Dmarc policy none
Moderate effortStrengthen your DMARC policy from p=none (monitor-only) to p=quarantine, then p=reject, so that emails fraudulently sent from your domain are blocked rather than silently allowed through.
What it is
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells the world's email providers what to do when they receive an email claiming to be from your domain. The policy tag (`p=`) controls the action: `none` means "do nothing — just watch," `quarantine` means "send suspicious mail to the spam folder," and `reject` means "refuse to deliver it at all." Right now your record is set to `p=none`, which is a read-only monitoring mode — it collects reports but never protects anyone. Moving to `p=quarantine` and eventually `p=reject` turns DMARC into an actual shield against email fraud.
Why it matters
With `p=none`, anyone in the world can send email that appears to come from your domain — your customers' inboxes, your suppliers, even your staff — and mail servers will deliver it without question. This is the primary technique used in phishing and business email compromise (BEC) attacks, where criminals impersonate your brand to steal money or credentials from your customers. Beyond security, Google and Yahoo now require a DMARC policy (at minimum `p=none` with reporting, but ideally stricter) for bulk senders, and staying in monitor-only mode signals poor email hygiene that can hurt your domain's sender reputation and deliverability. Moving to `p=reject` demonstrably reduces phishing abuse of your brand, protects customer trust, and is increasingly expected by enterprise buyers and payment processors performing vendor security assessments.
How to fix it
- Review at least 2–4 weeks of DMARC aggregate (rua) reports to identify every legitimate mail stream sending on behalf of your domain (e-commerce platform, marketing tools, helpdesk, shipping notifications, etc.).
- For each legitimate sending source not yet passing DMARC, configure SPF (add their sending IPs to your SPF record) and/or DKIM (enable DKIM signing in that tool and publish the DNS key they provide).
- Once your rua reports show that all legitimate mail is passing DMARC alignment (ideally 95%+ passing), change p=none to p=quarantine in your DMARC DNS TXT record. Keep rua reporting in place.
- Monitor rua reports for another 1–4 weeks at p=quarantine. Investigate any legitimate sources that are now landing in spam and fix their SPF/DKIM alignment.
- When legitimate mail is consistently passing and only unknown/unauthorised sources are being quarantined, change p=quarantine to p=reject. This is your fully enforced, production-hardened state.
- Optionally tighten further: set sp=reject to cover subdomains, ensure pct=100 (full enforcement), and keep rua reports active indefinitely for ongoing visibility.
Fix it on your platform
Pick your platform for the exact steps.
How to fix dmarc policy none on Shopify
- DMARC is a DNS record — it lives with your domain registrar or DNS host (e.g. GoDaddy, Namecheap, Cloudflare), not inside Shopify's admin.
- First, verify all Shopify-originated mail passes DMARC: in Shopify Admin → Settings → Notifications, ensure you have set up a custom sender domain and completed the SPF/DKIM verification Shopify requests.
- Then go to your DNS provider, find the TXT record for _dmarc.yourdomain.com, and edit the p= value from none to quarantine (then later reject).
- If you use third-party email apps (Klaviyo, Mailchimp, Omnisend, Gorgias, etc.), complete their DKIM/SPF setup steps inside each app before tightening the policy.
How to fix dmarc policy none on Shopify Plus
- Same DNS-level change as standard Shopify — DMARC lives at your DNS provider, not in Shopify Plus admin.
- Shopify Plus merchants frequently send from multiple subdomains or use Launchpad/Flows that trigger transactional email — audit all sending sources in your rua reports first.
- Verify custom sender domain SPF/DKIM under Settings → Notifications in each store, and under Settings → Domains for any Shopify-managed domain.
- Edit _dmarc.yourdomain.com TXT record at your DNS provider to advance the p= tag through quarantine to reject.
How to fix dmarc policy none on WooCommerce
- WooCommerce sends transactional email through WordPress (via PHP mail or an SMTP plugin). Confirm you are using an SMTP plugin such as WP Mail SMTP, FluentSMTP, or Postman SMTP and that DKIM signing is enabled in that plugin or your SMTP provider (e.g. SendGrid, Mailgun, Brevo).
- In WordPress Admin → Plugins, check your SMTP plugin settings and follow its guide to publish the DKIM DNS key your provider gives you.
- Add your SMTP provider's sending IPs/includes to your domain's SPF record at your DNS host.
- At your DNS provider, edit the TXT record for _dmarc.yourdomain.com — change p=none to p=quarantine, monitor rua reports, then advance to p=reject.
How to fix dmarc policy none on BigCommerce
- In BigCommerce Admin → Settings → Email, configure a custom sender domain and complete the SPF and DKIM DNS records BigCommerce instructs you to add.
- If you use a third-party ESP (Klaviyo, Mailchimp, etc.) via a BigCommerce app, complete that app's DKIM/SPF setup at your DNS provider as well.
- Go to your DNS provider and locate the _dmarc.yourdomain.com TXT record. Change p=none to p=quarantine.
- After monitoring rua reports and confirming all legitimate mail passes, change p=quarantine to p=reject.
How to fix dmarc policy none on Wix
- In Wix, go to the Dashboard → Settings → Domains (or Mailboxes if using Wix Email) and ensure the SPF and DKIM records Wix provides are published.
- If you use Wix Ascend or any connected marketing email tool, complete that tool's DKIM setup as well.
- DMARC itself is a separate TXT record. If your domain's DNS is managed by Wix, go to Dashboard → Settings → Domains → Manage DNS → Add Record. Add a TXT record: Name = _dmarc, Value = your DMARC string with p=quarantine (replacing p=none).
- If DNS is managed externally (e.g. GoDaddy), make the edit there instead. Then monitor rua reports and progress to p=reject.
How to fix dmarc policy none on Wix Studio
- Same DNS steps as Wix — Wix Studio sites share the same domain and DNS management interface.
- Go to the site's Dashboard → Settings → Domains → Manage DNS, locate the _dmarc TXT record, and update p=none to p=quarantine.
- Verify all client-site sending sources (email marketing integrations, transactional tools) have DKIM and SPF aligned before advancing to p=reject.
How to fix dmarc policy none on Squarespace
- Go to your Squarespace Dashboard → Settings → Domains. If DNS is hosted by Squarespace, click on your domain → DNS Settings → Custom Records.
- Find the existing _dmarc TXT record and edit the p= value from none to quarantine. If no DMARC record exists, add a TXT record with Host = _dmarc and the updated value.
- If Squarespace Email Campaigns is in use, ensure the sending domain is verified (Squarespace guides you through SPF/DKIM in Settings → Email Campaigns → Sender Email).
- After monitoring rua reports for a few weeks, return and change p=quarantine to p=reject.
How to fix dmarc policy none on Webflow
- Webflow does not send transactional email natively; you likely use a form submission handler, Memberstack, or an ESP integration. Confirm which services send mail on your domain's behalf from your rua reports.
- In Webflow → Project Settings → Hosting → Custom Domain, Webflow shows any DNS records it requires. Ensure those are published.
- Log in to your DNS provider (Webflow hosts DNS for Webflow-managed domains under Project Settings → Hosting → DNS), find the _dmarc TXT record, and change p=none to p=quarantine.
- Monitor reports, fix any failing senders, then advance to p=reject.
How to fix dmarc policy none on Adobe Commerce (Magento)
- Adobe Commerce sends transactional email via a configured SMTP server. Go to Admin → Stores → Configuration → Advanced → System → Mail Sending Settings and confirm you are routing through an authenticated SMTP relay (SendGrid, Mailgun, Amazon SES, etc.).
- Complete DKIM setup with your SMTP relay provider and publish the DKIM public key DNS record they provide, plus add their include to your SPF record, at your DNS host.
- At your DNS provider, edit the _dmarc.yourdomain.com TXT record — change p=none to p=quarantine.
- Review rua reports (tools like EasyDMARC, Dmarcian, or Postmark's free report reader help), fix any misaligned senders, then change p=quarantine to p=reject.
How to fix dmarc policy none on Magento Open Source
- Same steps as Adobe Commerce: configure SMTP relay under Admin → Stores → Configuration → Advanced → System → Mail Sending Settings.
- Publish the DKIM key from your relay provider and update SPF at your DNS host.
- Edit the _dmarc TXT record at your DNS provider to change p=none to p=quarantine, then p=reject after confirming alignment.
How to fix dmarc policy none on PrestaShop
- In PrestaShop Admin → Advanced Parameters → Email, set up an SMTP server with an authenticated relay (Mailgun, SendGrid, Brevo, etc.).
- Follow your relay provider's DKIM and SPF setup guide and publish the required DNS records at your DNS host.
- Edit the _dmarc TXT record at your DNS provider: change p=none to p=quarantine, monitor rua reports, then advance to p=reject.
How to fix dmarc policy none on WordPress.org
- Install a dedicated SMTP plugin (WP Mail SMTP is most common) from Plugins → Add New.
- Connect it to an authenticated SMTP relay (Mailgun, SendGrid, Brevo, Amazon SES, etc.) and complete that relay's DKIM key publication and SPF record update at your DNS host.
- At your DNS provider, edit _dmarc.yourdomain.com TXT record from p=none to p=quarantine, then p=reject after confirming all mail passes.
How to fix dmarc policy none on Ghost
- Ghost (Ghost Pro or self-hosted) sends newsletter and transactional mail through Mailgun by default. In Ghost Admin → Settings → Email, complete the Mailgun custom domain setup (Ghost walks you through adding the required DNS records).
- Those DNS records include DKIM — once published, Mailgun-sent mail will be DKIM-signed and aligned.
- At your DNS provider, update the _dmarc TXT record from p=none to p=quarantine, monitor reports, then advance to p=reject.
How to fix dmarc policy none on Headless / Custom (I build in code)
- Identify every service that sends email using your domain: transactional mail API (SendGrid, Postmark, Mailgun, SES), marketing ESP, helpdesk, CRM, etc.
- For each, complete their DKIM key publication (add the TXT record they provide to your DNS) and add their sending infrastructure to your SPF record.
- Parse your rua report data (use a DMARC report parser or a SaaS tool) until >95% of mail is aligned.
- Update your _dmarc TXT record via your DNS provider API or console: change p=none → p=quarantine → p=reject with monitoring intervals between each step.
Does your site have this issue?
Run a free SEOLZ scan to find dmarc policy none — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Dmarc policy none?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells the world's email providers what to do when they receive an email claiming to be from your domain. The policy tag (`p=`) controls the action: `none` means "do nothing — just watch," `quarantine` means "send suspicious mail to the spam folder," and `reject` means "refuse to deliver it at all." Right now your record is set to `p=none`, which is a read-only monitoring mode — it collects reports but never protects anyone. Moving to `p=quarantine` and eventually `p=reject` turns DMARC into an actual shield against email fraud.
Why does dmarc policy none matter?
With `p=none`, anyone in the world can send email that appears to come from your domain — your customers' inboxes, your suppliers, even your staff — and mail servers will deliver it without question. This is the primary technique used in phishing and business email compromise (BEC) attacks, where criminals impersonate your brand to steal money or credentials from your customers. Beyond security, Google and Yahoo now require a DMARC policy (at minimum `p=none` with reporting, but ideally stricter) for bulk senders, and staying in monitor-only mode signals poor email hygiene that can hurt your domain's sender reputation and deliverability. Moving to `p=reject` demonstrably reduces phishing abuse of your brand, protects customer trust, and is increasingly expected by enterprise buyers and payment processors performing vendor security assessments.
How do I fix dmarc policy none?
Strengthen your DMARC policy from p=none (monitor-only) to p=quarantine, then p=reject, so that emails fraudulently sent from your domain are blocked rather than silently allowed through.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP