How to explain DMARC to a business owner in two minutes

Business owners do not need to understand DNS to decide whether to fix their email. They need to understand what can happen, what fixing it gives them, and roughly what it costs. Here is a way to explain DMARC that takes about two minutes and has worked across law firms, dental practices and accountants.

The two-minute version

"Right now, anyone in the world can send an email that says it's from @yourfirm.com. Your clients' email providers have no way of knowing which messages really came from you, so they mostly let them through.

There's a setting called DMARC that fixes this. It's a short public note on your domain that says: 'only these services send our email, and if something else claims to be us, block it.'

Setting it up properly takes a few weeks, because first we watch who sends email for you, so we don't block your own invoices or newsletters. After that, fake emails in your name get rejected, and your real ones are more likely to reach the inbox."

That is all most owners need. It names the risk (impersonation), the fix (a published instruction), the process (watch first, then enforce) and the benefit (protection plus better delivery).

An analogy that works

Email addresses are like the return address on an envelope: anyone can write anything there. DMARC is like registering your signature with the post office and asking them to return any letter with your name on it that does not carry it.

If they ask what SPF and DKIM are, extend it: SPF is the list of post offices allowed to send your mail, and DKIM is the signature itself. DMARC is the instruction about what to do when neither checks out. The full technical version is in SPF, DKIM and DMARC explained.

The four questions owners always ask

"Has someone already done this to us?"

Be honest: you cannot tell from public settings alone. Without DMARC reporting, nobody is told when it happens. Once a DMARC record with a reporting address is in place, you will see who is sending email in the business's name, and that answers the question within a few weeks.

"Will this break our email?"

Not if it is done in stages. The first step (p=none) changes nothing about delivery; it only turns on reports. You move to quarantine and reject once every legitimate sender is passing. DMARC p=none vs quarantine vs reject explains each stage.

"Why hasn't our IT person or web designer done it?"

Avoid blaming anyone. DMARC sits between email, DNS and the website, so it often falls between people. It also only became a hard requirement for bulk senders in 2024, when Google and Yahoo started enforcing it. See the new sender rules.

"What does it cost?"

Give a range for your own pricing and explain the shape: a small setup project (find every sender, fix SPF and DKIM, publish DMARC), a few weeks of watching reports, then a final change to enforce. Some MSPs include ongoing report monitoring in a monthly plan.

What not to say

• "You've been hacked" or "you're vulnerable." You do not know that, and it puts people on the defensive.
• Acronym soup. Say "DMARC" once, then talk about "the setting" or "the protection".
• Absolute promises. DMARC stops exact-domain spoofing. It does not stop all phishing, lookalike domains or a compromised mailbox.

Show, then tell

The explanation lands best next to their own result. A one-page report that says "No DMARC record: anyone can send email pretending to be @theirdomain" does half the work for you. Run their domain through a free check, or use the DMARC record explainer if they already have a record and want to know what it does.