DMARC for Monaco Businesses

Three DNS records decide whether your email arrives

Most Monaco businesses discover email authentication the hard way. A client says they never received the quote. A newsletter that used to land in inboxes starts landing in spam. Or — worse — a supplier calls about an invoice your company never sent.

All three problems trace back to the same place: three small records in your domain's DNS, called SPF, DKIM and DMARC. They are not a marketing feature. They are the mechanism by which Gmail, Outlook and every other mailbox provider decides whether a message claiming to come from your domain is genuinely from you.

If those records are missing, wrong, or set to a policy that does nothing, two things follow. Your legitimate mail gets treated with suspicion. And anyone in the world can send email that appears to come from your address, with nothing to stop it.

This is fixable in a week. Most companies here simply have not looked.

Why the rules got stricter, and why they are not loosening

For years, authentication was optional in practice. That changed in 2024, when Google and Yahoo introduced enforced requirements for bulk senders, and it tightened again when Microsoft applied comparable rules to high-volume senders into Outlook and Hotmail addresses.

The current shape of the requirements is consistent across the major providers. If you send at scale — the commonly cited threshold is around 5,000 messages a day to a single provider's addresses — you need SPF and DKIM in place, a published DMARC record, a From domain that aligns with your authentication, one-click unsubscribe on marketing mail, and a spam complaint rate kept below roughly 0.3%.

Two details matter more than the headline. First, providers moved from quietly filtering non-compliant mail to rejecting it outright — a hard bounce, not a spam folder. Second, and more relevant to Monaco: the volume thresholds define who gets enforced against, not who gets judged. A twelve-person family office sending forty emails a day is assessed on the same signals. It simply fails more quietly.

What each record actually does

SPF publishes the list of servers allowed to send mail for your domain. If a message arrives from a server not on that list, the receiver knows something is off.

DKIM adds a cryptographic signature to each message, tied to a key published in your DNS. It proves the message genuinely came from your domain and was not altered on the way.

DMARC is the one that ties it together and the one most often missing. It tells receiving servers two things: what to do with mail that fails SPF and DKIM (p=none, p=quarantine, or p=reject), and where to send reports about attempted use of your domain.

That reporting function is the underrated half. A DMARC record at p=none blocks nothing, but it does start a stream of data telling you exactly who is sending mail as your domain — including the systems you had forgotten about, and the ones you never authorised.

The alignment trap

Here is where most Monaco companies fail, and it is not the record itself.

A typical small business here sends from more places than it realises: Microsoft 365 or Google Workspace for day-to-day mail, a newsletter platform, the website's contact form, a booking or CRM system, an accounting tool that mails invoices, and often an agency sending on the company's behalf.

Every one of those is a sender for your domain. DMARC requires alignment — the domain in the visible From address must match the domain that authenticated the message. When a platform signs mail with its own domain rather than yours, the message passes DKIM technically but fails alignment, and DMARC treats it as unauthenticated.

This is the single most common reason a company turns on enforcement and immediately breaks its own invoicing or newsletter. It is also why the inventory step is not optional. Before you change any policy, you need a complete list of every system that sends mail as you, each one configured to sign with your domain. If your email marketing and CRM stack has grown organically over several years, expect to find at least one sender nobody remembers setting up.

Spoofing, invoice fraud, and the September 2026 shift

Monaco's business profile makes this more than a deliverability question. Private wealth, real estate, yachting and hospitality all run on high-value transactions agreed over email between parties who may never meet in person. That is precisely the profile fraudsters target with payment-diversion and false-invoice attacks.

An unprotected domain makes the attacker's job trivial. They do not need to compromise anything — they simply send mail that says it is from your finance address, because nothing on your side says they cannot. A DMARC policy at p=reject does not stop every variant of this fraud, but it closes off the most direct route.

The timing is worth noting. Monaco's structured e-invoicing obligation begins to apply from 1 September 2026, phasing in by company size. As invoicing becomes more systematic and automated, invoice-related email becomes a more attractive target and a more damaging thing to have impersonated. Firms whose sites carry sensitive client relationships — the pattern behind most private wealth websites — should treat domain protection as part of the same project.

Getting to enforcement without breaking anything

The sequence is boring and it works.

Publish DMARC at p=none with a reporting address, and leave it for two to four weeks. Read the reports — use a monitoring tool, because raw XML is unreadable. Build the full sender inventory from what you see, and fix SPF and DKIM alignment for each legitimate source, one at a time. Then move to p=quarantine, initially on a percentage of traffic, and watch. Only then go to p=reject.

Skipping straight to p=reject is how businesses discover their accounting software was the one sender nobody had configured. Do not do it in the week you send a campaign.

Then keep it maintained. Every new tool added later is a new sender, and DNS records drift as platforms change infrastructure. This belongs in the same routine as the rest of your website maintenance, not in a one-off project folder.

What to do this month

Check what your domain currently publishes — a DMARC lookup takes seconds. If there is no record, publish one at p=none today; it is low-risk and it starts the data flowing. If the record exists but has sat at p=none for a year — the more common finding here — you have visibility without protection.

DNS changes are straightforward for someone who does this regularly and easy to get subtly wrong otherwise: a single malformed SPF record can degrade delivery for every message you send. If email is where your business actually happens, fold this into a wider digital strategy review rather than treating it as an IT chore.

Want help auditing your domain's email authentication and moving it safely to enforcement? Get in touch — we will tell you where you stand before anything changes.