Guide

What is DMARC? A plain-English guide for law firms

By Adam Sierant, Director of Northstar Infinity Works Ltd · Updated 10 September 2026 · 5 min read

DMARC in one paragraph

Every email shows a sender in its From line, and nothing in the basic design of email checks that the address is genuine.^[1] DMARC, short for Domain-based Message Authentication, Reporting and Conformance, closes part of that gap. The firm publishes one record in its DNS, under the name _dmarc followed by its domain, and receiving mail systems read it whenever a message arrives that claims to come from the firm. The record tells them how to check the message, what to do when the check fails, and where to send reports about what they saw.^[2]

Why it matters to a law firm

Law firms send the email criminals most want to imitate: completion statements, requests for funds, bank details and documents to sign. Take Five warns homebuyers that fraudsters pose as solicitors to have deposits and purchase money sent to their own accounts, sometimes from addresses that closely mimic a real firm’s.^[3] The SRA’s advice to firms on cybercrime mentions DMARC, which the National Cyber Security Centre recommends.^[4]

Phishing is also the attack UK organisations meet most often. In the government’s Cyber Security Breaches Survey 2025, 43% of businesses had identified a breach or attack in the previous twelve months, and 85% of those had experienced phishing.^[5] DMARC does not solve phishing on its own, but it removes the easiest version of it for your domain: a message that simply claims to be from you.

How DMARC decides

DMARC does not check a message by itself. It uses the results of two older standards and adds one rule of its own.

• SPF lists the servers allowed to send mail for a domain. It checks the envelope address that mail servers use between themselves, not the From address people read.^[6]
• DKIM adds a digital signature to each message, which the receiver checks against a public key the sending domain publishes in DNS.^[7]
• DMARC’s own rule is alignment: the domain that passed SPF or DKIM has to match the domain in the From line. A message passes DMARC when at least one of the two checks passes for an aligned domain.^[2]

Alignment is what makes the difference. A criminal can register a domain, set up SPF and DKIM for it, and send messages that pass both checks while showing your firm’s address in the From line. SPF and DKIM on their own would not notice. DMARC does, because the domain that passed is not yours.^[1]

What a DMARC record looks like

_dmarc.samplefirm.example  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

v=DMARC1 identifies the record, p= sets the policy, and rua= gives the address for aggregate reports: regular summaries from receiving systems of which servers sent mail using your domain, and whether that mail passed.^[8] The domain above is a reserved example; your own goes in its place.

The three policies

The standard describes none as the domain owner expressing no preference, quarantine as a significant concern and reject as a clear statement that the mail is not legitimate.^[2] The NCSC calls a reject policy on all of an organisation’s domains the best way to prevent spoofing of its email.^[9] Our guide to choosing a DMARC policy explains how firms move between them without losing legitimate email.

Why so many firms stop at none

A policy of none is safe to publish because it changes nothing about delivery. The NCSC notes that it does not interfere with email traffic in any way, and treats it as the place to start while you check that SPF and DKIM are set up correctly.^[10] The trouble is that a record left at none protects no one: receivers are asked to do nothing with mail that fails, so a message forging your domain meets no instruction from you at all.

Firms stall there for ordinary reasons. Nobody owns the reports, which arrive as compressed XML files. The IT provider looks after the mail platform but not the case management system, the accounts package or the office scanner that also send email as the firm. Moving on feels risky, because a mistake can stop genuine client email, and nobody has written down which services were checked.

What DMARC does not do

It is worth being precise, because DMARC is sometimes presented as more than it is.

• It protects your exact domain. It does not stop a criminal registering a lookalike domain with one character changed, because that domain’s mail is judged against that domain’s own records.^[2]
• It does not help when a genuine mailbox is compromised: mail sent from a real account really is from your domain, and passes. Take Five notes that criminals usually gain access to genuine legal email accounts.^[3]
• It does not control what every receiver does. The policy is a request, and each receiving system applies it through its own filtering.^[8]
• It does not guarantee delivery to the inbox, although Google requires a DMARC record from anyone sending more than 5,000 messages a day to Gmail accounts.^[11]

That is why DMARC sits beside other controls rather than replacing them: multi-factor authentication on every mailbox, a clear rule that bank details are never changed by email, and a call to a known number before money moves.

Where to start

1. Check your domain to see whether it publishes SPF and DMARC today, and at which policy.
2. List every service that sends email as the firm: the mail platform, case management, billing, marketing tools, scanners and anything your IT provider has set up.
3. Publish a DMARC record at none with a reporting address, and read the reports for long enough to confirm that each service passes.
4. Fix whatever fails, then move to quarantine and, when the evidence supports it, to reject, keeping a dated record of each change.

mailcounsel runs that project with your IT provider and leaves a dated record of the services checked and the settings changed. You can read a sample record first, or arrange a 20-minute scope call to talk it through.