How to fix dmarc policy none on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce is self-hosted or cloud-hosted; DNS is controlled at your registrar, hosting provider, or cloud DNS service (e.g., AWS Route 53, Cloudflare).
2. Log in to your DNS management interface and locate the _dmarc TXT record for your domain.
3. Edit the record: change p=none to p=quarantine. Save and allow up to 48 hours for propagation.
4. Adobe Commerce sends transactional emails via your configured SMTP (set in Stores > Configuration > Advanced > System > Mail Sending Settings). Confirm the sending domain matches your From address domain, and that SPF and DKIM are configured at your SMTP relay provider (SendGrid, Mailgun, etc.).
5. Review DMARC aggregate reports to confirm alignment, then update the _dmarc record to p=reject.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

What is dmarc policy none?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

See the complete Dmarc policy none guide for every platform and the full background.