Fix guide
Your DMARC record is set to p=none, so it reports but protects nothing. Here is how to move to quarantine and reject without blocking your own email.
Checkers show “DMARC policy not enabled” when your DMARC record is set to p=none. The record exists and works, but it only collects reports. It tells Gmail, Yahoo and Outlook to take no action on email that fails, so anyone can still send email pretending to be you.
It isn’t an error. p=none meets the minimum Gmail, Yahoo and Microsoft ask bulk senders for. It is simply the first step, not the finish line.
Make sure reports are switched on. Your record needs rua=mailto: followed by an address you can read. Without reports you can’t tell when it’s safe to tighten.
Read two to four weeks of reports. List every service sending as you: your inbox provider, newsletter tool, CRM, helpdesk, invoicing.
Fix any of your own senders that fail. Each one needs SPF or DKIM passing for your domain. Check with the SPF checker and DKIM checker.
Move to quarantine. Change p=none to p=quarantine. To go gently, add pct=25 first so only a quarter of failing mail is affected.
Move to reject. When reports stay clean for a few weeks at quarantine, change it to p=reject. Fake mail is then refused outright, and your domain qualifies for BIMI, your logo in the inbox.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
Check your policy
Look up your record to see your current policy in plain English, then build the next one.
Sponsored
EasyDMARC
Reading DMARC reports by hand is painful. EasyDMARC turns them into a dashboard and shows exactly which senders fail.
