How to fix dmarc policy none on Squarespace

Steps for Squarespace

1. If your domain is managed by Squarespace: go to Squarespace Admin > Settings > Domains > click your domain > DNS Settings.
2. If your domain is external: log in to your registrar's DNS panel.
3. Locate the TXT record with Host _dmarc and click the edit/pencil icon.
4. Update the value to change p=none to p=quarantine and save.
5. If you use Squarespace Email Campaigns or a connected ESP, verify DKIM is enabled in that platform's settings and that its sending domain is aligned.
6. After verifying reports show no legitimate failures, edit the record again and set p=reject.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

What is dmarc policy none?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

See the complete Dmarc policy none guide for every platform and the full background.