Does My Singapore Business Need DMARC? What CSA's Cyber Essentials Mark Now Requires

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. Strip away the acronym and the function is simple: it tells email providers like Gmail and Outlook what to do when someone sends an email that claims to be from your domain but fails to prove it.

DMARC builds on two existing protocols. SPF (Sender Policy Framework) is a published list of which servers are authorised to send email for your domain — think of it as a guest list at the door. DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outgoing email, proving the content was not altered in transit.

The problem DMARC solves is that SPF and DKIM, on their own, do not tell a receiving mail server what to actually do when a message fails those checks — and critically, neither protocol checks whether the visible sender address (what shows up in the recipient's inbox) matches the domain that was actually authenticated. This gap is exactly what attackers exploit to send emails that appear to come from your company's name and address, even when your actual mail servers were never involved.

DMARC closes that gap. It is a DNS record that does two things: it defines a policy (let the email through, send it to spam, or block it outright) for messages that fail authentication, and it generates reports showing you exactly who is sending email using your domain — including unauthorised parties impersonating you.

Three separate pressures have converged on Singapore businesses at the same time, and most SME owners are aware of at most one of them.

The Cyber Essentials Mark is Singapore's baseline cybersecurity certification, designed specifically for SMEs and non-profits that lack a dedicated IT security team. As of the Cyber Essentials (2025) framework — which all applications have been required to use since February 2026 — DMARC implementation, alongside aligned SPF and DKIM configuration, is part of the controls that independent certification assessors check for.

This matters beyond the certificate itself. Cyber Essentials certification is already a requirement for vendors under IMDA's SMEs Go Digital pre-approval process, and CSA has publicly indicated it is assessing whether the Mark may become a requirement for organisations handling sensitive data or bidding for government contracts. For a Singapore business that wants to be a PSG-approved vendor, sell into government-linked entities, or simply demonstrate baseline digital trust to enterprise clients, DMARC is increasingly part of the entry ticket, not an optional add-on.

Since February 2024, Google's bulk sender guidelines require any domain sending more than 5,000 emails per day to Gmail addresses to have SPF, DKIM, and DMARC properly configured and aligned — or risk having messages filtered to spam or rejected outright. Yahoo has matched this requirement.

The 5,000-email threshold sounds like it excludes most small Singapore SMEs, but it does not provide the safety most business owners assume. Inbox providers are applying increasing scrutiny to all unauthenticated domains, regardless of volume — a business sending a few hundred invoices and client emails a month can still see deliverability degrade if its domain has no authentication signal at all. And a domain with no DMARC record offers zero protection against impersonation no matter how few emails it legitimately sends.

According to CSA's Singapore Cyber Landscape 2024/2025 report, phishing attacks in Singapore rose 49% in a single year, with more than 6,100 cases reported, up from roughly 4,100 the year before. Banking and financial services, government agencies, and e-commerce platforms were the most frequently spoofed industries — but any business with an email domain is a potential target, and notably, 12% of these phishing emails already contained AI-generated content, making them harder for recipients to spot by tone or grammar alone.

Singapore's SMEs make up 99% of all businesses in the country and employ roughly 70% of the workforce, according to the Ministry of Manpower. The consequences of a successful email-based attack carried out under a company's domain name — misdirected payments, stolen customer data, reputational damage with clients who received fraudulent invoices that looked exactly like the real thing — can take years to recover from, particularly for a business whose entire value proposition rests on trust with Singapore clients.

Consider a Singapore professional services firm — a digital agency, an accounting practice, an immigration consultancy — that has never configured DMARC. Its domain, say firmname.sg, has no record at all.

A criminal registers a lookalike domain or simply spoofs the visible "From" address to read invoices@firmname.sg, without ever needing access to the firm's actual mail servers. They send an email to one of the firm's clients with updated bank account details for an upcoming payment. Because there is no DMARC policy instructing receiving mail servers to scrutinise or reject unauthenticated mail claiming to be from firmname.sg, the email lands in the client's inbox looking entirely legitimate — same domain, same visible sender name, often a closely matched signature block lifted from a previous real email.

The client, having no reason for suspicion, transfers the payment to the fraudulent account. The firm only discovers the issue when the legitimate invoice goes unpaid and the client insists they already settled it — weeks later, with the funds long gone and the relationship damaged regardless of who is ultimately found at fault.

With DMARC at enforcement level (p=reject), that spoofed email would never have reached the client's inbox in the first place — it would have failed authentication and been blocked before delivery, with the firm receiving a report flagging the attempted spoof.

The single most common mistake — across every guide we reviewed and every implementation we have been involved in — is jumping straight to the strictest enforcement setting without first auditing legitimate sending sources. This breaks real email and creates more operational pain than the threat it solves.

The correct sequence has three stages:

Stage 1: Monitor (p=none). Publish a DMARC DNS record with a policy of none and a reporting address. At this stage, nothing changes for deliverability — no email is blocked or quarantined. You are simply collecting aggregate reports showing every source currently sending mail using your domain, including your CRM, your marketing platform, your accounting software, and any unauthorised senders.

Stage 2: Align and clean up. Review the reports. Every legitimate platform sending on your behalf (Mailchimp, HubSpot, Xero, your transactional email provider, your WhatsApp Business API webhook notifications) needs to be either properly included in your SPF record or DKIM-aligned for your actual domain. This is where most Singapore SMEs hit a technical snag worth knowing about in advance: SPF has a hard limit of 10 DNS lookups. Every third-party platform you authorise in your SPF record adds a lookup, and businesses running a typical stack of five or six cloud tools can exceed this limit without realising it — which causes a PermError that fails DMARC for all outgoing mail, including legitimate messages. If your business has accumulated SPF includes from platforms you no longer use, this is the moment to clean the record up.

Stage 3: Enforce (p=quarantine, then p=reject). Once the reports confirm that all legitimate senders are passing alignment cleanly, move the policy progressively stricter — first to quarantine (failed messages go to spam, giving a safety margin), then to reject (failed messages are blocked outright). This is the level CSA's Cyber Essentials assessment and Google/Yahoo's bulk sender requirements are ultimately looking for.

For most Singapore SMEs with a relatively simple email setup — one domain, two or three sending platforms — this entire process does not require external technical expertise and can realistically be completed within four to six weeks of monitoring and adjustment. Businesses with more complex environments (multiple subdomains, regional offices each sending email, numerous third-party marketing and transactional tools) benefit from a DMARC management platform that automates report analysis, or from working with a digital services partner who has handled this configuration before.

For SMEs incorporated in Singapore, CSA provides funding support for the first successful Cyber Essentials certification, and CISOaaS (Chief Information Security Officer as a Service) consultancy co-funding covers up to 70% of preparation costs for businesses that need outside help getting their controls — including DMARC — in place before assessment. The subsidy window for certifying with this funding support runs until February 2028, giving Singapore SMEs a meaningful financial incentive to move on this now rather than waiting for it to become a hard mandate.

Even for Singapore businesses with no current plan to pursue the Cyber Essentials Mark, the underlying argument for DMARC stands independently of certification. Email domain impersonation does not require certification pressure to be a real risk — it requires only that your business sends email and that criminals find it worthwhile to impersonate you, which, for any business handling invoices, client communications, or payment instructions, is essentially guaranteed over time.

The deliverability angle alone is often reason enough. A domain with proper SPF, DKIM, and DMARC alignment is treated with materially more trust by Gmail, Outlook, and other major inbox providers — meaning legitimate marketing emails, client updates, and transactional notifications are less likely to be filtered to spam, independent of any certification requirement.

Q1: My Singapore business sends far fewer than 5,000 emails a day. Do I still need DMARC?

Yes. The 5,000-email threshold only determines when Google and Yahoo apply hard enforcement against bulk senders — it is not a safety threshold below which your domain is protected from impersonation. A business sending a few hundred emails a month can still have its domain spoofed by criminals sending fraudulent invoices or phishing messages to clients. DMARC protects against domain impersonation regardless of your actual sending volume, and increasingly, inbox providers scrutinise all unauthenticated domains, not just high-volume senders.

Q2: Will setting up DMARC break my existing email or marketing campaigns?

Not if you follow the staged approach correctly. Starting at p=none changes nothing about delivery — you only begin collecting visibility reports. The risk of disruption arises only if a business jumps directly to p=reject without first auditing and aligning all legitimate sending sources, which is precisely why the monitor-then-enforce sequence exists. Take the time at the monitoring stage; do not rush to enforcement.

Q3: Is DMARC mandatory for Singapore businesses by law?

Not as a blanket legal requirement as of mid-2026. However, it is a required control within CSA's Cyber Essentials Mark certification, which is already mandatory for certain vendor categories under IMDA's SMEs Go Digital pre-approval process, and CSA has signalled it is assessing broader requirements for organisations handling sensitive data or government contracts. Independently of any regulatory trajectory, Google and Yahoo's bulk sender policies function as a practical mandate for any business doing meaningful email volume, regardless of what Singapore law specifically requires.

Q4: I use multiple platforms to send email — CRM, marketing tool, accounting software, WhatsApp notifications. Does each one need its own DMARC setup?

No — DMARC, SPF, and DKIM are configured at the domain level, not per platform. What you need is for every legitimate platform sending email using your domain to be either listed in your SPF record or configured with its own DKIM signature aligned to your domain. This is exactly what the monitoring stage (p=none) is designed to reveal: it shows you every source currently sending as your domain, so you can systematically bring each one into alignment before moving to enforcement.

Q5: How long does the full DMARC implementation process realistically take for a Singapore SME?

For a business with a straightforward setup — one primary domain and a handful of sending platforms — the full process from initial DNS record publication through to enforcement typically takes four to eight weeks, most of which is the monitoring period needed to confirm all legitimate senders are correctly aligned before tightening the policy. Businesses with more complex setups (multiple subdomains, several regional or departmental email senders, legacy platforms with unclear configuration) should budget for a longer monitoring period and may benefit from a management platform or technical partner to interpret aggregate reports accurately.

Mayson supports Singapore SMEs with domain and email infrastructure setup, including DMARC, SPF, and DKIM configuration as part of broader digital infrastructure and outreach system builds. If you're unsure where your domain currently stands, book a consultation and we can walk through your current DNS setup with you.