What is DMARC, and does my practice need it?

DMARC is an email authentication policy that tells receiving email servers how to handle messages that appear to come from your domain but fail authentication checks. If your medical or dental practice sends emails to patients using its own domain, DMARC helps protect your practice against email spoofing and phishing. ObaShield helps configure DMARC, SPF, and DKIM to protect your domain and improve email deliverability.

What's the difference between SPF, DKIM and DMARC?

SPF identifies which mail servers are authorized to send emails on behalf of your domain. DKIM adds a digital signature to verify that an email is authentic and has not been altered. DMARC uses SPF and DKIM authentication results to help receiving servers decide how to handle unauthenticated emails. Together, these three protocols help protect healthcare practices against email spoofing and phishing.

Will this break our appointment reminders or patient portal emails?

ObaShield identifies the systems that send emails on behalf of your practice, including EHR platforms, patient portals, billing systems, and appointment reminder services. Email authentication is implemented in stages, starting with monitoring before moving to full enforcement. This helps ensure legitimate patient communications continue working without email downtime.

Do you sign a Business Associate Agreement?

Yes. ObaShield signs a Business Associate Agreement (BAA) before any work begins. This establishes the required responsibilities for handling protected health information when providing services to healthcare practices.

How long does it take?

The process starts with a free email security scan that takes about 60 seconds. After reviewing the results, ObaShield schedules a kickoff call of approximately 30 minutes to understand your email systems. The setup and enforcement process depends on the number of email services and domains involved. Protection is implemented gradually to avoid disrupting legitimate emails.

Will this help with our cyber insurance application?

ObaShield helps healthcare practices address common cyber insurance requirements, including multi-factor authentication and email authentication. We review security gaps, implement appropriate improvements, and provide documentation that can support your cyber insurance application. However, completing these improvements does not guarantee insurance approval.

We use Microsoft 365 or Google Workspace. Aren't we already protected?

Microsoft 365 and Google Workspace provide built-in email security features, but using these platforms does not automatically mean your domain has complete email authentication and security protection. ObaShield reviews your email configuration, sets up DMARC, SPF, and DKIM, strengthens platform security, and reviews multi-factor authentication to help protect your practice.

Doesn't our EHR or IT vendor handle this?

Your EHR or IT vendor may manage certain email services, but they may not be responsible for every system sending emails on behalf of your practice. ObaShield reviews all email-sending services, including EHR platforms, patient portals, billing systems, and appointment reminders, to identify and configure the necessary email authentication records.

What if the scan finds problems?

If the free email security scan identifies problems, ObaShield reviews the results with you during a quick call and identifies the systems sending emails from your domain. We then provide recommendations, configure the necessary SPF, DKIM, and DMARC records, and gradually strengthen protection. Monthly monitoring and reports help you understand your domain's email security status.

What Is DMARC and Does My Medical Practice Need It?

Health Care

If someone sent your patients an email that looked like it came from your practice, asking them to “update their billing info,” would anything stop it?

For a lot of medical practices, the honest answer is no. That’s exactly the problem DMARC solves. Here’s what DMARC for medical practices looks like, and whether yours needs it.

What DMARC actually is

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. That’s a mouthful, so here’s the short version: it’s a setting on your domain that tells email providers like Gmail and Outlook what to do when someone sends email pretending to be you.

Without it, anyone can put your practice’s address in the “From” line. Your patients’ inboxes have no clear instructions on whether to trust it.

With DMARC set up properly, you tell the world: “If an email claims to be from us but didn’t come from our real systems, reject it.” Fake emails get blocked before they ever reach a patient.

DMARC works alongside two other records, SPF and DKIM. We break down how all three fit together in SPF, DKIM, and DMARC: What’s the Difference and Why You Need All Three.

Why medical practices are a target

Scammers go where the trust is, and patients trust their doctor’s office. An email from your practice gets opened. A link from your practice gets clicked.

That makes your domain valuable to criminals. Common scams include:

Fake billing or payment requests sent to patients
Phony “lab results ready” emails that lead to a login page built to steal passwords
Invoices or wire transfer requests sent to your staff that look like they came from a partner or vendor
Messages to insurers or other providers pretending to be your office

Smaller practices get hit hardest because they usually don’t have an IT team watching for this.

Does HIPAA require DMARC?

HIPAA doesn’t mention DMARC by name. But the HIPAA Security Rule does require you to protect patient information and to assess and reduce the risks to it. Email impersonation is one of the most common ways attackers get access to that information.

If a breach traces back to a spoofed email from your own domain, “we didn’t have basic email authentication in place” is not a position you want to defend. DMARC is a simple, low-cost safeguard that shows you took the risk seriously.

There’s a practical reason too. Since 2024, Google and Yahoo require DMARC for anyone sending email in bulk to their users. If your practice sends appointment reminders or newsletters at volume, missing DMARC can push your real emails into spam.

So, does your practice need it?

If your practice uses its own email domain, yes. Here’s a quick test:

Do you email patients from an address like name@yourpractice.com?
Do you send appointment reminders, billing notices or forms by email?
Would it hurt your reputation if a fake email went out under your name?

If you answered yes to any of these, DMARC belongs on your domain.

Setting up DMARC for medical practices.

DMARC isn’t something you switch on and forget. Done right, it’s a gradual process:

Check what you have now. Many practices already have a DMARC record that does nothing because it’s set to “monitor only.”
Find every service that sends email for you. Your EHR, billing system, patient portal, and email marketing tool may all send email using your domain. Each one needs to be set up correctly first.
Monitor the reports. DMARC sends back reports showing who is sending email as you, both legitimate services and impostors.
Tighten the policy step by step. Once your real email is passing, move from monitoring to quarantine, then to reject.

Rushing to “reject” before step 2 is done can block your own appointment reminders. That’s why most practices bring in help.

Check your domain for free

Not sure where your practice stands? Our free email security scan checks your SPF, DKIM and DMARC records in seconds and tells you in plain English what’s missing.

If you’d like us to handle the setup and ongoing monitoring, see our email security services or take a look at a sample monthly report to see what you’d get.

ObaShield is a Maryland-based cybersecurity firm that helps medical practices, small businesses and federal contractors protect their email domains. Questions? Call us at 301-500-0211.