How to fix dmarc policy none on Wix

Steps for Wix

1. If your domain is registered through Wix: go to Wix Admin Dashboard > Domains > select your domain > Manage DNS Records.
2. If your domain is registered externally and pointed to Wix: log in to your external registrar and open DNS management.
3. Find the TXT record with the Host value _dmarc.
4. Click Edit and change p=none to p=quarantine in the Value field. Save the record.
5. Wix sends email via its own mailer; if you use Wix Stores transactional emails or a third-party email marketing app, confirm those services appear in your SPF record.
6. After a clean monitoring period, return to the same record and update to p=reject.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

What is dmarc policy none?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

See the complete Dmarc policy none guide for every platform and the full background.