DHL, PayPal and Microsoft refuse forged mail. Most small businesses don't.

On 12 November 2026 I looked up the DMARC records of brands most people get mail from. DHL, PayPal, Microsoft, Google, HMRC, GOV.UK, ING and LinkedIn all publish p=reject: they tell receivers to refuse mail that uses their domain without passing the checks. Most small businesses haven't set that instruction for their own domain yet.

What the big brands publish

A DMARC record is public. Anyone can look it up in DNS. This is what we found:

Smaller domains look different. In a 2025 scan by EasyDMARC of 1.8 million of the world's most visited domains, 52% had no DMARC record at all, and 7.7% were at p=reject. Valimail's 2026 report puts 42% of domains at quarantine or reject (sample not published). Neither counts small businesses on their own.

Why p=none isn't enough

A DMARC record at p=none asks for reports and blocks nothing. In a May 2024 advisory, the FBI, the NSA and the US State Department showed spear-phishing sent in the name of trusted organisations. Those mails failed DMARC, but the domains were at p=none, which "ultimately allows the spearphishing email to be delivered to the victim's inbox." Their advice: move to p=quarantine or p=reject.

Enforcement works at scale. The UK tax authority HMRC introduced DMARC in November 2016. By June 2018 it reported that DMARC had "successfully stopped half a billion phishing emails reaching customers."

So why do scams in their name still arrive?

Because the scammers use other routes. DMARC covers mail that uses the exact domain. It doesn't cover text messages, phone calls, lookalike domains, a free-mail address with the brand's name in the display name, or a hacked mailbox. The same HMRC release that reported half a billion stopped e-mails was about a record number of fake HMRC websites taken down: a route DMARC doesn't reach.

The big brands closed the exact-domain door years ago, so the scams in their name have to use those other routes. A domain without a DMARC policy leaves that door open.

Gmail, Yahoo and Outlook check it

Since February 2024, Gmail and Yahoo require bulk senders to pass SPF and DKIM and to publish a DMARC record aligned with their From address. Since May 2025, Outlook.com sends non-compliant mail from domains that send more than 5,000 messages a day to Junk. Google says unauthenticated mail "might be marked as spam or rejected."

What a small business can do

1. Check your domain. The free check shows your SPF, DKIM and DMARC, and one next step. No sign-up.
2. Publish DMARC with reports at p=none, and find every service that sends as you: the mailbox, the newsletter tool, invoicing, the webshop.
3. Move to quarantine, then reject, once the reports show your real senders pass. Your road to p=reject walks through it.
4. Cover your parked domains with a reject policy too, so a domain that sends no mail can't be used to send any.
5. Tell your customers how you contact them, so a message by another route stands out. DMARC only covers your domain's e-mail.

MonitorBase reads your DMARC reports for you and names every sender. For a business, monitoring starts with DMARC Basic at €16 a month: daily checks, an e-mail when something changes, and the next policy step when your data supports it. With managed DMARC, also on Basic, you point _dmarc to us with one CNAME and change the policy in the app.

Sources

• DMARC records: public DNS, checked 12 Nov 2026.
• EasyDMARC, 2025 DMARC Adoption Report, 29 May 2025, easydmarc.com.
• Valimail, 2026 State of DMARC, press release, 25 Feb 2026, valimail.com.
• FBI, NSA and US State Department, "North Korean Actors Exploit Weak DMARC Security Policies", 2 May 2024, ic3.gov.
• HMRC, "Record number of fake HMRC websites deactivated", 30 Jun 2018, gov.uk.
• Google, Email sender guidelines, support.google.com (read 12 Nov 2026).
• Yahoo, Sender best practices, Feb 2024, senders.yahooinc.com.
• Microsoft, "Outlook's new requirements for high-volume senders", 2 Apr 2025, techcommunity.microsoft.com.