DMARC for UK SMEs: Stop Spoofing Without Breaking Your Email

Spoofed email is one of the most common fraud vectors affecting SMEs. Attackers don’t need to hack your mailbox to impersonate your brand— they can simply forge messages that appear to come from your domain. DMARC is the control that tells receiving mail servers what to do when a message fails authentication.

Why DMARC matters

• Stops spoofing of your domain (or makes it much harder).
• Improves deliverability when SPF/DKIM are aligned and consistent.
• Provides visibility via reports: who is sending email using your domain.

Alignment in plain English

DMARC checks that the visible From: domain aligns with SPF and/or DKIM. That’s the key detail many setups miss. You can pass SPF and still fail DMARC if SPF is authenticated on a different domain (common with some third-party services).

• SPF alignment: the bounce/envelope domain matches your From domain.
• DKIM alignment: the DKIM signing domain matches your From domain.
• DMARC passes if aligned SPF or aligned DKIM passes (depending on your setup).

Safe rollout (none → quarantine → reject)

• Start: publish DMARC with p=none to collect reports.
• Then: move to p=quarantine once you’ve validated legitimate senders.
• Finally: move to p=reject when you’re confident everything legitimate aligns.

This staged approach is how you avoid breaking mail from website forms, CRMs, accounting systems, and marketing tools.

DMARC reports (what to look for)

• Unexpected sending sources (new IPs, countries, unknown tools).
• Services sending on your behalf that need DKIM/SPF alignment fixes.
• Authentication failures spikes (often caused by DNS changes or migrations).

Common pitfalls

• Multiple SPF records (breaks SPF).
• DKIM published but not signing (keys exist; outbound signing disabled).
• Third-party tools sending with misaligned domains.
• Going straight to reject without monitoring (breaks legitimate senders).