If you've ever received an email that looked like it came from your bank, your boss, or a supplier — but wasn't — you've seen email spoofing in action. It's one of the cheapest, most effective attacks a criminal can run, because it exploits something most businesses never think to check: whether anyone can send email pretending to be your domain.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the DNS record that closes this gap. Without it, your domain is wide open — anyone, anywhere, can forge a "From" address that reads accounts@yourbusiness.co.za and send it to your clients, your staff, or your bank.
How email spoofing actually works
Email was never designed with authentication in mind. The "From" address on an email is, by default, about as trustworthy as the return address on a paper envelope — the sender can write whatever they like. Without protective DNS records, a criminal can send an email through their own server, set the From address to look like yours, and most inboxes will deliver it without complaint.
This is how business email compromise (BEC) scams work: an attacker spoofs your CFO's address and asks the bookkeeper to urgently pay an invoice. It's how supplier fraud works: an attacker spoofs your supplier and asks you to pay into a "new" bank account. And it's how phishing campaigns against your own clients work — using your good name to get past their guard.
The three records that fix it: SPF, DKIM, and DMARC
- SPF (Sender Policy Framework) — a DNS record listing which mail servers are allowed to send email for your domain. Receiving servers check the sending server against this list.
- DKIM (DomainKeys Identified Mail)— a cryptographic signature added to outgoing mail, letting the receiving server verify the message genuinely came from your domain and wasn't altered in transit.
- DMARC — the policy layer on top of both. It tells receiving mail servers what to do when a message fails SPF or DKIM checks: monitor it, quarantine it, or reject it outright. It also gives you visibility — daily reports showing exactly who is sending email using your domain, including any spoofing attempts.
SPF and DKIM alone aren't enough — they exist, but without a DMARC policy telling servers to act on failures, spoofed mail often still gets delivered. DMARC is what makes the other two records actually enforceable.
A properly configured DMARC record with a p=reject policy blocks spoofed email before it ever reaches an inbox — not just yours, but every inbox worldwide that respects the standard.
Why this matters more in South Africa specifically
SA businesses are a disproportionately attractive target for email-based fraud: a high volume of EFT-based payments, a strong culture of trusting email instructions from "the boss" or "the supplier," and — until recently — very low adoption of DMARC among SMBs compared to larger enterprises. Attackers follow the path of least resistance, and an unprotected domain is exactly that.
POPIA compliance adds another angle: if your domain is spoofed to phish your own clients, you may carry reputational and even legal exposure for failing to take reasonable security measures — even though the attacker, not you, sent the email.
How to get DMARC set up correctly
The technical part — publishing SPF, DKIM, and DMARC records correctly, moving to an enforcing policy without breaking legitimate mail flow, and monitoring the reports — takes some care. A DMARC policy rolled out too aggressively, without first reviewing which services send mail on your behalf (invoicing tools, marketing platforms, your own staff), can silently block real emails.
That's why we roll it out in stages: audit every legitimate sender first, publish a monitoring-only policy, review the reports for a short period, then move to full enforcement once we're confident nothing genuine gets blocked.
Not sure where your domain currently stands? Run our free security check below — it tells you in 30 seconds whether your domain is currently protected, and estimates what it would cost to fix it if not.