“DMARC policy not enabled” or “No DMARC record found” — what the warning means and what to do

What this warning means

A scanner, a deliverability tool, a customer’s security questionnaire, or a mailbox provider’s postmaster tools has flagged that your domain either has no DMARC record at all, or has one with no effective policy (p=none). The two cases sound different but have the same practical consequence: anyone on the internet can send email claiming to be your domain, and receiving servers have no instruction from you to stop it.

This warning increasingly appears in contexts that cost you money: supplier security assessments, cyber-insurance questionnaires, partner onboarding checks, and the sender requirements of Google, Yahoo and Microsoft — all of which now expect a published DMARC record as a minimum.

Why it matters — in concrete terms

Without DMARC (or stuck at p=none):

• Direct domain spoofing is easier. Without an enforced policy, receivers have no DMARC request to reject forged mail. ENISA’s agency case involved a compromised mailbox, which DMARC would not stop; account security and payment verification are also needed.
• You lose aggregate-report visibility. Arua= address requests reports from participating receivers. Those reports are useful evidence, with gaps and delays; they complement sender logs and message-header tests.
• Your deliverability is discounted. Major providers treat a missing DMARC record as a negative reputation signal for every message you send.

Publishing DMARC and requesting reports is a first step. Ap=none policy requests no enforcement, whilequarantine and reject ask receivers for stricter handling. Receivers retain their own filtering rules.

How to fix it — the safe sequence

1. Publish a monitoring record.v=DMARC1; p=none; rua=mailto:reports@yourdomain.comat _dmarc.yourdomain.com requests reports without requesting rejection or quarantine. Check the address and report handling before publishing; receiver filtering still applies.
2. Inventory your senders. Received reports show sources observed by reporting receivers. Compare them with your own list of mail, invoicing and newsletter services, and allow a full sending cycle for infrequent senders. Missing reports do not prove that a sender is absent.
3. Align every legitimate sender with SPF and, preferably, DKIM signed with your own domain.
4. Enforce. Move to p=quarantine, verify nothing legitimate breaks, then p=reject. This reduces direct domain spoofing where receivers apply the policy; it does not stop lookalike domains or compromised accounts. EU CSIRT guidance describes this exact monitor-then-enforce path.
5. Keep watching. New tools, key rotations and vendor changes will eventually break alignment again; the reports are how you find out, rather than hearing it from a customer first.

How long does it take?

Publishing the record: five minutes. Reaching enforcement: typically four to eight weeks for a small business, driven mostly by how many sending services need aligning. The cost of not starting is open-ended.