What is DMARC, and does my practice need it?

DMARC is an email authentication policy that tells receiving email servers how to handle messages that appear to come from your domain but fail authentication checks. If your medical or dental practice sends emails to patients using its own domain, DMARC helps protect your practice against email spoofing and phishing. ObaShield helps configure DMARC, SPF, and DKIM to protect your domain and improve email deliverability.

What's the difference between SPF, DKIM and DMARC?

SPF identifies which mail servers are authorized to send emails on behalf of your domain. DKIM adds a digital signature to verify that an email is authentic and has not been altered. DMARC uses SPF and DKIM authentication results to help receiving servers decide how to handle unauthenticated emails. Together, these three protocols help protect healthcare practices against email spoofing and phishing.

Will this break our appointment reminders or patient portal emails?

ObaShield identifies the systems that send emails on behalf of your practice, including EHR platforms, patient portals, billing systems, and appointment reminder services. Email authentication is implemented in stages, starting with monitoring before moving to full enforcement. This helps ensure legitimate patient communications continue working without email downtime.

Do you sign a Business Associate Agreement?

Yes. ObaShield signs a Business Associate Agreement (BAA) before any work begins. This establishes the required responsibilities for handling protected health information when providing services to healthcare practices.

How long does it take?

The process starts with a free email security scan that takes about 60 seconds. After reviewing the results, ObaShield schedules a kickoff call of approximately 30 minutes to understand your email systems. The setup and enforcement process depends on the number of email services and domains involved. Protection is implemented gradually to avoid disrupting legitimate emails.

Will this help with our cyber insurance application?

ObaShield helps healthcare practices address common cyber insurance requirements, including multi-factor authentication and email authentication. We review security gaps, implement appropriate improvements, and provide documentation that can support your cyber insurance application. However, completing these improvements does not guarantee insurance approval.

We use Microsoft 365 or Google Workspace. Aren't we already protected?

Microsoft 365 and Google Workspace provide built-in email security features, but using these platforms does not automatically mean your domain has complete email authentication and security protection. ObaShield reviews your email configuration, sets up DMARC, SPF, and DKIM, strengthens platform security, and reviews multi-factor authentication to help protect your practice.

Doesn't our EHR or IT vendor handle this?

Your EHR or IT vendor may manage certain email services, but they may not be responsible for every system sending emails on behalf of your practice. ObaShield reviews all email-sending services, including EHR platforms, patient portals, billing systems, and appointment reminders, to identify and configure the necessary email authentication records.

What if the scan finds problems?

If the free email security scan identifies problems, ObaShield reviews the results with you during a quick call and identifies the systems sending emails from your domain. We then provide recommendations, configure the necessary SPF, DKIM, and DMARC records, and gradually strengthen protection. Monthly monitoring and reports help you understand your domain's email security status.

SPF, DKIM, and DMARC: What’s the Difference and Why You Need All Three

Health Care

If you’ve ever been told your business needs “SPF, DKIM and DMARC,” you probably nodded and moved on. They sound technical, and they are. But the idea behind them is simple, and it matters for any business that sends email.

All three answer one question: did this email really come from the business it claims to be from?

Think of it like mailing a letter

Imagine your business sends an important letter.

SPF is the list of mail carriers you’ve approved to deliver for you.
DKIM is a tamper-proof wax seal on the envelope.
DMARC is your instruction to the post office: “If a letter claims to be from us but fails these checks, throw it out, and let us know.”

Each one covers a different gap. Together, they make it very hard for someone to send email in your name.

SPF: who’s allowed to send for you

SPF (Sender Policy Framework) is a record on your domain that lists the servers and services allowed to send email as you. That might be Microsoft 365 or Google Workspace, plus tools like your CRM, billing system or newsletter platform.

When an email arrives, the receiving server checks whether it came from a sender on your list.

Where SPF falls short: it checks a behind-the-scenes address, not the “From” address your customer actually sees. A scammer can still put your name in the visible From line. SPF also breaks easily when email gets forwarded.

DKIM: proof the email wasn’t changed

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server uses a public key published on your domain to confirm two things: the email really came from you, and nobody altered it along the way.

Where DKIM falls short: on its own, it doesn’t tell anyone what to do when the signature is missing or fails. A fake email with no signature at all might still get delivered.

DMARC: the rule that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) is what makes SPF and DKIM actually enforceable. It does three jobs:

Checks alignment. It makes sure the domain that passed SPF or DKIM matches the From address your customer sees. That closes the gap scammers rely on.
Sets the policy. You choose what happens to email that fails: let it through and just report it (none), send it to spam (quarantine), or block it outright (reject).
Sends you reports. You get regular reports showing every service sending email as your domain, including ones you didn’t know about and ones that aren’t yours.

Why one or two isn’t enough

This is where most businesses get caught. They have SPF set up, maybe DKIM too, and assume they’re covered.

What you have	What happens to a spoofed email
Nothing	Very likely delivered
SPF only	Can still be delivered with your name in the From line
SPF and DKIM, no DMARC	Receiving servers decide on their own, often inconsistently
All three, DMARC at “none”	Still delivered, but you can see it in reports
All three, DMARC at “reject”	Blocked

A DMARC record set to “none” is a good first step, but it only watches. It doesn’t stop anything. The goal is to reach quarantine or reject once you’ve confirmed your real email passes.

There’s a deliverability side too. Since 2024, Google and Yahoo require bulk senders to have SPF, DKIM and DMARC in place. Missing records can send your own legitimate email to spam.

Healthcare practices: this one’s for you

If you run a medical or dental practice, email spoofing is a direct risk to patient trust and to your HIPAA obligations. We cover that in detail in What Is DMARC and Does My Medical Practice Need It?

See where your domain stands

Our free email security scan checks all three records in seconds and explains the results in plain English.

Want it handled for you? We set up SPF, DKIM and DMARC, monitor the reports, and move your domain to full protection without breaking your real email. Learn more about our email security services or see a sample monthly report.

ObaShield is a Maryland-based cybersecurity firm that helps small businesses, healthcare practices and federal contractors protect their email domains. Questions? Call us at 301-500-0211