Learn · Guide · 5 min read

What is DMARC, and how to set it up safely

DMARC is one of the cheapest, highest-impact security wins available, and most small businesses don't have it. Here's what it does and how to turn it on safely.

The problem it solves

By default, nothing stops a scammer from sending email that appears to come from your domain. That's how "the CEO" emails accounting asking for a wire transfer, or how a fake invoice reaches your customers. DMARC, working with SPF and DKIM, lets you tell the world's mail servers which senders are really yours and what to do with the rest.

The three records

• SPF lists which servers may send mail for your domain.
• DKIM adds a cryptographic signature that proves a message really came from you and wasn't altered.
• DMARC ties them together and tells receivers what to do with mail that fails, plus sends you reports.

Turn it on without breaking your email

The safe path is to start in monitoring mode, watch, then tighten. First make sure SPF and DKIM are set up (your email provider has guides). Then add a DMARC record:

Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]

With p=none, nothing is blocked yet, but you start receiving reports showing who's sending as you. After two to four weeks, once you've confirmed your legitimate senders pass, move to p=quarantine (suspicious mail goes to spam), and finally p=reject (it's refused outright).

Common mistakes

• Jumping straight to p=reject and silently losing real mail. Always start at none.
• Forgetting a legitimate sender like a newsletter tool or your CRM. The reports catch these.
• Setting up DMARC but never reading the reports. A report-viewing service makes them readable.

Torva checks for SPF and DMARC on every scan and flags what's missing, so you'll know the moment your email protection slips.

---