Guides › DMARC policy not enabled

"DMARC policy not enabled": what it means and how to fix it

Q: Is it safe to switch straight to p=reject?

Not unless you're sure every sender is set up. With p=reject, legitimate mail from a tool that isn't authenticated, such as an invoicing app or website form, will be rejected. Start with p=none and reports, fix what fails, then move to quarantine and finally reject.

Q: Is DMARC p=none enough for Gmail and Yahoo?

For their bulk sender rules, a DMARC record with p=none meets the minimum. But it doesn't protect your domain from being spoofed, which is why security scanners and cyber insurance questionnaires flag it.

A security scan, an insurance questionnaire or a tool like MXToolbox says "DMARC quarantine/reject policy not enabled". Here's what that means, and how to fix it without blocking your own email.

Rather not do this yourself? We find and fix what's sending your email to spam for $199. If there's nothing to fix, you don't pay.

Email us your domain Free check

What it means

DMARC is a DNS record, named _dmarc, that tells Gmail, Outlook and Yahoo what to do with email that claims to be from your domain but fails its checks. It has three settings:

p=none: deliver it anyway, just send me a report.
p=quarantine: put it in spam.
p=reject: refuse it.

The warning means your domain has no DMARC record at all, or has one set to p=none. Either way, someone can send email pretending to be you, for example a fake invoice to your customers, and it can still be delivered. That's why scanners flag it.

Why you shouldn't just change "none" to "reject"

DMARC doesn't only stop fakes. It also applies to your real email from any tool that isn't set up properly. If your website's contact form, invoicing tool or newsletter service sends as your domain without passing SPF or DKIM, a strict policy sends that mail to spam or blocks it. Many businesses have at least one of these and don't know it.

So the fix is in three steps: find every sender, make them pass, then tighten the policy.

How to fix it

1. Check what you have now

Run your domain through the free check. It shows your DMARC record, if any, plus SPF and DKIM. If there's no DMARC record, start with step 2. If there is one with p=none, skip to step 3.

2. Add a DMARC record that reports

At your DNS host, add a TXT record:

Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

The rua address receives daily reports from Gmail, Yahoo and others listing every server that sent mail as your domain, and whether it passed. Use a mailbox you can read, or a free DMARC report tool.

3. Make every real sender pass

Over a week or two, go through the reports. For each service that sends as you and fails, set it up: add it to your SPF record (only one SPF record per domain, and no more than 10 DNS lookups), and turn on DKIM for it in that service's settings. Typical ones are your email provider, your website or its contact form, invoicing and accounting tools, and newsletter or booking systems.

4. Move to quarantine, then reject

When the reports show only your real senders, and they all pass, change the record:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com

This clears the warning. Keep watching the reports for a few weeks. If nothing legitimate fails, move to p=reject for full protection.

Where to edit the record

Edit DMARC wherever your domain's DNS is hosted, which isn't always where you bought the domain. Your nameservers tell you where.

GoDaddy: Domain Portfolio → your domain → DNS → Add new record → TXT, name _dmarc. See our GoDaddy guide.
Cloudflare: your domain → DNS → Records → Add record → TXT, name _dmarc.
Hostinger: hPanel → Domains → your domain → DNS / Nameservers → add a TXT record named _dmarc.
cPanel hosting: Zone Editor → your domain → Add Record → TXT, name _dmarc. Newer cPanel also has an Email Deliverability page that shows SPF and DKIM status.
Google Workspace or Microsoft 365: the record still goes at your DNS host, not in Google's or Microsoft's admin. See our Google Workspace and Microsoft 365 guides.

Only ever have one _dmarc record. If one exists, edit it instead of adding a second.

Want it done without the risk?

We find every service sending as your domain, set up SPF and DKIM for each, add DMARC, and move you to an enforced policy without blocking your own mail. Real test emails to Gmail, Outlook and Yahoo, and a short report. $199, and if there's nothing to fix, you don't pay.

Email us your domain

Questions

What does DMARC policy not enabled mean?

It means your domain either has no DMARC record or has one set to p=none. With p=none, mailbox providers report on mail that fails authentication but still deliver it, so anyone can send email pretending to be your domain. Scanners flag it until the policy is p=quarantine or p=reject.

How do I fix DMARC policy not enabled?

Make sure every service that sends as your domain passes SPF or DKIM, then change the p= tag in your _dmarc TXT record from none to quarantine, and later to reject. If you have no DMARC record, add one at your DNS host first.

Is it safe to switch straight to p=reject?

Not unless you're sure every sender is set up. With p=reject, legitimate mail from a tool that isn't authenticated, such as an invoicing app or website form, will be rejected. Start with p=none and reports, fix what fails, then move to quarantine and finally reject.

Is DMARC p=none enough for Gmail and Yahoo?

For their bulk sender rules, a DMARC record with p=none meets the minimum. But it doesn't protect your domain from being spoofed, which is why security scanners and cyber insurance questionnaires flag it.