How to fix "DMARC policy not enabled"

If your CyberVigil report flagged "DMARC policy not enabled," the fix is one DNS record and about 15 minutes. It's one of the most common findings we see.

Start by checking your domain below. It shows exactly what's published today, so you'll know which part of this guide applies to you.

What does "DMARC policy not enabled" mean?

DMARC is the setting that tells Gmail, Outlook and other providers what to do with email that claims to be from your domain but fails authentication. We show this warning when your domain is in one of these states:

• There's no DMARC record, so providers have no instructions at all for suspicious mail using your name.
• The record is set to monitoring only (p=none). You may be getting reports, but fake emails aren't blocked yet.
• There's more than one DMARC record. Providers can't tell which one to follow, so they ignore all of them.
• The policy is missing or invalid. The record exists, but a typo means providers can't use it.

The fix is the same in every case: end up with exactly one valid record, then move it toward enforcement.

Why does a missing DMARC policy matter?

Without an enforced DMARC policy, it's easier for scammers to send emails that look like they come from yourbusiness.com. Those emails might ask a customer to pay a fake invoice or a vendor to update your bank details. This is a common setup for business email compromise.

DMARC also helps your real email. Google tells senders to set up SPF or DKIM, and bulk senders need SPF, DKIM and DMARC. A domain with all three looks more trustworthy to spam filters.

What DMARC record should I add?

If you don't have a record yet, start with this one:

Here's what each part does:

• v=DMARC1 marks this as a DMARC record. It must come first.
• p=none is monitoring mode. Providers report on failures but don't change delivery.
• rua=mailto:... is where providers send aggregate reports, usually once a day.

If you already have a record set to p=none and your reports look clean, skip ahead to moving to quarantine.

How do I fix "DMARC policy not enabled"?

Step 1: Check your current DMARC record

Use the checker at the top of this page. Note whether you have no record, one record, or several, and what the p= value is.

Step 2: Make sure SPF and DKIM are working

DMARC only passes when SPF or DKIM passes for your real email. Check that you have exactly one SPF record with our SPF checker, and confirm DKIM is turned on in your email provider. Google recommends letting SPF and DKIM run for 48 hours before adding DMARC.

Step 3: Add the DMARC record at your DNS host

Your DNS host is usually where you bought your domain. Choose your provider below. Google Workspace and Microsoft 365 don't host DMARC themselves, so their tabs cover the email-side settings.

Not sure who hosts your DNS? Look up your domain's nameservers. If they point to Cloudflare, add the record in Cloudflare even if you bought the domain elsewhere.

Step 4: Wait, then verify the record

Most DNS hosts publish changes within an hour, though some take up to 48 hours. Re-run the checker. You should see one record with your policy and reporting address.

Step 5: Move from p=none to quarantine, then reject

p=none only monitors. The next section explains how to tighten it safely.

Check the rest of your email and website setup

Run a free scan to see your SPF, DKIM, certificate and security headers in one plain-English report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How do I read DMARC reports?

Aggregate reports arrive as email attachments, usually compressed XML files. They aren't meant to be read by hand. Each one comes from a provider like Google or Microsoft and lists the servers that sent email using your domain, how many messages each sent, and whether they passed SPF, DKIM and DMARC.

You're looking for two things:

• Your real services should pass. Look for your email provider, newsletter tool and invoicing software showing a DMARC pass.
• Unknown senders should fail. Servers you don't recognize that fail every check are usually spoofing attempts, and that's the mail quarantine will catch.

A free or paid DMARC report viewer turns the files into a readable summary. If a legitimate service is failing, check its help docs for the SPF include or DKIM setup it needs.

How do I move from p=none to quarantine or reject?

Before you tighten the policy, use your reports to make sure every legitimate sender passes: your email provider, newsletter tool, invoicing software, website contact forms and CRM.

1. Monitor at p=none for two to four weeks. Fix any legitimate sender that fails by adding it to SPF or turning on DKIM in that service.
2. Change to p=quarantine by editing your existing record to v=DMARC1; p=quarantine; rua=mailto:dmarc@yourbusiness.com. Failing mail now goes to spam.
3. Watch for another few weeks, and ask your team whether any expected emails went missing.
4. Consider p=reject, which refuses failing mail outright. RFC 9989 suggests extra care here if your team posts to mailing lists, because some lists alter messages in ways that fail DMARC.

Microsoft recommends the same gradual approach. Older guides use pct= to apply a policy to a share of messages. The current standard retires that tag, so step the policy itself instead.

How do I check that the fix worked?

• Re-run the DMARC checker. It should show one record with the policy you set.
• If you're comfortable in a terminal, nslookup -type=TXT _dmarc.yourbusiness.com shows what the world sees.
• Send a test email to a Gmail address, open it, and choose Show original. Look for dmarc=pass.
• Reports should start arriving at your rua address within a day or two.

If the checker can't find your record, the Name field is the usual cause. Some hosts add your domain automatically, so typing _dmarc.yourbusiness.com can create _dmarc.yourbusiness.com.yourbusiness.com. Enter just _dmarc.

What should you do next?

• Check your domain with the free DMARC checker and fix any duplicate records.
• If your DNS is at GoDaddy, follow our GoDaddy DMARC guide for the exact click path.
• Learn how the pieces fit together in SPF, DKIM and DMARC explained.
• Set a reminder for two to four weeks from today to review your reports and move to p=quarantine.