"DMARC policy not enabled": read your record and move to quarantine and reject safely
In short: Reads the _dmarc record, says what a scanner reports for it, checks a report address is set, and writes the four records from p=none to quarantine at 25% to quarantine to reject, with a date for each. Limit: It doesn't read your DMARC reports; the DMARC report analyzer does.
"DMARC policy not enabled" means your domain's DMARC record is missing or set to p=none, which only monitors, so spoofed mail is still delivered. The fix is to move the policy to quarantine and then reject in stages, reading DMARC reports between each step so your own mail keeps passing. Enter your domain to see the record for every stage.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
p=none is "DMARC policy not enabled": spoofed mail is still delivered.
- Domain
- northwind.example
- Now
- p=none, no reports
- Next
- p=none with rua=
What this means for you
Four records, with dates: none with reports, quarantine at 25%, quarantine, then reject.
- Reads your live _dmarc record
- What scanners report for it
- Staged records to reject
- A date for each stage
- DMARC
- Quarantine
- Reject
By SimpleVerifier Team · Last updated
Enforcing DMARC. How do I keep bounces down too?
- Export the list you send campaigns to.
- Upload it on the verify page; the first checks are free.
- Send to the valid rows, so bounces don't hurt the domain you just protected.
How do I enable a DMARC quarantine or reject policy?
- Enter your domain and, if you want, the mailbox that should receive DMARC reports.
- Press Read my DMARC and plan the fix. The current _dmarc record is read live.
- Publish the first stage not marked done as a TXT record at _dmarc, replacing the old one.
- Before each next stage, check the reports: every service that sends as you should pass. Then publish the next record.
Example
- You enter
- Domain
northwind.example, whose record isv=DMARC1; p=none, checked on 6 Nov 2026. - You get
- Scanner shows "DMARC policy not enabled (p=none)" and no report address. Four records: p=none with rua= from 2026-11-06, quarantine at pct=25 from 2026-11-20, quarantine from 2026-12-04, reject from 2026-12-18.
- Limits
- Ten lookups a minute per visitor; the plan is built in your browser.
What does "DMARC policy not enabled" mean?
Security scanners and email audit tools show it when the _dmarc record is missing or has p=none. A none policy asks receivers to report on mail that fails authentication but to deliver it anyway, so anyone can still send mail that claims to be from your domain. "DMARC quarantine/reject policy not enabled" is the same finding worded for a record that hasn't reached the stronger policies yet.
It isn't a delivery error; your mail still arrives. Gmail and Yahoo only require bulk senders to publish a DMARC record, and p=none satisfies that. The finding is about spoofing protection.
What DMARC policy should I use: quarantine or reject?
Reject is the goal: failing mail is refused. Quarantine sends it to spam, which is the safe middle step while you find any legitimate service that isn't authenticated yet. RFC 7489 defines both and the pct= tag that applies a policy to part of the failing mail, which lets you start quarantine at 25%.
The order this tool writes: p=none with reports, quarantine at 25%, quarantine at 100%, then reject. Move on when the reports show every sender passing, which the DMARC report analyzer reads for you; two weeks a stage is a suggested pace, not a rule.
Will p=reject block my own email?
Only mail that fails both SPF and DKIM alignment with your domain, which is why the reports come first. The usual surprises are invoicing tools, help desks and CRMs sending as you without DKIM. Set up DKIM for each one before moving to reject.
Who uses this tool, and for what?
- IT admins
- Close a security-scan finding with a plan and dates instead of jumping straight to reject.
- Small businesses
- Stop scammers sending invoices that appear to come from your domain.
- MSPs
- Move each client domain through the stages on a schedule and copy the exact record at each step.
What can’t this tool tell you?
- It doesn't read your DMARC reports; the DMARC report analyzer does.
- The dates are a suggested pace. Move when reports show your senders passing, not when the date arrives.
- An existing sp= tag isn't carried over, so subdomains follow the main policy.
- DMARC protects the exact domain. Lookalike domains are a separate problem.
Common questions
- What does DMARC policy not enabled mean?
- Your DMARC record is missing or set to p=none, so receivers deliver mail that fails authentication. Move to quarantine and then reject in stages.
- What DMARC policy should I use?
- Start at p=none with a report address, then quarantine, then reject once reports show all your senders passing.
- Quarantine vs reject: what's the difference?
- Quarantine sends failing mail to spam; reject refuses it. Reject is the stronger protection.
- How long should I stay on p=none?
- Until the reports show every service that sends as you passing. Two to four weeks is common.
- Does p=none affect deliverability?
- No, your mail is delivered the same. It meets Gmail's and Yahoo's requirement to have a DMARC record, but doesn't stop spoofing.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.