How to fix dmarc policy none on Magento Open Source

Steps for Magento Open Source

1. Magento Open Source is self-hosted; DNS is at your registrar or hosting control panel (cPanel, Plesk, Cloudflare, etc.).
2. Navigate to DNS management and find the _dmarc TXT record.
3. Edit the value to set p=quarantine, save, and monitor DMARC reports.
4. In the Magento admin go to Stores > Configuration > Advanced > System > Mail Sending Settings to confirm the SMTP relay and From domain. Ensure the relay's SPF include and DKIM selector are present in your DNS.
5. After reports confirm only spoofed mail fails, edit the record to p=reject.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

What is dmarc policy none?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

See the complete Dmarc policy none guide for every platform and the full background.