Email protection

Set a policy for faked business email

Why this matters

DMARC tells receiving mail servers what to do with messages that fail checks for your domain. A policy of p=none only watches; it does not ask them to block faked email.

What to do

1. Ask your email provider to check that all legitimate senders pass the email identity checks before changing the policy.
2. Open your domain's DNS settings, usually at the company you bought the domain from. DNS holds public domain records. Add a TXT, or text, record at _dmarc.yourdomain, replacing yourdomain with your actual domain. Start with v=DMARC1; p=none. Some settings ask only for _dmarc as the record name. Update an existing record rather than adding a duplicate.
3. Arrange reporting with your email provider; p=none alone does not set a report destination. Once legitimate mail passes and reports look clean, change to v=DMARC1; p=quarantine, then v=DMARC1; p=reject. Quarantine asks for suspicious mail to go to junk; reject asks for it to be refused.
4. What to tell your web developer: Please configure DMARC with our email provider. Start at p=none, arrange and review reports, then move to p=quarantine and p=reject once all legitimate senders pass. Keep the record at _dmarc on our domain.

How to check the fix

After DNS changes have spread, run the checker again. Expect an advisory for p=none and a pass for quarantine or reject. Confirm real business email still arrives; a pass does not validate the whole email setup.