What DMARC does
When an email arrives, the mail server checks it against your SPF and DKIM records. DMARC is your rule for an email that fails those checks. It also asks mail servers to send you reports, so you can see who is sending email as you.
The three settings
- None: watch only. Fakes still arrive, but you get reports.
- Quarantine: emails that fail go to spam.
- Reject: emails that fail are blocked.
Why small firms need it too
Criminals copy names that people trust, and your customers trust you. Large email providers also look for DMARC when they decide whether your own emails are real, so it helps your invoices and replies arrive.
How to start safely
Start at none, read the reports for a few weeks and fix any tool of yours that fails. Then move to quarantine, and later to reject. Going straight to reject can block your own invoices or website forms.
Common questions
Will DMARC stop my own emails arriving?
Not if you start at none and fix your own senders first. Move to quarantine or reject only once the reports show that all your own tools pass.
Do I have to pay for DMARC?
No. It is a free line of text at your domain provider. Xevrion's free check shows which setting you have now.
Sources
- Email security and anti-spoofing. National Cyber Security Centre. Published 7 October 2019.
Last checked: 4 October 2026.