Actionable guidance; a staged DMARC rollout that will not break your email
Most SMEs fail with DMARC for one reason. They jump to “reject” before they know which systems legitimately send email.
Step 1; inventory every sender
List every platform that sends email using your domain:
* Microsoft 365 or Google Workspace
* Marketing tools and newsletters
* CRM, ticketing, booking, invoicing, payroll
* Website contact forms and web servers
Step 2; fix SPF and enable DKIM
* Ensure you have one SPF record; keep it tidy.
* Enable DKIM signing for your main email platform and key third parties.
Step 3; publish DMARC in monitor mode
Start with p=none and set reporting addresses. Review reports weekly with your MSP or vCISO.
Step 4; move to quarantine, then reject
* Move to p=quarantine first.
* Then move to p=reject once reports show only legitimate sources are aligned.
Step 5; operationalise it
Add a simple rule. Any new supplier system that “sends email as us” must be added to the sender inventory and aligned before go live.
Compliance and best practice fit; Cyber Essentials, UK GDPR, and NIST
DMARC supports SME cyber security best practices by reducing spoofing, but it should be paired with controls that Cyber Essentials focuses on, such as access control, secure configuration, and patching. DMARC plus MFA (multi-factor authentication) on email admin accounts is a strong baseline for SME cyber resilience.
From a compliance for SMEs perspective, the ICO expects organisations to implement appropriate technical and organisational measures to protect personal data. Reducing impersonation and fraud risk through email authentication is a defensible, proportionate measure, especially where email is used for customer communications. (Reference: ICO Guide to data security.)
If you use NIST Cybersecurity Framework language with boards, DMARC is a clean “Protect” control, with reporting that supports “Detect”.
Quick checklist; what to ask your MSP this week
* Do we have SPF, DKIM, and DMARC published for all domains we use?
* Are we at p=none, quarantine, or reject; and what is the plan to progress?
* Who reviews DMARC reports; and how often?
* Is MFA enforced for email admins and high-risk users?
* Do we have a process for supplier and marketing platforms that send mail as our domain?
