What DMARC Is and Why Your Dental Practice Needs It

Suppose someone sends your patients an email from your practice's own address, says their balance is past due and links to a payment page they control. Will Gmail deliver it?

Gmail's spam filter might catch it. But for most dental offices around here, nothing in the practice's own settings tells Gmail to refuse it. The setting that would is called DMARC. It's free, and it lives in your domain's DNS next to your website records.

What DMARC does

The From line on an email proves nothing by itself. Anyone can type your address into it, the same way anyone can write your return address on an envelope.

Three public records on your domain let the receiving mail system check whether a message really came from you:

• SPF lists the mail servers allowed to send email for your domain, such as Microsoft 365's or Google's.
• DKIM adds a digital signature to each message, so the receiver can confirm it came from your systems and wasn't altered on the way.
• DMARC tells the receiver what to do when a message claims to be from you but fails those checks, and can ask for daily reports on who is sending as you.

On their own, SPF and DKIM aren't tied to the From address your patients see. DMARC ties them to it, and it's the part where you tell the receiver what to do with a forgery. In CISA's words, DMARC "removes guesswork from the receiver's handling of failed emails."

The three settings

A DMARC record contains a policy, written as p=. There are three:

p=none is a monitoring setting. It's the right place to start and a poor place to stay, because a forged email is handled essentially as if you had no record at all.

The same forged email under each setting. The From address is fictional.

What we found locally

In late September 2026 we looked up the public DMARC records of 28 independent dental practices in Holly Springs, Fuquay-Varina, Apex, Garner and Angier. These records are public by design, so anyone can do the same lookup.

• 16 had no DMARC record.
• 6 had a record set to p=none.
• 1 had two DMARC records. The standard says a receiver that finds more than one applies no DMARC at all, so that practice is in the same position as the first 16.
• 5 were set to quarantine or reject.

That's 23 of 28 practices giving receivers no instruction to stop an email forged with their address.

Why a dental office should care

Your patients trust email from you. A "your balance is past due" or "please update your insurance information" message from your real address is far more convincing than the same message from a stranger's Gmail account.

The same goes for everyone else you email: your lab, your billing company, your accountant, your landlord. A forged request that appears to come from your office can reach any of them.

Two things worth knowing, so you can weigh it honestly:

• It isn't a HIPAA requirement. The Security Rule doesn't name it, and the HHS 405(d) guide for small healthcare organizations (2023 edition) recommends spam filtering, multi-factor authentication and staff training for email. DMARC isn't named in its recommendations, though one footnote points to an FTC page on email authentication.
• Some insurance applications ask about it, most don't. Tokio Marine HCC's e-MD application for healthcare providers asks which of SPF, DKIM and DMARC you've put in place to protect against phishing. None of the eight general cyber applications we keep on file asks about DMARC by name; the closest is The Hanover's ransomware supplement, which asks whether you enforce SPF on incoming email.

Either way, what it does is narrow and worth doing: it stops email forged with your exact address, and it costs nothing.

What DMARC won't stop

• Lookalike domains. A scammer who registers a near-copy of your domain, with one letter swapped or "-billing" added, owns a different domain. Your DMARC record doesn't cover it.
• A broken-into mailbox. If someone steals the front desk's password, the email they send passes every check, because it really does come from your systems. Multi-factor authentication is the fix there.
• Display-name tricks. The sender's name can say "Your Dental Office" while the address behind it is a random Gmail account. Many phone mail apps show only the name.

Our breakdown of four business email compromise emails shows how these play out.

How to set it up without breaking your reminders

Writing the record takes a few minutes. The care goes into not blocking your own legitimate email.

Most practices send email from more than one place: the Microsoft 365 or Google mailbox, plus an appointment-reminder or recall system, a review-request tool, an online payment service, maybe a newsletter. Each of those has to send in a way that lines up with your domain before you move past p=none. For most of these tools that means turning on DKIM signing for your domain in the tool's settings, often labeled "domain authentication" or "custom sending domain." Adding the tool to SPF alone often isn't enough, because many send with their own return address behind the scenes. Skip this step and their messages start landing in spam or bouncing.

1. Check what you have. Type your domain, the part after the @ in your email address, into a free lookup such as MxToolbox's DMARC check.
2. If there's no record, publish one at p=none with an address for reports. Receivers typically send reports once a day.
3. Read the reports for a few weeks. They show the mail servers that receivers saw sending as your domain, and whether each one passed. Match those to your services, and fix anything legitimate that fails.
4. Move to p=quarantine, then p=reject, once the reports show only your own services. CISA recommends the same order: none, then quarantine, then reject.
5. If you have two DMARC records, merge them into one. Receivers ignore both until there's only one.

The change is made wherever your domain's DNS is managed. For many practices that's the website company or a registrar account, such as GoDaddy, that someone set up years ago. Finding that login is often the slowest part.

If you'd like a hand

We'll look up your practice's email records at no charge and tell you what's missing and in what order to fix it. If you have an IT person, we're happy to walk them through it. Get in touch, or see how we handle email security and dental practices in general.

Sources: CISA, DMARC fact sheet; RFC 7489, sections 6.3 and 6.6.3; HHS 405(d), HICP Technical Volume 1; Tokio Marine HCC, e-MD / MEDEFENSE Plus application, question 7.c; local lookups by Obsidian Ridge, September 2026.