How to fix “DMARC Quarantine/Reject policy not enabled” from MXToolbox

You ran MXToolbox's DMARC check and got the warning “DMARC Quarantine/Reject policy not enabled” — but you already have a DMARC record, so what's wrong?

Check your domain first — 10 seconds, free, no signup.
See your DMARC policy, SPF lookup count and every issue explained in plain English.
Run the free check →

What this means

The warning means your DMARC record is published but sits at p=none, which MXToolbox flags because p=none gives no active protection against spoofing. Crucially it's a warning, not an error — and p=none is the correct first step: MXToolbox's own guidance is to start at p=none and read your reports before moving to quarantine or reject, so you don't block legitimate senders. So the message is really “you're not finished yet”, not “you did it wrong”. Source: MXToolbox — DMARC Policy Not Enabled · verified 2026-07-15

How to fix it

Step 1. Confirm the finding: your record almost certainly reads p=none — monitoring only.
Step 2. Don't jump straight to p=reject just to silence the warning; that risks blocking real mail.
Step 3. Read aggregate reports first and authenticate every legitimate sender — the free check names them for you.
Step 4. Then step to p=quarantine, then p=reject — the warning clears once you're at enforcement.

Frequently asked

How long until fixes take effect?

DNS changes propagate within minutes to 48 hours. Mailbox providers pick up the new records on their next check — most senders see bounces stop within a day of correct configuration.

Does this apply if I send fewer than 5,000 emails a day?

Formal enforcement targets bulk senders, but partial authentication already costs you inbox placement at every volume — and spoofing protection matters regardless of how much you send.

Can I just ask my hosting provider to fix it?

Hosting support can add DNS records for you, but they don't know which services send as your domain. You (or a monitoring tool reading your DMARC reports) have to provide that list — that's the actual hard part.

Don't want to babysit DNS records?
DMARCKeeper monitors your reports, names every sender, and walks you to full p=reject protection.
Start free monitoring →