DMARC Policy Not Enabled: How to Fix It

What "DMARC policy not enabled" means

If a checker warns that your DMARC quarantine/reject policy is not enabled, it means your domain publishes a DMARC record set to p=none. That policy only monitors — it collects reports but takes no action on mail that fails authentication, so it offers no protection against spoofing and does nothing for your deliverability.

The fix is to move your policy to p=quarantine or p=reject — but only after confirming that every legitimate sender passes SPF or DKIM. Enforce too early and you'll block your own mail. This guide walks the safe path, whether you're on Cloudflare, GoDaddy, or any other provider. You can check your current record any time with the Email Security Score or the DMARC lookup tool.

How to fix it, step by step

Step 1: Check your existing DMARC record

Verify your current configuration with a DNS checker. A DMARC record typically looks like this:

v=DMARC1; p=none; rua=mailto:reports@example.com;

Use the DNS lookup tool to pull your live record, then read the p= tag to see your current policy.

Step 2: Understand the three policies

• None — monitors email activity without taking action. Useful for initial analysis, but provides no security.
• Quarantine — directs suspicious mail to the recipient's spam folder.
• Reject — blocks unauthorized mail from delivery entirely.

For a deeper comparison, see reject vs quarantine.

Step 3: Start with monitoring

Begin with a p=none policy to gather data on your email streams and check SPF and DKIM alignment. This generates XML aggregate (RUA) reports like this:

You can read these DMARC reports manually in your inbox, or use a monitoring tool to parse them. Let reports collect for at least one full sending cycle — long enough to capture every third-party service (marketing and transactional) that sends as your domain — so you can fully assess SPF and DKIM alignment.

Step 4: Align SPF and DKIM

Read your aggregate reports to identify which authorized senders pass SPF and DKIM and which fail. For each failing sender, update your SPF record or DKIM keys so it aligns with your From: domain. Only enforce a stronger policy once every legitimate sender passes.

Step 5: Move to quarantine or reject

Once SPF and DKIM are aligned and verified, upgrade the policy. Many domains raise enforcement gradually — quarantine first, often with a pct= sample, then reject:

• Quarantine: v=DMARC1; p=quarantine; rua=mailto:reports@example.com;
• Reject: v=DMARC1; p=reject; rua=mailto:reports@example.com;

Step 6: Monitor and adjust

Keep reviewing DMARC reports to confirm the policy protects your domain without catching legitimate mail. This is ongoing, not a one-time change.

Fixing it on Cloudflare

1. Log in to Cloudflare and open the DNS section for your domain.
2. Click Add record.
3. Set Type to TXT, Name to _dmarc, and paste your record as the value — for example v=DMARC1; p=none; rua=mailto:reports@example.com;
4. Save the record.

Note: only raise the policy to quarantine or reject once monitoring confirms SPF and DKIM alignment is correct. For the full walkthrough, see how to add a DMARC record in Cloudflare.

Fixing it on GoDaddy

1. Log in to GoDaddy and open DNS Management for your domain.
2. Add a new record: set Type to TXT and Name to _dmarc.
3. Enter a DMARC value starting at p=none — for example v=DMARC1; p=none; rua=mailto:reports@example.com;
4. Save the record and allow up to 48 hours for propagation.
5. Monitor the reports, align your senders, then tighten the policy.

Best practices

Enabling an enforcement policy isn't a one-time fix. Keep your domain protected by:

• Reviewing DMARC reports regularly.
• Keeping SPF and DKIM aligned as you add or remove senders.
• Raising the policy in stages (none → quarantine → reject) rather than jumping straight to reject.

For a from-scratch build, see how to create a DMARC record. To evaluate your domain quickly, use the Email Security Score.

Frequently asked questions

What does "DMARC quarantine/reject policy not enabled" mean?

It means your DMARC record is set to p=none, so it monitors but never acts on mail that fails authentication. Your domain still collects reports, but it isn't protected against spoofing or phishing — the warning is prompting you to move to quarantine or reject.

What's the difference between quarantine and reject?

Quarantine delivers failing mail to the spam folder, so a wrongly-failed message is still recoverable. Reject refuses it entirely, so it never arrives. Reject is stronger protection; quarantine is the safer intermediate step while you confirm nothing legitimate is failing.

How do I check my current DMARC policy?

Query your record with a DMARC checker or the command line (dig TXT _dmarc.yourdomain.com) and read the p= tag. If it shows none, monitoring is on but enforcement isn't. The DMARC lookup tool shows the same result in the browser.

What should I do before switching from p=none?

Let aggregate reports run for at least one full sending cycle, then confirm every legitimate sender passes SPF or DKIM and aligns with your From: domain. Skipping this is the most common way domains block their own mail when they enforce.

Why is p=none not enough on its own?

p=none gives you visibility but zero enforcement — attackers can still spoof your domain and receivers won't reject the forgery. It's a starting point for gathering data, not a finished configuration. The protection only begins at quarantine or reject.