SPF and DKIM produce pass or fail results — but without DMARC, receivers decide alone what to do with failures, and criminals can still spoof your exact From address. DMARC (Domain-based Message Authentication, Reporting and Conformance) publishes your instructions: monitor, quarantine or reject mail that fails. It also sends you reports showing exactly who is sending as your domain worldwide.

The Record Itself

DMARC is a TXT record at _dmarc.yourdomain.com.np. A starter record looks like:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com.np; fo=1

  • p= the policy: none (monitor only), quarantine (send to spam) or reject.
  • rua= where aggregate reports are emailed daily by Gmail, Yahoo and others.
  • Alignment: DMARC passes only when SPF or DKIM passes and the authenticated domain matches your From domain.

The Safe Three-Stage Rollout

  1. Stage 1 — p=none for 4–8 weeks. Nothing changes for delivery; you simply collect reports. Feed them into a free DMARC report viewer and identify every legitimate source: mail server, website forms, newsletter tool, CRM.
  2. Stage 2 — p=quarantine. Once every legitimate source passes aligned SPF or DKIM, switch. Optionally begin with pct=25 to apply the policy to a quarter of failing mail and raise gradually.
  3. Stage 3 — p=reject. The end state: spoofed mail is refused outright. This is the setting that actually stops criminals invoicing your customers from your own address.

Why Nepali Businesses Should Care Now

  • Payment-diversion fraud against exporters, travel agencies and NGOs almost always begins with a spoofed or lookalike sender.
  • Gmail and Yahoo require DMARC for bulk senders — newsletters from unprotected domains are already being throttled.
  • Tender-issuing bodies and international partners increasingly check DMARC status before trusting correspondence.

Reading the Reports Without Pain

Raw DMARC reports are zipped XML — unreadable by hand at any volume. Use a free-tier report analyser, or have your provider monitor them. What you are looking for is simple: legitimate sources failing alignment (fix their SPF/DKIM) and unknown sources sending as you (evidence of spoofing that your policy will squash).

A Realistic Stage-1 Findings Example

A typical mid-size business's first month of DMARC reports at p=none commonly surfaces two or three sources nobody remembered were sending as the company domain: an old newsletter tool from a marketing campaign two years prior, a CRM's automated follow-up emails, and occasionally a departed employee's forgotten mail-merge tool. Each of these needs its own SPF inclusion or DKIM configuration before moving to p=quarantine, or their legitimate mail starts failing alongside any genuine spoofing attempts. This is exactly why the monitoring stage is not optional busywork — skipping straight to enforcement without this discovery step is the single most common cause of DMARC rollouts breaking legitimate business mail.

Common Pitfalls

  • Jumping straight to p=reject and silently losing invoices sent by a forgotten CRM — always monitor first.
  • Forgetting subdomains: use sp= to set subdomain policy, or attackers just spoof billing.yourdomain instead.
  • Reports mailbox overflowing: point rua at a dedicated mailbox or analyser address, not the MD inbox.

Frequently Asked Questions

Will DMARC break my newsletters?

Not if your newsletter tool is properly authenticated with its own DKIM for your domain — that is exactly what the p=none stage verifies.

How long does the whole rollout take?

Most SMEs reach p=reject safely in two to three months.

Is DMARC expensive?

The record is free; the work is analysis. Providers like WebsNP bundle monitoring with corporate plans.

We take corporate email customers to p=reject as standard — or start with a business email plan and ask for DMARC help.