# DMARC Policy Not Enabled: How to Fix It

> Fix the 'DMARC policy not enabled' warning: move from p=none to quarantine or reject safely, with monitoring to avoid losing legitimate mail.

![DMARC policy enforcement overview](/images/cms/67e20da77ce57d00e13af82f_frame-49796-4.png)

## What "DMARC policy not enabled" means

If a checker warns that your DMARC quarantine/reject policy is not enabled, it means your domain publishes a [DMARC](/learning/what-is-dmarc) record set to `p=none`. That policy only *monitors* — it collects reports but takes no action on mail that fails authentication, so it offers no protection against spoofing and does nothing for your deliverability.

The fix is to move your policy to `p=quarantine` or `p=reject` — but only after confirming that every legitimate sender passes [SPF](/learning/what-is-spf) or [DKIM](/learning/what-is-dkim). Enforce too early and you'll block your own mail. This guide walks the safe path, whether you're on Cloudflare, GoDaddy, or any other provider. You can check your current record any time with the [Email Security Score](/tools/email-security-score) or the [DMARC lookup tool](/tools/dmarc). Those read the published record; to confirm a specific stream actually passes and aligns before you enforce, run the free [email deliverability test](/tools/email-deliverability-test) on a message you send through it.

![Moving a DMARC policy from monitoring to enforcement](/images/figures/dmarc-policy-progression.webp)

## How to fix it, step by step

### Step 1: Check your existing DMARC record

Verify your current configuration with a DNS checker. A [DMARC record](/tools/dmarc) typically looks like this:

`v=DMARC1; p=none; rua=mailto:reports@example.com;`

Use the [DNS lookup tool](/tools/dns-lookup) to pull your live record, then read the `p=` tag to see your current policy.

### Step 2: Understand the three policies

![The three DMARC policies: none, quarantine, and reject](/images/cms/67e1d19e2eb684c917a12588_palisade---dmarc-policies-1-1.png)

- **None** — monitors email activity without taking action. Useful for initial analysis, but provides no security.
- **Quarantine** — directs suspicious mail to the recipient's spam folder.
- **Reject** — blocks unauthorized mail from delivery entirely.

For a deeper comparison, see [reject vs quarantine](/resources-post/dmarc-reject-vs-quarantine-whats-the-difference).

### Step 3: Start with monitoring

Begin with a `p=none` policy to gather data on your email streams and check SPF and DKIM alignment. This generates XML aggregate ([RUA](/learning/what-is-a-rua)) reports like this:

![Example DMARC XML aggregate report](/images/cms/67e1d1dee7abda286bde67ba_dmarc-xml-report-1-1.png)

You can read these [DMARC reports](/resources-post/how-to-understand-dmarc-reports) manually in your inbox, or use a monitoring tool to parse them. Let reports collect for at least one full sending cycle — long enough to capture every third-party service (marketing and transactional) that sends as your domain — so you can fully assess SPF and DKIM alignment.

### Step 4: Align SPF and DKIM

![Palisade DMARC Agent analyzing sender alignment](/images/cms/67e1d296fbf65efaf2b4ffc7_palisade-ai-dmarc-agent.gif)

Read your aggregate reports to identify which authorized senders pass SPF and DKIM and which fail. For each failing sender, update your [SPF record](/learning/what-is-spf) or [DKIM](/learning/what-is-dkim) keys so it aligns with your `From:` domain. Only enforce a stronger policy once every legitimate sender passes.

### Step 5: Move to quarantine or reject

Once SPF and DKIM are aligned and verified, upgrade the policy. Many domains raise enforcement gradually — quarantine first, often with a `pct=` sample, then reject:

![Updating a DMARC record to an enforcement policy](/images/cms/67e1d3082eb684c917a272b0_palisade-smart-dmarc-large.gif)

- **Quarantine:** `v=DMARC1; p=quarantine; rua=mailto:reports@example.com;`
- **Reject:** `v=DMARC1; p=reject; rua=mailto:reports@example.com;`

### Step 6: Monitor and adjust

Keep reviewing DMARC reports to confirm the policy protects your domain without catching legitimate mail. This is ongoing, not a one-time change.

## Fixing it on Cloudflare

![Adding a DMARC policy record in the Cloudflare dashboard](/images/cms/67e1d43056eb9260b5507d53_palisade---cloud-flare-dmarc-policies.png)

1. Log in to Cloudflare and open the **DNS** section for your domain.
2. Click **Add record**.
3. Set **Type** to `TXT`, **Name** to `_dmarc`, and paste your record as the value — for example `v=DMARC1; p=none; rua=mailto:reports@example.com;`
4. Save the record.

**Note:** only raise the policy to quarantine or reject once monitoring confirms SPF and DKIM alignment is correct. For the full walkthrough, see [how to add a DMARC record in Cloudflare](/learning/how-can-i-add-a-dmarc-record-in-cloudflare).

## Fixing it on GoDaddy

1. Log in to GoDaddy and open **DNS Management** for your domain.
2. Add a new record: set **Type** to `TXT` and **Name** to `_dmarc`.
3. Enter a DMARC value starting at `p=none` — for example `v=DMARC1; p=none; rua=mailto:reports@example.com;`
4. Save the record and allow up to 48 hours for propagation.
5. Monitor the reports, align your senders, then tighten the policy.

## Best practices

Enabling an enforcement policy isn't a one-time fix. Keep your domain protected by:

- Reviewing DMARC reports regularly.
- Keeping SPF and DKIM aligned as you add or remove senders.
- Raising the policy in stages (`none → quarantine → reject`) rather than jumping straight to reject.

For a from-scratch build, see [how to create a DMARC record](/resources-post/how-to-create-dmarc-record). To evaluate your domain quickly, use the [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### What does "DMARC quarantine/reject policy not enabled" mean?

It means your DMARC record is set to `p=none`, so it monitors but never acts on mail that fails authentication. Your domain still collects reports, but it isn't protected against spoofing or [phishing](/resources-post/the-ultimate-guide-to-preventing-phishing-attacks-expert-tips-and-strategies) — the warning is prompting you to move to quarantine or reject.

### What's the difference between quarantine and reject?

Quarantine delivers failing mail to the spam folder, so a wrongly-failed message is still recoverable. Reject refuses it entirely, so it never arrives. Reject is stronger protection; quarantine is the safer intermediate step while you confirm nothing legitimate is failing.

### How do I check my current DMARC policy?

Query your record with a DMARC checker or the command line (`dig TXT _dmarc.yourdomain.com`) and read the `p=` tag. If it shows `none`, monitoring is on but enforcement isn't. The [DMARC lookup tool](/tools/dmarc) shows the same result in the browser.

### What should I do before switching from p=none?

Let aggregate reports run for at least one full sending cycle, then confirm every legitimate sender passes SPF or DKIM and aligns with your `From:` domain. Skipping this is the most common way domains block their own mail when they enforce.

### Why is p=none not enough on its own?

`p=none` gives you visibility but zero enforcement — attackers can still spoof your domain and receivers won't reject the forgery. It's a starting point for gathering data, not a finished configuration. The protection only begins at quarantine or reject.