From Visibility to Enforcement: A Thirty-Day DMARC Plan for UK SMEs in 2026

Email remains the most direct route into a small business. It is also one of the cheapest for an attacker to imitate. A supplier invoice, a director's instruction, a payroll update: these are ordinary messages that staff are conditioned to trust. DMARC, or Domain-based Message Authentication, Reporting and Conformance, gives a domain owner a way to tell receiving mail systems what to do when a message claims to come from their domain but fails authentication. Yet many UK SMEs still publish a monitoring-only record and never move beyond it. The result is visibility without protection.

Why DMARC belongs with governance, not just IT

DMARC is often presented as a technical configuration task. In practice it is a control over brand trust, financial process and supplier confidence. When a domain is spoofed, the immediate risk may be a fraudulent payment request or a credential-phishing page. The longer-term risk is reputational: customers and partners begin to doubt whether a message from the firm is genuine.

For directors, the important distinction is between a DMARC record that merely collects reports and one that instructs receivers to quarantine or reject failing mail. The first is a diagnostic tool. The second is an enforceable policy. A thirty-day programme can move a small firm from the first to the second without disrupting legitimate correspondence, provided the work is staged and the evidence is reviewed before enforcement.

Days 1 to 5: Inventory every legitimate sender

Begin with a sender inventory rather than a DNS change. List every domain and subdomain the business uses for email, including those used by marketing platforms, customer relationship systems, invoicing tools, payroll providers, website contact forms, e-signature services and any legacy application that sends notifications.

Speak to finance, sales, operations and the web team. The senders that cause the most trouble are rarely the obvious ones. A website form may send through a third-party service. A finance system may use its own relay. A marketing team may have added a new platform without telling IT.

At this stage, publish a DMARC record in monitoring mode with aggregate reporting enabled. The aim is not to block anything but to receive data. Record the reporting address in a mailbox that is actively monitored, and decide who will review the reports. For a small firm, this may be the IT provider or a nominated operations lead rather than a dedicated security team.

Days 6 to 12: Read the reports before changing policy

DMARC aggregate reports are not designed for casual reading. They are XML files that summarise which servers sent mail claiming to be from the domain, and whether those messages passed SPF and DKIM alignment. A reporting tool or managed service will make the data usable, but the questions are straightforward: which sources are legitimate, which are unexplained, and which legitimate sources are failing authentication?

Check that SPF records remain within DNS lookup limits and that every sending service is included. Confirm that DKIM signing is active and that the key is correctly published. Pay particular attention to forwarding and mailing-list behaviour, which can break SPF while leaving DKIM intact. Do not assume that a failing source is malicious; it may be a supplier portal or an internal application that has never been documented.

Document each sender, its business owner and its authentication status. This register becomes the evidence base for the next stage and a useful asset for future supplier onboarding.

Days 13 to 20: Fix authentication and align subdomains

With the inventory in hand, correct the legitimate senders that are failing. This may mean adding a service to SPF, enabling DKIM in a platform's settings, or moving a legacy application to a dedicated subdomain so that it does not affect the main domain's policy.

Subdomains deserve specific attention. Attackers often spoof a subdomain that has no DMARC record of its own. A subdomain policy can extend protection across the estate, but it should be applied only after the subdomain senders are understood. For many SMEs, the safest approach is to publish a strict subdomain policy while keeping the main domain in monitoring mode until the sender register is complete.

At this point, the firm should be able to explain every legitimate source of email. If a source cannot be explained, do not enforce yet. Investigate it first.

Days 21 to 25: Move to quarantine, then reject

Enforcement should be deliberate. Once legitimate senders are authenticated and unexplained sources have been investigated, move the main domain to quarantine. Monitor the reports closely for several days. If legitimate mail continues to be delivered and spoofed mail is being filtered, move to reject. Reject is the stronger setting and the appropriate destination for most SMEs that have completed the inventory.

Keep a rollback plan. A DNS change can be reversed, but the business needs to know who has authority to do so and how quickly. For firms with complex legacy systems, a phased approach using a percentage of messages can provide additional reassurance, but it should not become a permanent substitute for enforcement.

Days 26 to 30: Report in plain English and embed review

The final stage is communication. Directors do not need XML reports; they need a one-page summary covering what changed, which legitimate senders were identified, how many spoofed messages were blocked, what remains outstanding and who owns the next review.

DMARC is not a one-off project. New marketing platforms, website changes and supplier integrations can alter the sending landscape. Add DMARC review to quarterly IT governance, include email authentication in supplier onboarding, and ensure DNS changes pass through a controlled approval process. For UK SMEs, this also supports conversations with insurers and customers who increasingly ask for evidence of basic cyber hygiene.

The inbox is not a perimeter that can be sealed once. It is a business channel that needs documented ownership. A thirty-day DMARC programme gives a small firm a practical way to move from passive monitoring to active enforcement, while keeping legitimate mail flowing and giving directors a clear view of the risk being managed.