Guide · Email

DMARC setup for a small business: GoDaddy, Microsoft 365, Google Workspace, Namecheap

DMARC is one line of text that tells Gmail and Outlook what to do with email pretending to be from your business. Adding it takes about ten minutes. Tightening it safely takes a few weeks of watching. Here is the whole process, provider by provider.

Published 24 October 2026 · By the What's wrong with my site? team · About a 10-minute read

v=DMARC1; p=none; rua=mailto:[email protected]

Before you start

• Find where your DNS lives. DNS is your domain's public settings page. It's usually where you bought the domain (GoDaddy, Namecheap, Squarespace, which took over Google Domains) or wherever it was pointed later (often Cloudflare, or your web designer's account). Your email provider is not always the same company. A free lookup such as MXToolbox's "DNS lookup" or "NS lookup" shows which company answers for your domain.
• Get SPF and DKIM working first. DMARC passes when either SPF or DKIM passes and matches your domain. If neither is set up, DMARC has nothing to judge. Our guide to email going to spam covers both.
• Pick a mailbox for reports. Reports arrive as zipped data files, a few a day for a small business. A separate address like [email protected] (an alias or group is fine) keeps them out of your main inbox. Free and paid report readers can turn them into a readable summary; if you use one, they give you their own address to put in rua=.
• Look for an existing record. A domain can have only one DMARC record. If _dmarc already exists, edit it.

What each part of the record means

There are other optional parts (rules for subdomains, how strictly domains must match). A small business rarely needs them, and leaving them out uses sensible defaults.

Menus below are how each provider labels things as we write this (October 2026). They rename menus often; if a step doesn't match, search the provider's help for "add TXT record".

GoDaddy

1. Sign in and open Domain Portfolio (sometimes "My Products" → Domains). Select your domain, then DNS.
2. Scroll the list for a TXT record named _dmarc. GoDaddy sometimes adds one automatically when you buy email through them. If it's there, click the pencil (edit) and change its value; don't add a second one.
3. If there isn't one, click Add New Record. Type: TXT. Name: _dmarc (just that; GoDaddy adds your domain). Value: your starting record. TTL: leave the default.
4. Save. GoDaddy usually shows it within minutes; elsewhere in the world it can take up to an hour or two.

If you use Microsoft 365 bought through GoDaddy, the DNS records are still managed here, in GoDaddy's DNS page.

Microsoft 365

Where the record goes depends on who runs your DNS:

• DNS at another company (GoDaddy, Namecheap, Cloudflare and so on, which is most businesses): add the _dmarc TXT record there, using that company's steps on this page.
• DNS managed by Microsoft (you moved your domain's nameservers to Microsoft when you set up 365): go to the Microsoft 365 admin center → Settings → Domains → your domain → DNS records → Add record. Type TXT, name _dmarc, value your starting record.

Before tightening the rule, make sure DKIM is switched on for your own domain in the Microsoft Defender portal (security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM). Until it is, Microsoft signs with its own onmicrosoft.com domain, which doesn't count toward your DMARC.

Google Workspace

Google Workspace doesn't host your DNS, so the record goes wherever your domain is managed: GoDaddy or Namecheap (steps on this page), Cloudflare (DNS → Records → Add record, type TXT, name _dmarc), or Squarespace if your domain came from Google Domains (Domains → your domain → DNS → DNS settings → add a custom record).

Before tightening the rule, check DKIM is on: Google Admin console → Apps → Google Workspace → Gmail → Authenticate email. The status should say it's authenticating email with DKIM. If it doesn't, generate the record, add it to your DNS (host google._domainkey), and click Start authentication.

Namecheap

1. Sign in, go to Domain List, and click Manage next to your domain.
2. Open the Advanced DNS tab. (If it says your domain uses custom nameservers, your DNS is somewhere else, such as Cloudflare or your web host, and the record goes there instead.)
3. Under Host Records, click Add New Record → TXT Record. Host: _dmarc. Value: your starting record. TTL: Automatic.
4. Click the green check mark to save.

If you use Namecheap's Private Email, check that its SPF and DKIM records are present on the same Advanced DNS page before tightening the rule; the Private Email dashboard lists what it expects.

Check it worked

• Use a DMARC lookup tool (MXToolbox has a free one): type your domain. It should find one record starting v=DMARC1.
• From a computer, the command nslookup -type=txt _dmarc.yourbusiness.ca shows the same thing.
• Within a day or two, the first reports should arrive at your rua address, typically from Google and Microsoft.

When to move to quarantine and reject

p=none protects nobody on its own; it's a listening period. The point is to get to reject without blocking your own mail. A sensible pace for a small business:

To change the rule, edit the same _dmarc record and change only the p= part, for example:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

If anything goes wrong after a change, set it back to the previous value. It takes effect within roughly an hour.

What breaks, and how to tell

Once the rule is quarantine or reject, anything sending with your address in "From" that isn't set up for your domain gets sent to spam or blocked. The usual suspects for an Ontario plumber or dental office:

• The website's contact or booking form, when it emails "from" your address.
• Booking and patient-reminder systems, invoicing and accounting tools, point-of-sale receipts.
• Newsletter tools, if they haven't been through their "authenticate your domain" step.
• An office printer or scanner that emails scans, or an old server.
• Mail that gets forwarded on by a recipient, or sent through a mailing list, can sometimes fail. DKIM usually survives forwarding, which is another reason to have it on.

How to tell: the reports list each sending server and whether it passed; a report reader names the service for you. Without one, the quickest test is to make each tool send you an email at a Gmail address and use Show original: you want SPF, DKIM and DMARC all saying PASS. Customers saying "I never got the invoice" is the late signal; the reports are the early one.

Questions owners ask

Related: Why your business email goes to spam · All guides · Sources we check against