Skip to content

Your DMARC policy is "none": anyone can send e-mail in your name

Warning Whole domain E-mail delivery

General instructions. Open this article from your PageCheck report to see it filled in with your domain's records and your DNS host's exact steps.

What it is

DMARC is a TXT record at _dmarc.example.com. It tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM.

What is wrong

The policy is p=none, which only collects reports. Mail forged in the name of your domain is still delivered.

How to fix

1. Make sure every service that sends your mail signs it with DKIM. Mail that passes only through SPF fails DMARC when it is forwarded.

  • Google Workspace: admin.google.com → Apps → Google Workspace → Gmail → Authenticate email.
  • Microsoft 365: security.microsoft.com → Email authentication settings → DKIM.
  • Other services (newsletter, shop, invoicing): their settings for domain authentication or DKIM.

2. Wait 3 days, then check the reports. The reports arrive at the address in the record's rua= tag; a DMARC report service makes them easier to read. For the days since the steps above, every service that sends your mail must pass. If one of them fails, fix that sender first and do not change the policy yet.

3. Change the policy. Replace p=none with p=quarantine and keep the rest of the record as it is.

  1. Open the DNS records of your domain where its DNS is managed: usually the domain registrar, the web host or Cloudflare.
  2. Edit the TXT record named _dmarc and change its value to: the same record with p=none replaced by p=quarantine
  3. Save. Most DNS hosts apply it within an hour.

Later 4. After 4 weeks with no failures of your own mail in the reports, change p=quarantine to p=reject the same way. 

Enforce DMARC for example.com (found by PageCheck: the policy is p=none, so forged mail is still delivered).

Steps:
1. List everything that sends mail as @example.com, including SMTP / mail API settings in this codebase. For each, say whether it can pass SPF or DKIM aligned with example.com.
2. Make sure each sender signs with DKIM for example.com; tell me where to turn it on and which DNS records to add.
3. Stop here and tell me to come back in 3 days: DKIM needs up to 48 hours to start, and the reports need a few days of data.
4. Check with me in the DMARC reports that every sender from step 1 passes. If one fails, fix it and do not change the policy.
5. Only then change the TXT record _dmarc.example.com from p=none to p=quarantine, keeping the rest. Tell me the exact steps for my DNS host, or do it through its API if you have access.
6. Verify the record with a DNS-over-HTTPS query and report what changed.
Do not set p=reject.

Check your site to see whether it has this problem. Check a website