DMARC for Small Business: Start with p=none

DMARC tells receivers what to do when SPF/DKIM checks fail alignment. For small businesses on MailShrine, the safe start is p=none (monitor) — then tighten after you trust the data.

Real-life example: Cedar Clinic

Dr. Amaka’s desk received spoofed “invoice” mail pretending to be the clinic domain. Publishing DMARC at p=none with a report address revealed which systems still needed SPF includes before they moved to quarantine.

Policy ladder

Example starter shape:

• Host: _dmarc
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Use an inbox you check (or a parser later).

What you need

Working SPF + DKIM for MailShrine (SPF, DKIM) + DNS edit for _dmarc.

Step 1: Confirm SPF/DKIM pass

Don’t enforce DMARC on a broken base.

Step 2: Publish `_dmarc` with `p=none`

Save at registrar; DNS only on Cloudflare.

Step 3: Watch reports for 1–2 weeks

Note unexpected senders (CRM, booking tools) → add to SPF/DKIM.

Step 4: Tighten carefully

Move to quarantine, then reject when reports are boringly clean.

Step 5: Keep rua actionable

A black-hole rua mailbox helps no one.

Checklist

• SPF/DKIM healthyCompleted
• _dmarc with p=noneCompleted
• rua mailbox monitoredCompleted
• Schedule policy tightenNot completed

Common mistakes

1. Jumping to p=reject on day one.
2. DMARC without SPF/DKIM.
3. Ignoring report mail.
4. Typo host (dmarc vs _dmarc).

Next steps

• SPF vs DKIM vs DMARC · Spam fixes · Setup

Citations & References

• Reference: Google: Email sender guidelines
• Reference: Cloudflare Learning Center: DNS records
• Reference: ICANN: What is DNS?

Written by Isabelle M., Email Authentication Specialist. Isabelle helps SMEs start DMARC safely with p=none before enforcing.