How to Set Up DMARC for a Small Business – A Step‑by‑Step Guide

Why DMARC matters for UK small businesses

Phishing and business‑email compromise are among the most common threats highlighted in the UK Government Cyber Security Breaches Survey. Even a single successful spoofed email can damage a small company’s reputation, lead to financial loss, or expose sensitive client data. DMARC (Domain‑based Message Authentication, Reporting & Conformance) sits on top of SPF and DKIM, giving you a way to tell receiving mail servers what to do with unauthenticated messages and to receive detailed reports about abuse attempts. Implementing DMARC is therefore a low‑cost, high‑impact step towards the Cyber Essentials requirements that many UK businesses pursue.

Prerequisites before you start

Before you dive into DMARC, make sure you have the following in place:

• A domain name that you control (e.g. yourcompany.co.uk).
• Access to your DNS provider’s management console – this is where you will add TXT records.
• SPF and DKIM already published for the domain. DMARC will only be effective if these two mechanisms are working correctly.
• An email address where you can receive aggregate reports (usually something like reports@yourcompany.co.uk).

If any of these items are missing, pause and set them up first – trying to publish a DMARC record without SPF or DKIM will generate a lot of false‑positive failures and make troubleshooting harder.

Step 1: Verify your existing SPF and DKIM records

Log in to your DNS console and look for TXT records that start with v=spf1 and v=DKIM1. If you are using a hosted email service such as Microsoft 365 or Google Workspace, the provider will usually give you the exact values to copy.

To test them, send a test email from your domain to an external address (e.g. a personal Gmail account) and inspect the full email headers. Look for lines like Received-SPF: pass and DKIM-Signature. If either check fails, correct the record before moving on – DMARC will reject any message that fails SPF or DKIM when you later enforce a stricter policy.

Step 2: Draft your initial DMARC policy

Start with a “monitor‑only” policy so you can see what would happen without affecting legitimate mail. The basic syntax of a DMARC TXT record is:

Explanation of the tags:

• v=DMARC1 – identifies the record as DMARC.
• p=none – tells receivers to take no action (just report).
• rua – address for aggregate reports (daily XML summaries).
• ruf – address for forensic reports (individual failure details – optional).
• pct=100 – apply the policy to 100 % of messages.

Replace the email addresses with ones you control. If you prefer not to receive forensic reports, you can omit the ruf tag.

Step 3: Publish the DMARC record in your DNS

In your DNS console, create a new TXT record with the name _dmarc.yourcompany.co.uk (the leading underscore is mandatory). Paste the policy you drafted into the value field. Save the record and allow the TTL (time‑to‑live) to expire – most providers update within a few minutes, but give it up to an hour.

To confirm the record is live, use a free lookup tool such as MXToolbox DMARC lookup. The tool should display the exact TXT you entered and indicate that the syntax is valid.

Step 4: Monitor reports and interpret the data

After the record propagates, you will start receiving aggregate reports at the address you specified in rua. These reports are sent in XML format and can be a little daunting, but several free services (e.g. dmarcian or Postmark DMARC) will parse them and present a readable dashboard.

Key things to look for in the first few weeks:

• All legitimate sending sources (your own mail server, marketing platforms, CRM tools) should appear as “pass”.
• Any “fail” entries usually indicate a third‑party service that is still using your domain without proper DKIM signing.
• The volume of “none” results tells you how many messages are being sent from unauthenticated sources – these are the ones you will want to block later.

If you spot unknown sources, contact the vendor or remove the unauthorised sending IPs from your SPF record. Adjust your SPF include: statements until the reports show only expected traffic.

Step 5: Move to a stricter policy

Once you are confident that all legitimate mail passes SPF and DKIM, you can tighten the policy. A common progression is:

• p=quarantine – tells receivers to treat failing messages as spam.
• p=reject – tells receivers to outright reject failing messages.

Update the TXT record accordingly, for example:

Keep monitoring for at least a week after each change. If you see a sudden increase in rejected mail from your own users, you may have missed a sending source – revert to p=none, investigate, then re‑apply the stricter setting.

Common pitfalls and how to avoid them

Missing sub‑domains – DMARC does not automatically apply to sub‑domains. If you send from info.yourcompany.co.uk, either publish a separate DMARC record for that sub‑domain or add sp=none (or sp=quarantine) to the organisational record to cover sub‑domains.

Too many DNS lookups – SPF records are limited to ten DNS lookups. Over‑complicating SPF with many include: statements can cause SPF to fail, which in turn breaks DMARC. Consolidate IP ranges where possible.

Forgetting to update third‑party services – Marketing platforms, invoicing software or help‑desk tools often send mail on your behalf. Most providers have a “custom domain” setting where you can add your DKIM key; failing to do so will generate DMARC failures.

Ignoring reports – The DMARC aggregate report is a valuable feedback loop. Treat it as a regular security‑maintenance task, much like checking your firewall logs.

What Solvbeat can do for you

Setting up DMARC is only the first step in a broader email‑security programme. Solvbeat offers a free website and email scanner that checks whether your SPF, DKIM and DMARC records are correctly configured, highlights mis‑configurations and provides a clear remediation plan. While Solvbeat is not an accredited Cyber Essentials certification body, we can help you prepare the technical evidence required for certification via an accredited body.

Ready to see whether your domain is protected? Run a free scan →