These records stop attackers from sending email that appears to come from your own domain. DMARC tells receiving servers what to do with mail that fails checks. A policy of reject gives real protection.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Publish SPF and sign mail with DKIM
- Move DMARC from none to quarantine to reject
- Read the DMARC reports
Next steps
Include all third-party senders such as newsletter tools before enforcing. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.