Introduction
If you've heard your IT team talk about DMARC and walked away with the impression that it's something to do with email and probably important, you're in the right place. This article is DMARC explained without jargon — what it actually does, why it matters to the business, and what decisions might land on your desk.
No code, no acronyms-on-acronyms, no DNS rabbit holes. Just the operating model. If you want the deeper beginner's guide to DMARC when you're ready, it's one click away.
What DMARC actually does, in one paragraph
When somebody sends an email, the receiving mail server has to decide whether to deliver it. DMARC is a public sign your company posts on the internet that says: "For mail claiming to come from us, here are the rules to check, and here's what to do if those rules aren't met." You can tell the world's mailbox providers to monitor only (just tell us what you saw), soft-block (deliver to spam if suspicious), or hard-block (don't deliver at all). The most common destination is hard-block, because at that point nobody can send an email that looks like it's from your company unless they actually are your company.
That's it. Everything else is mechanics.
Why your company needs to care
Three reasons, in order of how often they show up in board conversations:
- Your customers are getting phished using your brand. Attackers send fake invoices, fake password resets, fake CEO requests — all with your company's domain in the "From" address. Without DMARC, mailbox providers have no way to know it's fake. Your customer opens it, things go wrong, and the support call comes to you.
- Your marketing email is starting to land in spam. Google, Yahoo, and Microsoft now require DMARC for any company sending more than ~5,000 messages per day to their users. "5,000 messages per day" is easier to hit than people realise — newsletters plus transactional plus sales outreach plus billing reminders adds up fast.
- Your cyber insurance is asking about it. Underwriters now check DMARC posture before binding policies. A domain without DMARC pays more, or gets declined.
These reasons add up to roughly: "the cost of doing nothing is rising every quarter."
How it works, told as a story
Picture the postal service. Anyone can drop a letter in any mailbox with any return address. The receiver has to decide whether the return address is real.
DMARC is like every company in the world posting a sign at the post office that says: "Letters from us have a specific stamp and signature. If a letter shows up claiming to be from us but doesn't have them, here's what to do." The choices are:
- Watch and tell me. Deliver it normally, but mention it in the daily report.
- Move it to the back room. Don't put it in the recipient's inbox; put it in a side stack labelled "probably junk."
- Return to sender. Don't deliver at all.
Most companies' posted instructions eventually say "return to sender" — that's the equivalent of p=reject in the technical world.
The two underlying mechanisms that produce the "stamp and signature" are SPF (a list of IP addresses your domain is allowed to send from) and DKIM (a cryptographic signature added to each message). DMARC ties them together and gives them an enforcement instruction. How they work together is a separate read.
What your IT team is actually working on
When your IT team says "we're rolling out DMARC," here's what they're actually doing, in business terms:
- Inventorying senders. Listing every tool, vendor, and team that sends email using the company domain. Marketing's email platform, the CRM, the invoicing system, the help desk, individual sales reps. The list always surprises someone.
- Configuring each sender properly. Making sure every legitimate tool is on the "allowed list" and signs its messages correctly. This is the bulk of the work.
- Publishing the sign. Adding the DMARC instruction to the company's DNS — a one-time update.
- Watching reports. Mailbox providers now send daily summaries of what they saw. The team reviews these to confirm that legitimate mail is passing and that no surprise senders appear.
- Tightening the instruction over time. Starting with "watch and tell me," moving to "back room," ending at "return to sender." This usually takes 2-3 months.
The full step-by-step guide is for the engineers; you mostly need to know the shape of the work.
Where the business needs to weigh in
A DMARC rollout is mostly technical, but three decisions are business-side:
- Which subdomains to protect. Most companies have
brand.com,mail.brand.com,notifications.brand.com,careers.brand.com— each is a separate decision. The technical default protects all subdomains together; business teams sometimes need an exception. DMARC for subdomains covers it. - When to tighten the instruction. Moving from "watch and tell me" to "return to sender" carries some risk of blocking a misconfigured legitimate sender. The IT team will want sign-off on the timeline.
- How aggressive to be with reports. Some companies treat DMARC monitoring as a security function (the CISO owns it); others treat it as marketing infrastructure (deliverability). DMARC for CEOs and DMARC for CISOs frame the ownership question.
Best practices for non-technical leaders
- Treat DMARC as infrastructure, not a project. Once the rollout is done, the ongoing monitoring is small and steady. Don't budget it as a one-time line item; budget it as ops cost.
- Ask for the dashboard, not the XML. Good DMARC platforms show "% of your mail that's authenticated" in a single number. If your team is sending you raw XML reports, ask for a summary instead.
- Include DMARC in vendor onboarding. Whenever marketing or another team signs up for a new email-sending tool, the DMARC posture should be checked as part of intake.
- Don't skip the monitoring phase. Pushing your team to "just turn on the strict policy" is how legitimate email gets blocked. The monitoring phase has a purpose; respect the timeline.
- Renew the conversation when sending tools change. A new CRM, a new marketing platform, a new help-desk system — each requires the team to recheck DMARC compliance.
Recommended next step
Ask one question of your IT team: "What's our current DMARC policy and what percentage of our mail is currently passing authentication?" The answer tells you exactly where you are. If they don't know, that's the data point.
If the answer is "we don't have one," the next step is a free audit — DMARC AI's domain checker produces a posture report in under a minute and shows exactly what's missing.
FAQ
Does DMARC stop all phishing?
No. It stops one specific kind: emails with your domain in the From address. It doesn't stop look-alike domains (yourcompany-support.com), display-name attacks ("Your CEO <[email protected]>"), or compromised accounts. Does DMARC stop phishing? covers the limits.
Will it affect our marketing email?
If your marketing tools (Mailchimp, HubSpot, etc.) are properly configured, no. The rollout includes a check that all legitimate senders are set up correctly before tightening enforcement. The risk is reversed if you do nothing — non-DMARC senders increasingly get filtered to spam by default.
How long does it take?
For a typical mid-sized company, 8-12 weeks from start to "fully enforced." Most of that time is monitoring and remediation; the actual technical change in DNS is a 5-minute job.
How much does it cost?
The DNS change is free. The monitoring platform (which you need to make sense of the reports) is typically a per-domain monthly subscription — for an SME, in the low hundreds per year. For larger enterprises, more depending on domain count.
Who owns it long-term?
Usually IT or the security team. Some companies put it under marketing because deliverability is the more visible business impact. DMARC for IT managers covers the IT-owned model.
Final thoughts
DMARC is one of those rare initiatives where the technical mechanism is more complicated than the business impact. The business impact is simple: customers can't be phished using your domain, your marketing gets delivered, your insurer is happy.
The technical mechanism takes a couple of months and then runs itself, with a dashboard your team checks weekly. If you're hearing about DMARC for the first time as a non-technical leader, the right reaction is to make sure it's underway — not to dive into the acronyms.