How to fix dmarc policy none on Squarespace
Strengthen your DMARC policy from p=none (monitor-only) to p=quarantine, then p=reject, so that emails fraudulently sent from your domain are blocked rather than silently allowed through.
Steps for Squarespace
- Go to your Squarespace Dashboard → Settings → Domains. If DNS is hosted by Squarespace, click on your domain → DNS Settings → Custom Records.
- Find the existing _dmarc TXT record and edit the p= value from none to quarantine. If no DMARC record exists, add a TXT record with Host = _dmarc and the updated value.
- If Squarespace Email Campaigns is in use, ensure the sending domain is verified (Squarespace guides you through SPF/DKIM in Settings → Email Campaigns → Sender Email).
- After monitoring rua reports for a few weeks, return and change p=quarantine to p=reject.
What is dmarc policy none?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells the world's email providers what to do when they receive an email claiming to be from your domain. The policy tag (`p=`) controls the action: `none` means "do nothing — just watch," `quarantine` means "send suspicious mail to the spam folder," and `reject` means "refuse to deliver it at all." Right now your record is set to `p=none`, which is a read-only monitoring mode — it collects reports but never protects anyone. Moving to `p=quarantine` and eventually `p=reject` turns DMARC into an actual shield against email fraud.
With `p=none`, anyone in the world can send email that appears to come from your domain — your customers' inboxes, your suppliers, even your staff — and mail servers will deliver it without question. This is the primary technique used in phishing and business email compromise (BEC) attacks, where criminals impersonate your brand to steal money or credentials from your customers. Beyond security, Google and Yahoo now require a DMARC policy (at minimum `p=none` with reporting, but ideally stricter) for bulk senders, and staying in monitor-only mode signals poor email hygiene that can hurt your domain's sender reputation and deliverability. Moving to `p=reject` demonstrably reduces phishing abuse of your brand, protects customer trust, and is increasingly expected by enterprise buyers and payment processors performing vendor security assessments.
See the complete Dmarc policy none guide for every platform and the full background.
Not sure if your Squarespace store has this?
Run a free SEOLZ scan — we’ll find dmarc policy none and every other issue across your whole site.
Scan my site free