosting provider).
• An active SPF record that lists all authorised sending servers.
• DKIM signing enabled on your outbound mail server or third‑party service (e.g., Microsoft 365, Google Workspace).
• A dedicated email address to receive DMARC aggregate reports, such as dmarc-reports@yourdomain.co.uk.

If any of these are missing, set them up first – the DMARC policy relies on both SPF and DKIM passing alignment checks.

Step 1: Verify your existing SPF and DKIM records

Use a DNS lookup tool (or Solvbeat’s free scanner) to confirm the records are present and correctly formatted.

Check SPF

Look for a TXT record that begins with v=spf1. A typical entry for a small business using Microsoft 365 and a marketing platform might look like:

Make sure the -all qualifier is at the end – it tells receivers to reject any server not listed.

Check DKIM

DKIM is usually set up through your mail provider. For Microsoft 365 you’ll publish a CNAME that points to selector1‑domainkey.yourdomain.co.uk. Verify the selector name and that the public key resolves correctly.

Step 2: Create a DMARC policy

A DMARC record is also a TXT record, placed at the sub‑domain _dmarc.yourdomain.co.uk. Start with a “monitoring” policy so you can see what would happen without affecting legitimate mail.

Basic policy syntax

Here is a minimal example:

Key tags explained:

• v=DMARC1 – version identifier.
• p=none – instructs receivers to take no action (just report).
• rua – address for aggregate reports (XML format).
• ruf – address for forensic reports (optional, may generate more data).
• fo=1 – request reports if either SPF or DKIM fails.

Save this string for the next step. When you feel comfortable, you can tighten the policy to p=quarantine (send to spam) or p=reject (block outright).

Step 3: Publish the DMARC record in DNS

Log into your DNS provider’s control panel and add a new TXT record:

• Name/Host: _dmarc (some panels require the full name _dmarc.yourdomain.co.uk).
• TTL: 1 hour (or the default). A short TTL makes future changes propagate quickly.
• Value: paste the DMARC string from Step 2.

After saving, use a DNS lookup tool to confirm the record is visible. It may take a few minutes for propagation.

Step 4: Monitor reports and adjust the policy

DMARC reports arrive as compressed XML files. They can look intimidating, but several free tools (e.g., dmarcian, Postmark DMARC) parse them into readable dashboards.

What to look for in the first weeks

• Unauthenticated sources: If you see legitimate services missing from SPF/DKIM, add them.
• Alignment failures: Ensure the “From” domain matches the domain used for SPF and DKIM signatures.
• Volume spikes: A sudden surge in failed messages may indicate a phishing campaign targeting your brand.

Based on the findings, update your SPF/DKIM records and then move the DMARC policy from p=none to p=quarantine. Keep the policy at p=quarantine for a few weeks, watching the reports. When the failure rate is consistently low (ideally under 1 % of total mail), switch to p=reject for full protection.

Step 5: Align DMARC with Cyber Essentials

Cyber Essentials, issued via an accredited body, expects organisations to demonstrate that email authentication mechanisms are in place. When you complete the steps above you will have:

• SPF record covering all outbound servers.
• DKIM signing enabled for your primary mail service.
• DMARC policy publishing and evidence of monitoring.

During a Cyber Essentials assessment you will be asked to provide the DMARC TXT record and a sample of recent aggregate reports. Having a tidy DNS configuration and a clear reporting process makes that part of the audit straightforward.

Additional tips for UK small businesses

• Use a UK‑based DNS provider: Faster propagation and local support can reduce downtime.
• Keep your reporting mailbox tidy: Set up a rule to auto‑archive DMARC reports after they are processed.
• Document changes: Record every SPF/DKIM/DMARC amendment in a simple change‑log – this helps auditors and future IT staff.
• Review quarterly: The email landscape evolves; a quarterly check ensures new services are added to SPF and DKIM.

By following this step‑by‑step guide you’ll dramatically lower the risk of phishing attacks that exploit your domain, improve mail deliverability and stay on track for Cyber Essentials certification.

Ready to see how your current DNS configuration measures up? Run a free scan →