How to fix missing dmarc on Squarespace

Steps for Squarespace

1. If your domain is registered with Squarespace: go to Squarespace Dashboard → Domains → click your domain → DNS Settings → Add Record → Type: TXT, Host: _dmarc, Data: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL: 3600 → Save.
2. If your domain DNS is managed outside Squarespace (e.g. at GoDaddy), add the TXT record there.
3. Squarespace Commerce sends transactional email (order confirmations etc.) via Squarespace's own servers, so SPF/DKIM for that path is managed by Squarespace. If you use Google Workspace or another external mail provider for your From: address, add that provider's DKIM record first.
4. After publishing the DMARC record at p=none, monitor reports for 2–4 weeks before tightening the policy.

What is missing dmarc?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a free email security standard that works alongside SPF and DKIM. You publish a single DNS TXT record at a special subdomain (_dmarc.yourdomain.com) that tells the world's mail servers what to do when someone sends an email pretending to be from your domain — for example, whether to let it through, quarantine it to spam, or reject it outright. Without this record, anyone on the internet can spoof your brand's email address and there is nothing in place to stop it or report it to you.

Without a DMARC record, criminals can send phishing emails that appear to come from your store's domain — stealing customer passwords, payment details, or credentials — and your brand takes the reputational hit. Google and Yahoo now require DMARC for bulk senders, meaning stores without it face deliverability problems: legitimate order confirmations, shipping notices, and marketing emails are more likely to land in spam or be rejected entirely. This directly harms revenue through lost transactional emails and undelivered promotions. OWASP classifies this under A05:2021 Security Misconfiguration because a missing DMARC record is a straightforward, avoidable configuration gap that exposes your customers and business to serious harm.

See the complete Missing dmarc guide for every platform and the full background.