By Kyle Sutherland,
The one-sentence version
DMARC is a public instruction attached to your domain that tells every inbox in the world what to do with email claiming to be from you that fails authentication: deliver it anyway, put it in junk, or refuse it outright.
That is the whole idea. The rest is knowing which instruction to give, and how to get from the safe-but-toothless setting to the one that actually protects you, without losing genuine email along the way. If you want the background on why forging email is possible at all, why criminals can send email as your business covers it in plain English.
The three settings, from weakest to strongest
p=none means watch and report. Inboxes deliver everything exactly as before, but send you reports about what they saw. Nothing is blocked. It is the right place to start and the wrong place to stop: a domain parked on p=none is being monitored, not protected, and forged email still lands.
p=quarantine tells inboxes to treat failures as suspicious, which in practice means the junk folder. Real damage gets much harder, because the forgery arrives pre-flagged in a place nobody trusts.
p=reject is the destination. Mail that fails the checks is refused outright, so the fake invoice never reaches your customer at all. This is the setting that actually closes the door.
The reports: how you find out who is sending as you
DMARC's quiet superpower is the reporting. Once the record is live, the big mail providers send regular summaries of every server they saw sending mail for your domain: your own, your website's, your invoicing tool's, and anything pretending to be you. For a small business, it is the only practical way to ever see that picture.
The reports arrive as dense technical files, which is honestly the least friendly part of the whole system. But with a little tooling and a patient eye they boil down to a simple list: these senders are yours, these are not.
The safe rollout, in order
Never jump straight to reject. The safe path is to publish p=none first and let the reports run for a few weeks, so every legitimate sender you had forgotten about, the invoicing tool, the booking system, the newsletter, shows up and gets properly authorised.
Then tighten to quarantine, watch that genuine mail still lands, and move to reject once the reports run clean. Done in that order, protection arrives without a single real email going missing. Rushed, it is how a business ends up junking its own invoices, which is precisely the fear that keeps so many domains unprotected.
Do it yourself, or have it done
Nothing here is beyond a careful owner. Your email provider's guides cover publishing the records, and the reports will tell you the truth about your senders. Budget a few patient hours spread over a few weeks, most of it waiting and reading.
If you would rather hand it over, the staged rollout, the report-reading and the final tightening are part of the email security work on the services page, done for a fixed price and explained as it goes. Either way, start with the free security check: it reads your domain's records in seconds and tells you whether you have a DMARC problem to solve at all.