What is DMARC, and do you need it? A DNS and email security playbook for South African businesses

I have worked in IT and development since 1998. This paper uses our own domain, rizonetech.com, as the worked example: its real records, read on 12 October 2026, and where its DMARC rollout stands. The standards and requirements come from the published sources, read the same day.

Do you need DMARC?

Yes, if your business sends email from its own domain. Without DMARC, anyone can put your address in the From line, and receivers have no published preference from you about it. With DMARC you:

• Publish a requested policy for mail that fails DMARC. Under RFC 9989, the May 2026 standard that replaced RFC 7489, p=none offers “no expression of preference”, while quarantine and reject ask for stricter handling. The final handling “is always a matter of local policy”, so a p=none message can still land in spam for other reasons.
• Get reports from the receivers that send them, showing which servers send mail in your name, including ones you forgot.
• Meet the big mailbox providers’ rules for bulk senders, set out below.

How do SPF, DKIM and DMARC differ?

They answer different questions, and they work as a set:

The key idea is alignment. A message passes DMARC only when SPF or DKIM passes for a domain that matches the visible From domain. By default the match is relaxed, so bounce.example.com aligns with example.com; strict alignment needs an exact match.

Our website’s mail shows why it matters. Before we fixed it, it passed SPF for the hosting company’s relay domain, which did nothing for rizonetech.com, and it failed DMARC.

What do Gmail, Yahoo and Outlook require?

• Gmail: since 1 February 2024, every sender to personal Gmail accounts needs SPF or DKIM. Senders of 5,000 or more messages a day to personal Gmail accounts need SPF, DKIM and a DMARC record, and Google’s sender guidelines say “Your DMARC enforcement policy can be set to none”. The From domain must align with the SPF or DKIM domain, marketing mail needs one-click unsubscribe, and spam rates should stay below 0.3%.
• Yahoo asks bulk senders for SPF, DKIM and an aligned DMARC record, and publishes no fixed volume threshold.
• Outlook.com has required SPF, DKIM and a DMARC record since May 2025 of anyone sending 5,000 or more messages a day to Microsoft’s consumer email services from the same From domain, and rejects mail that fails.

Smaller senders still go through filtering. Authentication meets an important delivery requirement, but content, complaints and sender reputation still affect where mail lands.

How do you roll out DMARC without breaking your mail?

A monitored, staged rollout reduces disruption. It does not guarantee that no legitimate message is ever lost, so keep testing your senders and reading reports after you enforce. Microsoft’s DMARC guide recommends the same path, from p=none to p=quarantine to p=reject. This is the order we follow for rizonetech.com:

1. List every service that sends as your domain: your mailbox provider, website forms, invoicing, newsletters, CRM and anything else. Give each one aligned SPF or DKIM.
2. Publish p=none with a report address, and read the reports. Ours, live today:

v=DMARC1; p=none; rua=mailto:dmarc@rizone.tech; ruf=mailto:dmarc@rizone.tech; sp=none; fo=0:1:d:s;

Here rua asks for daily aggregate reports. The optional ruf and fo tags ask for a report on each failing message, which RFC 9991 warns “can contain the header fields or sometimes the entire content of a failed message”, and many receivers do not send them. For a first rollout, use rua alone unless you have decided who reads failure reports and how long you keep them.

1. Fix what the reports show. Our inventory found the website’s own form mail failing DMARC, because the host sent it through its relay with no DKIM signature. We moved it to a sending service that signs as rizonetech.com and uses a return-path subdomain of ours. It now passes DKIM with d=rizonetech.com and passes DMARC, while our root SPF record still names only Microsoft 365: v=spf1 include:spf.protection.outlook.com -all. The full story is in why business emails go to spam.
2. Move to p=quarantine once every known legitimate sender has been tested and any unexplained failure of real mail is resolved. The reports may still show spoofing failures; that is what the policy is for. Cover a full sending cycle, including monthly invoices and occasional campaigns. Two weeks, counted from 11 October 2026, is our first observation period, not an automatic deadline.
3. Move to p=reject after a further clean period.
4. Do not forget subdomains. Our sp=none keeps subdomains at monitoring even after p changes. Check which subdomains send mail, then move sp with p, or remove it so subdomains inherit p.
5. Keep reading the reports. A new tool, a changed provider or a forwarding rule can start failing at any time.

What replaced the pct tag?

Older guides, Microsoft’s among them, suggest stepping up with pct=10, 25, 50 and so on. RFC 9989 removed the pct tag because it “was usually not accurately applied, unless the value specified was either 0 or 100”. Its replacement for testing is t=y, which asks receivers to apply one level below your policy, so reject is handled as quarantine. Do not rely on t=y alone: receivers built to the older standard can ignore it and apply p directly, so keep the staged rollout.

The DMARC record builder writes the record from plain options, and the SPF record builder counts your SPF lookups.

How do you read a DMARC report?

Aggregate reports arrive as compressed XML files, usually one a day from each receiver that sends them. RFC 9990 defines them. Each row groups messages by sending server and result. This example is illustrative, not one of our reports:

Match each source to your sender list. A known service that fails alignment needs fixing before you enforce. An unfamiliar source may be spoofing, a forgotten sender, a forwarder or a mailing list, so check the headers and delivery path before you change anything. Test forwarding and mailing-list mail before you enforce, and do not add an unfamiliar relay to SPF just because it appears in a report. If no reports arrive, that proves nothing about your mail: some receivers do not send them, and the address may not be authorised.

What do DMARC reports need that most guides skip?

If your reports go to a mailbox on another domain, that domain must agree to receive them. We send rizonetech.com’s reports to dmarc@rizone.tech, so on 11 October 2026 we published this record in the rizone.tech zone:

rizonetech.com._report._dmarc.rizone.tech TXT "v=DMARC1"

RFC 9990 describes the check: a receiver looks for that name, and a record starting v=DMARC1 shows the arrangement “was authorized by the Report Consumer”. Without it, receivers that check send no reports to that address, and the p=none stage tells you nothing.

What else hardens your domain?

Email authentication protects your mail. These records protect the rest of the domain. Plan each one with whoever runs your DNS, registrar and certificates, then test resolution, mail delivery and certificate renewal after any change:

• DNSSEC signs your DNS answers so validating resolvers can detect forgery. Turning it on, and changing DNS provider later, needs care: our DNSSEC guide gives the order we followed when we moved rizonetech.com’s DNS in October 2026.
• CAA (RFC 8659) names the certificate authorities you authorise to issue certificates for your domain. It lets them “reduce the risk of unintended certificate mis-issue”, but it “does not prevent mis-issue by an authorized CA”, and it works only because authorities observe it.
• MTA-STS (RFC 8461) tells other mail servers to deliver to you only over TLS with a valid certificate. In testing mode they still deliver when the check fails, and TLS-RPT (RFC 8460) sends you reports of those failures. Start in testing mode and read the reports before you enforce.
• BIMI can show your logo next to your mail in supporting inboxes, but only with DMARC at quarantine or reject. Gmail also requires a Verified Mark Certificate or a Common Mark Certificate.

None of these are on rizonetech.com today. We removed the domain’s DS records through the registrar on 11 October 2026 as part of a move to a new DNS provider, and DNSSEC goes back on after the nameserver change and the cache waits our DNSSEC guide describes. Our rollout puts DMARC enforcement first. CAA and MTA-STS can go on independently; BIMI needs DMARC enforcement.

Why does this matter in South Africa?

Business email compromise and phishing start with mail that looks like it came from someone you trust. INTERPOL’s Africa Cyberthreat Assessment Report 2025 says reports from cybersecurity firms and its private partners show South Africa and Egypt “suffered the highest number of ransomware incidents in 2024” in Africa. A domain at DMARC enforcement makes direct spoofing of that domain much harder, although lookalike domains and compromised mailboxes still need other defences.

POPIA section 19 requires a responsible party to secure personal information by “taking appropriate, reasonable technical and organisational measures”. Under section 22, reasonable grounds to believe that personal information was accessed or acquired by an unauthorised person mean notifying the Information Regulator and the affected people, where they can be identified, “as soon as reasonably possible”, subject to the section’s qualifications. Since 1 April 2025, notifications to the Regulator go through its eServices portal. Email authentication is one reasonable measure among many. It does not make a business compliant on its own.

What is the hardening checklist?

• Publish one SPF record on each envelope-sender domain, authorising the services that use that domain, within 10 DNS-querying terms including nested includes. A service that uses its own return-path domain does not need to be in your root SPF just because it sends with your From address.
• Turn on DKIM signing for every service that sends as your domain, with your domain as the signer.
• Publish DMARC at p=none with a report address you read, and authorise it if it is on another domain.
• Move to quarantine, then reject, as the reports come back clean, and take sp with you.
• Add one-click unsubscribe to marketing mail.
• Plan DNSSEC and CAA with your DNS, registrar and certificate providers, then test resolution and certificate renewal after the change.
• Review the whole set whenever you add or change a mail service.

FAQ

Is DMARC p=none enough?

For Gmail’s bulk sender rule, yes. For protection, no: p=none expresses no preference, so it reports spoofing without asking anyone to stop it. Treat it as the first stage.

Will DMARC stop all phishing?

No. It makes direct spoofing of your exact domain harder. It does not stop lookalike domains, display-name tricks or mail from a compromised mailbox.

Do I need DMARC if I use Microsoft 365?

Yes. Microsoft’s guide has you create the DMARC record for each custom domain at your DNS host, and for the onmicrosoft.com domain in the Microsoft 365 admin center. For licences and the rest of the setup, see our Microsoft 365 guide for South African SMBs.

What should you do next?

Build your record with the free DMARC record builder, then check the result with the Email health check. If you would rather have it set up and watched, DNS Shield covers DNSSEC, SPF, DKIM and DMARC for your domain, on its own or as part of a managed IT service.

Published 16 June 2026. Last updated 12 October 2026.