How to fix dmarc policy none on Webflow

Steps for Webflow

1. Webflow does not host DNS unless you purchased your domain through Webflow. If your domain was purchased via Webflow, go to Webflow Dashboard > Project Settings > Hosting > Custom Domain > DNS Settings (or manage via the Webflow DNS panel).
2. If your domain is at an external registrar, log in there and go to DNS management.
3. Find the TXT record with Name/Host _dmarc and edit it.
4. Change p=none to p=quarantine, save, and propagate.
5. Webflow itself does not send email on your behalf; ensure any connected tools (Mailchimp, Klaviyo form integrations, etc.) are in your SPF and have DKIM set up.
6. After a clean monitoring window, return and change p=quarantine to p=reject.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

What is dmarc policy none?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

See the complete Dmarc policy none guide for every platform and the full background.