Hey there,
The evenings are getting lighter in my part of the world and there are flowers popping up in my garden and I cannot concentrate on anything.
I was supposed to be writing a blog post on Tuesday but instead I clicked on a research report in an email and spent the entire afternoon falling down a rabbit hole that had absolutely nothing to do with what I was meant to be working on.
A few coffees later I hadn't written a single word of my actual assignment but I knew a lot about DMARC adoption rates.
If you've been reading these newsletters for a while you might remember me admitting that I'd completely forgotten to set up DMARC on my own domain when I moved to a new host. Only I had no idea because everything was still working fine.
If "DMARC" means absolutely nothing to you, here's a quick refresher: When your website sends emails, providers like Gmail and Outlook want proof the email is actually from you. There are three DNS records that do this: SPF, DKIM, and DMARC. SPF and DKIM prove your email is legit. DMARC tells providers what to do if it's not: block it, send it to spam, or just let it through anyway.
When you set up a DMARC record, you choose this action. And most people pick "none" because it seems like the safe option. It's a bit like having one of those doorbell cameras that shows you someone stealing your parcel but doesn't actually do anything to stop them. You just get to watch it happen in HD.
According to the research I was procrastinating with, only 42% of domains have DMARC set to actually block or quarantine the fakes. Everyone else either doesn't have it at all, or has it set to "none."
Check Your Domain Authentication
Some industries are way better at this than others. For example, online retailers are at 73% (because a spoofed order confirmation is the kind of thing that ruins your week). Healthcare is at about 57%, financial services around 59%. But others are lagging behind. Higher education is only at 34%, and even in tech-adjacent industries like gaming, only about a third of domains are properly set up.
I'm not going to pretend your emails will stop working tomorrow without DMARC. The strict rules from Gmail, Yahoo, and Microsoft are aimed at people sending 5,000+ emails a day right now. But these requirements have only ever gone in one direction, and that's stricter. Microsoft tightened theirs again last year. Google keeps ramping up enforcement. What's optional for smaller senders today won't be optional forever.
And even right now, properly authenticated emails have a better chance of reaching inboxes instead of spam folders. Plus without DMARC, bots can send emails pretending to be from your domain. They really don't care how small your site is.
Consider this your email spring clean. If you're using WP Mail SMTP with a good transactional email provider like SendLayer, your DNS records were probably sorted when you first set things up. But it's always worth checking.
Use the WP Mail SMTP email test feature to check for any missing or misconfigured DNS records or use a DMARC analyzer for more detailed info (We've covered the whole process in our guide on how to create a DMARC record.) And if you want to understand how all three records fit together, the full guide to SPF, DKIM, and DMARC explains it without assuming you're a DNS expert.
If the clocks changing gives you the urge to check on things you've been ignoring, your email authentication setup is a good place to start.
(Stats from Valimail's yearly State of DMARC report if you want to go check out the full industry breakdown.)
Until next time,
Rachel
Product Educator, WP Mail SMTP