If anyone can send email that appears to come from your domain — and right now, without DMARC enforcement, they probably can — your business is exposed to domain spoofing, phishing attacks that impersonate your brand, and Business Email Compromise.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the email authentication standard that closes this gap. This guide explains how DMARC works, how to set it up for Google Workspace, Microsoft 365, and Zoho Mail, and how to move safely from monitoring to full enforcement without accidentally blocking legitimate email.
What is DMARC?
DMARC is a DNS-based email authentication protocol that works alongside two other standards:
- SPF (Sender Policy Framework) — specifies which mail servers are authorised to send email from your domain
- DKIM (DomainKeys Identified Mail) — adds a cryptographic signature to outgoing emails that receiving servers can verify
- DMARC — tells receiving mail servers what to do when an email fails SPF or DKIM: do nothing (p=none), send to spam (p=quarantine), or reject it outright (p=reject)
DMARC also enables reporting — receiving mail servers send back aggregate reports showing all email sources that sent mail from your domain, whether they passed or failed authentication. This gives you visibility into legitimate senders you may not have configured (CRMs, marketing tools, HR systems) and attackers trying to use your domain.
Why DMARC Matters for Indian Businesses
- Prevents domain spoofing — attackers cannot send phishing emails that appear to come from
yourcompany.comonce you reach p=reject - Improves email deliverability — DMARC-aligned domains have better delivery rates; Gmail and Outlook are more likely to route your legitimate emails to the inbox, not spam
- Required for bulk senders — Google and Yahoo mandated DMARC for bulk email senders (5,000+ emails/day to Gmail) starting February 2024. This requirement will extend to all senders over time
- DPDP Act compliance — demonstrates due diligence in protecting your brand and customer communications
- Stops BEC at the domain level — when combined with DKIM and SPF, p=reject prevents exact-domain spoofing (though not lookalike domains — that requires AI-powered impersonation detection)
The Three Layers: SPF, DKIM and DMARC
SPF — Sender Policy Framework
SPF is a DNS TXT record that lists the IP addresses and mail servers authorised to send email from your domain.
How it works: When an email arrives claiming to be from yourcompany.com, the receiving server looks up the SPF record for yourcompany.com in DNS. If the sending server's IP is listed in the SPF record, the email passes SPF. If it isn't, the email fails SPF.
Basic SPF record format:
v=spf1 include:_spf.google.com ~all
This record says: emails from Google's mail servers are authorised; all others should be treated with soft-fail (~all).
For Microsoft 365:
v=spf1 include:spf.protection.outlook.com ~all
For Zoho Mail:
v=spf1 include:zoho.in ~all
SPF limitations:
- SPF only checks the "envelope from" address (used during SMTP delivery), not the "header from" address (the one displayed to recipients)
- SPF breaks when email is forwarded (the forwarding server's IP is not in the original SPF record)
- SPF has a maximum of 10 DNS lookups — including third-party services in your SPF record (CRMs, marketing tools) can cause you to exceed this limit, causing legitimate emails to fail
DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to the email header, signed with a private key held by your email provider. Receiving servers verify the signature using the corresponding public key published in your DNS.
How it works: Your email server signs outgoing messages with a private key. The receiving server finds the corresponding public key in your DNS (selector._domainkey.yourcompany.com) and verifies the signature. If the signature matches, the email passes DKIM — and the email content has not been tampered with in transit.
Why DKIM matters for forwarding: Unlike SPF, DKIM survives email forwarding (as long as the message body isn't altered). This makes DKIM the more reliable of the two authentication methods.
Setting up DKIM:
- Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record. Add the CNAME record to your DNS.
- Microsoft 365: Admin Center → Security → Email & collaboration → Policies & rules → Threat policies → DKIM. Enable DKIM for your domain and add the CNAME records to DNS.
- Zoho Mail: Zoho Admin Console → Mail Administration → Email Authentication → DKIM. Generate and add the TXT record.
DMARC — Domain-based Message Authentication
DMARC ties SPF and DKIM together with a policy. It adds three key concepts:
-
Alignment — the "from" address in the email header (what the recipient sees) must align with the domain that passed SPF or DKIM. This prevents attackers from passing SPF with one domain while displaying a different domain to the recipient.
-
Policy — what the receiving server should do with emails that fail DMARC:
p=none— take no action; send reports only (monitoring mode)p=quarantine— send failing emails to spam/junkp=reject— block failing emails entirely (enforcement mode)
-
Reporting — receiving servers send aggregate reports (rua) and forensic reports (ruf) to your specified email addresses, showing all sources that sent email from your domain.
Setting Up DMARC — Step by Step
Step 1 — Verify SPF is Configured
Before setting up DMARC, confirm SPF is correctly configured for your domain.
Use MXToolbox (mxtoolbox.com/spf.aspx) to look up your domain's SPF record. You should see a single SPF TXT record returning v=spf1 include:....
If you have no SPF record, or multiple SPF records (only one is allowed), fix this before proceeding.
Step 2 — Verify DKIM is Configured
Confirm DKIM is enabled and the DNS record is published. Send a test email to a Gmail account and view the original message headers — look for DKIM=pass in the Authentication-Results header.
Step 3 — Publish Your First DMARC Record (p=none)
Add a DNS TXT record for _dmarc.yourcompany.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com; ruf=mailto:dmarc-failures@yourcompany.com; fo=1
Record breakdown:
v=DMARC1— DMARC version (always DMARC1)p=none— monitoring only; no action on failing emailsrua=— aggregate report destination (daily summary from receiving servers)ruf=— forensic report destination (individual failure reports)fo=1— generate forensic reports on any authentication failure
Why start with p=none? You almost certainly have legitimate email sources you haven't configured yet — your CRM (Salesforce, Zoho), your marketing tool (Mailchimp, Sendinblue), your HR system, your invoicing software. Jumping straight to p=reject without knowing all your sources will block legitimate emails your business depends on.
Step 4 — Analyse DMARC Reports
DMARC aggregate reports arrive daily in XML format — not human-readable. Use a DMARC reporting tool to parse and visualise them:
Free options:
- dmarcian.com (free tier)
- Postmark DMARC (postmarkapp.com/tools/dmarc)
- Google Admin Toolbox (for GWS domains)
Included in email security platforms:
- Mimecast DMARC Analyser (included in most Mimecast plans)
- Barracuda Email Protection (DMARC monitoring included)
- Proofpoint Email Fraud Defence
Look for:
- Legitimate sources that are failing — your CRM, marketing tool, etc. These need DKIM signing or SPF inclusion before you move to enforcement
- Unknown sources sending mail — attackers or unauthorised employees using your domain
Step 5 — Fix Failing Legitimate Sources
For each legitimate source that is failing DMARC:
- Contact the service provider and ask them to enable DKIM signing for your domain
- OR add their sending IPs to your SPF record (if you have SPF lookup headroom)
- Confirm the source passes DMARC in your reports before moving to enforcement
Common sources that need configuration:
- Marketing email tools (Mailchimp, HubSpot, Sendinblue) — all support custom DKIM signing
- CRM email sending (Salesforce, Zoho CRM) — add DKIM in their DNS settings
- HR platforms (Darwinbox, Keka) — check their email authentication settings
- Accounting/invoicing platforms (Tally, Zoho Books) — add sending domains to SPF
Step 6 — Move to p=quarantine
Once you've confirmed all legitimate sources are passing DMARC (typically 2–4 weeks of monitoring), update your DMARC record to:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourcompany.com
The pct=25 parameter tells receiving servers to apply the quarantine policy to only 25% of failing emails. This is a safety net — if you missed a legitimate source, only 25% of those emails will be quarantined, giving you time to investigate without blocking all legitimate mail.
Monitor for 1–2 weeks. Gradually increase: pct=50, then pct=75, then pct=100.
Step 7 — Move to p=reject (Full Enforcement)
Once you are confident all legitimate sources are passing DMARC, move to full enforcement:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com; ruf=mailto:dmarc-failures@yourcompany.com; adkim=s; aspf=s
p=reject— all emails failing DMARC are rejected at the receiving server; they never reach the recipient's inboxadkim=s— strict DKIM alignment (the d= tag in the DKIM signature must exactly match the From header domain)aspf=s— strict SPF alignment (the envelope from domain must exactly match the From header domain)
DMARC for Specific Email Platforms
Google Workspace
SPF: v=spf1 include:_spf.google.com ~all
DKIM: Admin Console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record. Wait 48 hours after adding the DNS record before enabling.
DMARC: Add _dmarc.yourcompany.com TXT record as described above. Google provides daily aggregate reports automatically.
Notes for GWS:
- Google recommends DMARC enforcement for all Google Workspace domains
- If you use Google Groups for email forwarding, be aware that Group-forwarded emails may break DKIM; configure them carefully
- Google Workspace's spam filter respects DMARC policies — p=reject means Google will reject failing emails before they reach your users
Microsoft 365
SPF: v=spf1 include:spf.protection.outlook.com ~all
DKIM: Microsoft 365 Admin Center → Security → Email & Collaboration → Policies & Rules → Threat Policies → DKIM. Enable DKIM signing and add the two CNAME records provided to your DNS.
DMARC: Add _dmarc.yourcompany.com TXT record. Microsoft recommends starting with p=none.
Important for M365: Microsoft 365 applies DMARC policies differently from most receiving mail servers. With just EOP (Exchange Online Protection), Microsoft does not reject emails that fail DMARC at p=reject — it marks them for further filtering. To get true p=reject enforcement for inbound email, you need Microsoft Defender for Office 365 Plan 1 or higher, or a third-party gateway like Mimecast or Sophos Email.
Zoho Mail
SPF: v=spf1 include:zoho.in ~all (for .in accounts) or include:zoho.com (for international)
DKIM: Zoho Admin Console → Mail Administration → Email Authentication → DKIM. Generate and publish the TXT record.
DMARC: Standard TXT record at _dmarc.yourcompany.com. Zoho supports DMARC reporting.
Common DMARC Mistakes to Avoid
1. Publishing p=reject without completing monitoring phase Jumping to p=reject without confirming all legitimate sources are passing will silently block legitimate business email. Always start with p=none and work through p=quarantine with pct stages.
2. SPF over 10 DNS lookups
SPF has a maximum of 10 DNS lookups (includes nested include: statements). Including too many third-party services causes SPF to fail permanently. Use SPF flattening tools or consolidate senders.
3. Multiple SPF records Only one SPF TXT record is allowed per domain. If you have multiple, merge them into a single record.
4. Not configuring DKIM before DMARC DMARC requires either SPF or DKIM to pass with alignment. Deploying DMARC without DKIM means you're relying entirely on SPF — which breaks on forwarded email.
5. Ignoring DMARC reports Publishing p=none and then not reading the reports defeats the purpose. If you're not using a DMARC reporting tool, you're flying blind. Mimecast DMARC Analyser is included with most Mimecast plans and is the easiest reporting tool for Indian businesses.
6. Setting p=reject before fixing email forwarding Legacy email forwarding (where emails are forwarded from one domain to another) breaks DKIM if the forwarding server modifies the message. Audit all email forwarding before moving to p=reject.
FAQs
How long does DMARC setup take?
For a single domain with Google Workspace or Microsoft 365 and no third-party sending tools, the initial SPF/DKIM/DMARC setup takes 1–2 hours. DNS propagation adds up to 48 hours. The monitoring phase (p=none → p=reject) typically takes 4–8 weeks to complete safely.
Does DMARC stop all email spoofing?
DMARC with p=reject stops exact-domain spoofing — someone sending email that claims to be from yourcompany.com. It does not stop lookalike domain attacks (e.g., yourcompany-in.com) — those require AI-powered impersonation detection from a dedicated email security platform like Sophos Email Advanced, Mimecast or Proofpoint.
What is BIMI and do I need it?
BIMI (Brand Indicators for Message Identification) is an extension to DMARC that displays your company logo next to your emails in Gmail, Apple Mail and Yahoo Mail. It requires DMARC at p=quarantine or p=reject plus a Verified Mark Certificate (VMC). BIMI is not required for security but improves brand recognition and can improve open rates. It is worth considering after DMARC enforcement is complete.
Does Cloudfy handle DMARC setup?
Yes. Cloudfy configures SPF, DKIM and DMARC for every email security deployment — whether for Google Workspace, Microsoft 365, Zoho Mail, or any third-party email gateway. We also provide DMARC monitoring through Mimecast for businesses that want ongoing visibility.
DMARC is one of the highest-ROI security improvements an Indian business can make — it takes a few hours to deploy and permanently closes one of the most common email attack vectors. As an authorised email security partner in India, Cloudfy handles the full SPF/DKIM/DMARC setup and monitoring for businesses using any email platform. Contact us for a free DMARC assessment.