DMARC policy not enabled: what it means and how to fix it safely

"DMARC policy not enabled" is the warning an email checker shows when a domain has no DMARC record, or has one set to p=none. Either way, nothing from the domain tells receiving mail servers to block email faked in its name.

It is common. When we checked 749 South Florida law firms and real estate offices in October 2026, about 4 in 5 were not blocking fake email sent in their name. This guide covers what the warning means, how SPF, DKIM and DMARC fit together, and how to reach p=reject without blocking your own mail. To see where your domain stands first, run our free email security check.

What does "DMARC policy not enabled" mean?

It means one of two things.

1. No DMARC record. Nothing is published at _dmarc.example.com. The current DMARC standard, RFC 9989, says that when no record is found, receiving servers "MUST NOT apply the DMARC mechanism" to the message. Each server falls back on its own filters.
2. A record set to p=none. The standard defines none in one line: "The Domain Owner offers no expression of preference." You get reports if you ask for them, but each receiver's own filters decide what happens to fakes.

CISA's guidance for federal email is blunt: p=none "doesn't actually delay or stop unauthenticated mail from being delivered", and it should be a temporary state on the way to enforcement. For a firm that moves client money, that gap is the one a fake wiring email uses.

Both states are common. Of the 519 South Florida law firms in our scan, 412 were in one of them: 263 had no DMARC record at all, and the rest were set to monitor only. That is why 79% of those firms can have their email spoofed. Real estate offices were worse, at 83% of the 230 we checked.

What do SPF, DKIM and DMARC each do?

They are three DNS records that work as a set. SPF and DKIM prove where a message came from. DMARC checks that the proof matches the address the reader sees, and says what to do when it doesn't. NIST's email guide, SP 800-177 Rev. 1, recommends all three and says it "will also be useful for small or medium sized organizations."

What is an SPF record?

An SPF record is a DNS TXT record that lists the servers allowed to send mail for a domain. It is defined in RFC 7208. An example:

example.com.  IN  TXT  "v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all"

• It starts with v=spf1, and a domain may publish only one. Two or more is a permanent error.
• Each include, a, mx, ptr, exists and redirect term costs a DNS lookup, and more than 10 is a permanent error. Every include counts, and so do the lookups inside it.
• The ending sets the default for everything else: -all means fail, ~all softfail, ?all neutral.
• SPF checks the envelope sender (the bounce address used in the mail transaction), not the From address a reader sees.

What is DKIM?

DKIM, defined in RFC 6376, adds a signature to each message. The signature names a domain (d=) and a selector (s=), and the receiver looks up the public key at selector._domainkey.domain:

s1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=<your public key>"

RFC 8301 requires RSA keys of at least 1024 bits, recommends 2048, and bars SHA-1 for signing. Your email provider and each sending service generate the key pair; you publish the public half. Selectors can't be listed from outside, so checkers try common names. Ours does the same, so a key under an unusual selector can show as missing even when DKIM works.

What does DMARC add?

DMARC adds alignment: the domain in the visible From address must match a domain that passed SPF or DKIM. Relaxed alignment, the default, accepts the same organizational domain, so news.example.com aligns with example.com. Strict alignment needs an exact match. The record lives at _dmarc:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The p tag is the policy: none, quarantine or reject. The rua tag says where receivers send aggregate reports, usually daily, in the format of RFC 9990. Leave it out and receivers send no aggregate reports at all.

Why does DMARC fail when SPF passes?

A message passes DMARC when SPF or DKIM passes and that domain aligns with the From address. It fails when nothing aligns. So a DMARC fail next to an SPF pass usually means SPF passed for someone else's domain. Common causes:

• A sending service uses its own bounce domain. Your billing or newsletter system sends as you@example.com, but SPF passes for the service's domain. Fix: have it sign with DKIM for your domain, or set a custom bounce domain under yours.
• Forwarding. A forwarded message arrives from the forwarder's server, so SPF fails. DKIM usually survives, which is why the standard says domains at p=reject must not rely on SPF alone and must sign with DKIM.
• Mailing lists. The standard notes that list mail with an unmodified From line is "frequently rejected" under p=reject.
• Too many SPF lookups, which turns SPF into a permanent error.

Aggregate reports are how you find these. For each source sending as your domain, they show the message count, the SPF and DKIM results and the domains checked, whether they aligned, and the policy the receiver applied.

How do you fix it without blocking your own email?

Go in stages, with reports on the whole time.

Stage	Record	What receivers do	Move on when
1. Monitor	p=none with rua	Nothing changes; reports arrive	Every legitimate sender passes and aligns
2. Quarantine	p=quarantine	Treat failing mail as suspicious, usually the spam folder	Reports stay clean for a similar period
3. Reject	p=reject	Refuse failing mail	Keep reading reports

The steps:

1. List every service that sends as your domain: your email provider, plus billing, CRM, newsletter, e-signature and scheduling tools.
2. Fix SPF so one record covers them, within 10 lookups.
3. Turn on DKIM for your domain in each one.
4. Publish p=none with rua and read the reports. The standard says they are formatted to be machine-parsed, so use a tool or service that reads them.
5. Fix each legitimate source that fails. RFC 9989 says these gaps must be addressed before you publish an enforcing policy.
6. Move to p=quarantine, then p=reject, holding each stage until the reports are clean. The standard adds a caution: domains whose users post to Internet mailing lists should not publish p=reject. Those that do should first run p=none for at least a month and p=quarantine for as long, compare results, and warn users that list posts may be hindered.

At the end, the record looks like this. The p policy also covers subdomains unless you set sp or np.

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

How long? The standard says it may take many months of reports before a busy domain is sure all its mail authenticates. Fewer senders means less to check. Under CISA's Binding Operational Directive 18-01, federal executive branch departments had one year to reach p=reject on all their second-level domains.

Domains that never send mail are simpler. CISA's guidance for them: start at p=none to confirm from the reports that nothing legitimate sends, then set p=reject and publish an SPF record of v=spf1 -all.

What changed in the 2026 DMARC standard?

In May 2026 the IETF published RFC 9989 on the standards track. It replaces RFC 7489, the informational 2015 version that older guides describe. Changes that matter for setup:

• pct is gone. Older guides ramp with pct=10, then pct=50. The new standard dropped it because it was usually not applied accurately except at 0 or 100. A new t=y test flag asks receivers to apply one level below your stated policy, so p=reject; t=y asks for quarantine handling while you test. A pct tag left in an old record is a leftover from the 2015 version.
• np is new. It sets a policy for subdomains that don't exist, so made-up names under your domain are covered.
• Policy lookup changed. When a subdomain has no record of its own, receivers find the right one with a "DNS tree walk" instead of a public suffix list.
• Reports have their own documents: RFC 9990 for aggregate reports and RFC 9991 for failure reports.

The core tags keep their meaning: v, p, sp, rua, ruf, adkim, aspf and fo.

Do Gmail and Yahoo require DMARC?

For bulk senders, yes, but not enforcement. Since February 2024, both have asked senders of large volumes (for Gmail, more than 5,000 messages a day to Gmail accounts) to set up SPF and DKIM, publish a DMARC record, align the From domain with SPF or DKIM, offer one-click unsubscribe on marketing mail and keep spam complaints under 0.3%. Both accept p=none. So a domain can meet their rules and still show "DMARC policy not enabled". Each provider's sender guidelines have the current details.

How Raileon helps

Our free email security check reads your SPF, DKIM and DMARC records from public DNS in a few seconds and explains the result. No sign-up. On a free 20-minute call with the founder, we list your senders, write the records with whoever runs your email, and plan the move to p=reject. For systems we build and run, monthly care (hosting, monitoring, fixes and updates) starts from $1,999 a month.

FAQ

What does "DMARC policy not enabled" mean?

It means your domain has no DMARC record, or has one set to p=none. Either way, nothing from your domain tells receiving mail servers to quarantine or reject email that fakes your address.

Is p=none safe to leave in place?

It is safe for your own mail, but it does not ask receivers to stop fakes. Treat it as the first stage: read the reports, fix your legitimate senders, then move to p=quarantine and p=reject.

What is an SPF record?

An SPF record is a DNS TXT record, starting with v=spf1, that lists the servers allowed to send email for your domain. A domain can publish only one, and it must stay within 10 DNS lookups.

How long does it take to reach p=reject?

It depends on how many services send as your domain. Plan at least a month at p=none and a similar period at p=quarantine, reading reports throughout. Large, busy domains can take many months.

Check your domain first

Run the free email security check to see what your domain publishes today. Then, on a free 20-minute call, we'll read the results with you and plan the move to p=reject.

Book a free 20-minute call