DMARC for Small Business: We Checked 1,728 Local Business Domains and 46% Had No DMARC Record

If a criminal emailed your customers today from your exact domain, would anything stop it? For most of the small businesses we checked, no. We looked up the public email security records of 1,728 local business domains in October 2026: 46% had no DMARC record at all, and only 18% had one that tells inboxes to quarantine or reject email that fails the checks.

This article covers the findings, why they matter more for a plumber or a cleaning company than you might think, and the exact steps to close the gaps. To see where your own domain stands, run it through our free SPF and DMARC checker: it takes a few seconds and needs no sign-up. If you'd rather not edit DNS records yourself, we can set them up and check them as part of our security hardening work.

SPF, DKIM and DMARC in plain English

Three DNS records decide whether an email claiming to be from your domain is believable:

• SPF lists the servers allowed to send email for your domain, for example Google Workspace or Microsoft 365.
• DKIM adds a digital signature to each email, which the receiving server checks against a public key in your DNS.
• DMARC ties the two together. It tells receiving inboxes what to do when an email uses your domain but fails the checks: nothing (p=none), treat it as suspicious (p=quarantine) or refuse it (p=reject). It can also ask for reports, so you can see who is sending as you.

Without DMARC, each inbox makes its own guess. With p=none, you're watching but not protecting. Only quarantine or reject tells inboxes to stop fakes.

How we checked 1,728 domains

The businesses are the trade and service firms from our October 2026 audit of Google Maps listings, in the US, UK, Australia, Canada, New Zealand and five Gulf countries.

We took the domain of every business website, skipping social media pages and free builder subdomains: 2,096 domains. On 13 October 2026 we looked up their public DNS records: MX (where email is delivered), SPF and DMARC. 1,728 domains (83%) had MX records, meaning they receive email. The figures below are for those 1,728.

We didn't measure DKIM. It can't be checked from outside without knowing the key's name (its "selector").

What we found

So 82% of these businesses had no instruction telling inboxes to block email that fakes their domain: either no DMARC record or a monitoring-only one.

Three smaller details:

• Only 28% asked for DMARC reports. Without reports, a p=none record does almost nothing. It's a smoke alarm with the sound turned off.
• 26 domains had two or more SPF records. The SPF standard allows only one, so the SPF check on every email these businesses send ends in an error. It usually happens when someone adds a second email or marketing tool and creates a new record instead of editing the old one.
• 55% of the domains had an SPF record ending in `~all` (a "soft fail") and 32% one ending in -all (a hard fail). Either can work alongside DMARC, because the DMARC policy decides the outcome.

The email provider made a big difference

One in five Google Workspace domains had no SPF record at all. Almost every Microsoft 365 domain had one. Our reading is that Microsoft's domain setup steers people into adding SPF, while with Workspace it's easy to get email working and stop there. Either way, it's a two-minute fix.

Businesses behind a dedicated email security gateway did far better, which makes sense: a business that pays for one usually has someone looking after email security.

Busier businesses were better protected

Unlike website speed, where the busiest businesses did worst, email security improved with size:

Our guess is that larger firms are more likely to have an IT provider, or to have hit deliverability problems that forced the fix. Even so, 71% of the busiest businesses had no enforced policy.

Two more gaps we didn't expect

Domains that don't use email. 356 of the domains had no MX record. They don't appear to use email, but that doesn't stop someone sending fakes from them. A domain that never sends email should say so publicly, with an SPF record of v=spf1 -all and a DMARC record of p=reject. Only 14 of the 356 had both. 332 (93%) had neither, and 280 had no SPF or DMARC record of any kind.

Gmail addresses as the contact email. Of the businesses with their own domain where we found a contact email, 12% still gave a Gmail, Yahoo, Outlook or similar address. Customers can't easily tell a real @gmail.com address from a fake one, and impersonators rely on that.

Why this matters for a local business

Invoice fraud is the big one. A criminal emails your customer as you, with new bank details for "this month's invoice". The FBI's Internet Crime Complaint Center recorded $3.05 billion in reported losses from business email compromise in 2025, the second-largest category after investment fraud. An enforced DMARC policy doesn't stop every variant, but it stops the most convincing one: an email that really uses your domain.

Getting your own email delivered is the other. Google requires every sender to Gmail accounts to use SPF or DKIM, and senders of more than 5,000 messages a day also need DMARC. Microsoft introduced similar rules for high-volume senders to Outlook.com in May 2025. You probably don't send 5,000 emails a day, but quotes and invoices from a domain without SPF or DKIM are more likely to land in spam.

How to set up DMARC for a small business, step by step

Expect about an hour of work spread over a few weeks. Your IT provider or web developer can do it, or you can follow along in your DNS settings. If you're not sure who can log in to your domain's DNS, check who really owns your domain first.

1. Check your current records. Enter your domain in our free SPF and DMARC checker, or ask your IT provider. Is there exactly one SPF record, is DKIM switched on, and is there a DMARC record?
2. Fix SPF. Keep exactly one record, starting with v=spf1. Include every service that sends email as you: your mailbox provider, your website's contact form, your invoicing or marketing tool. Our SPF and DMARC record generator builds the record from the services you pick, or your provider's help pages give the exact include: to add.
3. Turn on DKIM in your email admin console. In Google Workspace and Microsoft 365, you publish the DNS record it gives you, then switch signing on.
4. Add a DMARC record at `p=none` with reporting, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Use a mailbox someone reads, or a free DMARC report service. The record generator writes this record for you too.
5. Read the reports for two to four weeks. They show every service sending email as you. Anything legitimate that fails needs its SPF or DKIM fixed first.
6. Move to `p=quarantine`, then `p=reject`. Once your real email passes, tighten the policy. This is the step that protects your customers.
7. Lock down unused domains with v=spf1 -all and a DMARC p=reject record.

For the technically curious: in May 2026 the IETF published DMARC as a standards-track specification, RFC 9989, replacing the 2015 version. Existing v=DMARC1 records keep working without changes.

Frequently asked questions

The bottom line

Plenty of local businesses polish their website, then leave their email domain open to anyone who wants to borrow it. In our data, 82% had no enforced DMARC policy. The fix is a few DNS records and a few weeks of reading reports, and you can check your domain now to see which of them you're missing.

Sending invoices by email and not sure your domain is protected? Book a free consultation and we'll check your domain's records with you and tell you exactly what to change.

Sources

• ZNova Studio, public DNS lookups (MX, SPF, DMARC) of 2,096 local business domains, 13 October 2026. Businesses from our October 2026 audit of Google Maps listings: /insights/local-business-website-statistics
• IETF, RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), May 2026: https://www.rfc-editor.org/rfc/rfc9989.html
• IETF, RFC 7208: Sender Policy Framework (SPF): https://www.rfc-editor.org/rfc/rfc7208.html
• Google, Email sender guidelines: https://support.google.com/mail/answer/81126
• FBI Internet Crime Complaint Center, 2025 IC3 Annual Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• Microsoft Outlook blog, Strengthening email ecosystem: Outlook's new requirements for high-volume senders (April 2025): https://techcommunity.microsoft.com/blog/outlook/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730