If clients are suddenly asking for DMARC, they are not overreacting. Email providers have tightened sender requirements, and businesses that send from their own domain are under more pressure to prove their mail is legitimate.
In practice, this means your domain should have working SPF, DKIM, and DMARC records. Without these, you are more likely to see delivery problems, spam-folder placement, or rejected messages, especially when sending campaigns, invoices, or support mail.
This guide explains the recent DMARC shift in plain language and gives you a practical setup path for South African businesses.
What changed with DMARC requirements?
Large mailbox providers have made email authentication a baseline expectation, not a "nice to have". Over the last year, senders have seen stricter checks for domain alignment and sender reputation, especially for higher-volume mail.
For many businesses, the key change is this: if you send from your own domain (like yourbusiness.co.za), you should publish a DMARC policy and ensure SPF/DKIM align with your visible From address.
Even when a platform does not hard-block every unauthenticated message, missing DMARC often contributes to poorer inbox placement and lower trust. That is why clients are proactively asking for DMARC now.
Quick refresher: SPF, DKIM, and DMARC
SPF says which servers are allowed to send on behalf of your domain. DKIM adds a signed header so receiving servers can verify the message was not tampered with. DMARC ties SPF and DKIM to your visible From domain and tells receivers what to do when checks fail.
Think of DMARC as your domain-level policy layer. It does not replace SPF or DKIM. It sits above them, adds alignment rules, and gives you reporting data so you can monitor who is sending as your domain.
Why this matters for small and medium businesses
If your business sends quotes, account notices, support replies, newsletters, or payment communication, deliverability is revenue-critical. A message in spam can mean missed sales, missed payments, or delayed support.
DMARC also helps reduce spoofing risk. Attackers often impersonate local brands to run phishing scams. A stronger DMARC policy makes abuse harder and helps protect your brand reputation.
For companies in the Strand, Somerset West, and across the Western Cape, this is no longer only an "enterprise IT" topic. It is practical business hygiene for any domain-based email setup.
A safe rollout plan (without breaking legitimate mail)
Step 1: confirm SPF is valid and includes every sending platform (Microsoft 365, Google Workspace, CRM, ticketing, invoicing tools, etc.). Step 2: enable DKIM on each platform that supports it. Step 3: publish DMARC with a monitoring policy first (p=none).
Once reports confirm your senders are aligned, move gradually to stronger enforcement (quarantine, then reject where appropriate). Rushing directly to reject without visibility can block real business email.
Also make sure forwarding and third-party senders are tested. Many DMARC incidents happen because one forgotten platform still sends mail without DKIM alignment.
Example DMARC record and what it means
A starter record often looks like: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.za; adkim=s; aspf=s; pct=100
This tells receivers you are monitoring failures (p=none), where to send aggregate reports (rua), and that strict alignment is preferred (adkim/aspf). After review and cleanup, policy can be tightened.
Your exact record should match your business mail flow. If your team sends from multiple tools, a one-size-fits-all record is risky unless properly validated.
How Strand Web can help
We help businesses configure SPF, DKIM, and DMARC safely, test alignment, and reduce delivery problems. If your team is receiving client requests to "add DMARC", we can implement it with a staged approach and reporting visibility.
If you already use Microsoft 365, see our Microsoft services. You can also read From Gmail to Professional for domain-email fundamentals, or contact us and we will audit your current DNS/email setup.
Frequently asked questions
Do we need DMARC if we send low email volume?
Yes. Volume affects enforcement pressure, but low-volume domains are still spoofed and can still suffer deliverability issues. DMARC is recommended for any business domain sending mail.
Can DMARC break our email?
It can, if enforcement is switched on before SPF/DKIM alignment is clean. That is why a staged rollout (monitor first, then enforce) is the safest approach.
How long does a DMARC rollout take?
Basic setup can be quick, but full hardening depends on how many sending systems you use. Most businesses can complete monitoring and cleanup over a few weeks, then enforce with confidence.
Recent DMARC-driven sender rules mean authenticated email is now the standard. Businesses that delay setup risk lower inbox placement and greater spoofing exposure.
If clients are requesting DMARC from your team, this is the right time to implement it properly. Talk to us and we will help you publish, validate, and harden your DMARC policy without disrupting legitimate mail.