Do small agencies need DMARC?

If you run a 15-person agency, it’s easy to assume DMARC is a big-company problem. Our data says the opposite. In our October 2026 check of UK agencies, PR firms and architecture practices, firms with fewer than 50 staff were three times as likely to have no DMARC record at all as firms with 250 or more. Smaller firms are the most exposed, not the least.

Do small agencies need DMARC?

Yes. DMARC is what stops someone sending email that looks like it came from your domain. A small firm’s name is just as easy to fake as a large one’s, and the people who receive the fakes are your clients and suppliers. The setting is free, and the size of the firm makes no difference to how it works.

What did we find?

We checked the DNS records of 886 UK agencies, PR firms and architecture practices with a known staff count on 7 October 2026. The smaller the firm, the weaker its protection.

Staff	Firms	No DMARC record	Monitor only (p=none)	Nothing stopping fakes	Fully protected
Under 50	544	21.0%	36.9%	58.3%	16.2%
50 to 249	285	13.7%	35.1%	48.8%	18.9%
250 or more	57	7.0%	31.6%	38.6%	36.8%

“Nothing stopping fakes” adds together firms with no record, a broken record or a monitor-only record. The 250+ group is small, so treat its figures as a direction rather than a precise rate. The full method is in our research.

Why do smaller firms fall behind?

Our data shows the gap, not its cause. But three facts about how DMARC works make the pattern unsurprising.

• Nobody switches it on for you. Microsoft 365 and Google Workspace don’t publish a DMARC record for your own domain when you set up email. Someone has to add it to your domain’s DNS. In a small firm without IT staff, that job often has no owner.
• The rules that force it don’t reach small firms. Google, Yahoo and Microsoft require DMARC from senders of more than 5,000 emails a day. Most small agencies never get near that, so nothing ever prompts them.
• Getting to full protection takes attention. Moving from monitoring to blocking means checking every system that sends email as you. That’s a small job, but it needs someone to own it.

Why does it matter more for a small firm?

A fake email doesn’t need a big target. It needs a convincing one. A small agency’s clients usually know its people by name, deal with them directly and pay their invoices without a second thought. That trust is exactly what a fake invoice or a “new bank details” email relies on.

A small firm also has less room to absorb the damage: a client who pays a fraudster, a supplier who stops trusting your emails, or time spent cleaning up instead of billing.

What should a small agency do?

The same as any firm, in stages, so nothing genuine gets blocked:

1. Check where you stand. The checker at the top of this page shows your current DMARC setting in about a minute.
2. Add a record if you have none. Start at p=none with a reporting address, so you can see who sends email as you.
3. List your sending systems. Most small agencies have a handful: Microsoft 365 or Google, a CRM, a newsletter tool, accounts software, a website form.
4. Move to quarantine, then reject. Once the reports show nothing genuine failing. Our post on what p=none means covers this step.

For a firm with a few sending systems, this can be done in a few weeks.

What this means for your agency

If you’re under 50 staff, the odds in our data say there’s a good chance your domain has nothing stopping a fake email. Ask whoever looks after your IT one question: is our DMARC set to reject? If the answer is no, or nobody knows, run the checker above and you’ll have your answer in a minute.

Frequently asked questions

We only have a few staff. Is anyone really going to fake our email? Fake emails aren’t aimed at big names. They’re aimed at relationships where people pay without checking. Small firms have plenty of those.

Does DMARC cost anything? The record itself is free. It’s a line of text added to your domain’s DNS. The only cost is the time to set up your sending systems properly.

Isn’t our email provider handling this? Not for your own domain. Microsoft and Google filter the email you receive, but publishing DMARC for the domain you send from is your job.

We’re on p=none. Are we covered? No. p=none reports fakes but still lets them through. It’s a first step, not protection.

Sources

• Cubit Technology: DMARC adoption in UK agencies, October 2026
• Google: Email sender guidelines
• Microsoft: Outlook’s new requirements for high-volume senders