“DMARC Quarantine/Reject policy not enabled” – what it means

Verdict: Real, but not urgent; fix it in steps. Your DMARC record says p=none, so receivers deliver mail that fails DMARC as usual and anyone can still send as your domain. It doesn't block your own mail: Google's sender guidelines accept p=none, even from bulk senders. Move to p=quarantine, then p=reject, once your DMARC reports show every service that sends as you passing.

What the warning checks

MxToolbox's domain health report shows this warning when the domain's DMARC record (the TXT record at _dmarc.yourdomain.com) has no protective policy. Its problem page calls it "DMARC Policy Not Enabled" and says the record "is not currently configured with a protective DMARC policy", meaning quarantine or reject. The p= tag tells receivers what to do with mail that fails DMARC: none asks for no specific action, quarantine asks them to treat it as suspicious (usually the spam or junk folder), and reject asks them to refuse it (RFC 7489 §6.3; RFC 9989 §4.7 keeps the same three values).

Does it hurt email delivery?

Not by itself. p=none doesn't make your mail fail anywhere. Google's sender guidelines require DMARC only from bulk senders (5,000+ messages a day to Gmail) and say "Your DMARC enforcement policy can be set to none".
It leaves your domain open to spoofing. Mail that fails DMARC, including phishing with your domain in the From line, is delivered as if you had no policy. That is what the warning is about.
It keeps your logo out of the inbox. BIMI works only at quarantine or reject: BIMI logo not appearing.
Fixing it too fast does hurt. At quarantine or reject, every service that sends as you without passing SPF or DKIM for your domain lands in spam or bounces (Gmail answers 550 5.7.26). Mailing lists and forwarding can break DMARC too: RFC 7960 says "DMARC with restrictive policies causes problems for many Mailing Lists".

What to do

Make sure reports come in. Your record needs rua=, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, or a free monitoring address that turns the daily XML into a list of senders. Without rua= you would be enforcing blind.
Find every service that sends as you and get it passing: your mailbox, plus the newsletter tool, CRM, help desk, shop, invoicing app, website form and office scanner. Each must pass SPF or DKIM aligned with your From domain; DKIM with your own domain is the sturdier of the two. Read at least two weeks of reports, longer if some mail goes out only monthly (invoices, statements). Setup per service: the guides.
Then quarantine. Change the record to v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com and keep reading reports. If a real sender shows up failing, fix it, or go back to p=none while you do.
Then reject. After a few weeks at quarantine with no real mail failing: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com. Subdomains follow p= unless you set sp=.
A domain that sends no mail at all (parked, or only redirects to your main site) can go straight to v=DMARC1; p=reject with the SPF record v=spf1 -all: nothing of yours can break.
Don't ramp up with pct=. RFC 9989 (May 2026) removed it, so receivers that follow it apply your policy to all failing mail. Use the time-based steps above (what changed).
Run the checker again afterwards: its DMARC line shows the policy receivers now see.

Which record to publish now

Where you are	Publish at `_dmarc`
No reports yet, or you don't know every sender	`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`
Two weeks or more of reports, every real sender passing	`v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com`
Quarantine has run for a few weeks with no real mail failing	`v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com`
The domain sends no mail	`v=DMARC1; p=reject`

Need subdomain or alignment options? Build the record with the DMARC generator, then check it with the DMARC checker.

Want to reach reject without losing your own mail? The record is one line. The hard part is every invoicing app, CRM, website form and scanner that also sends as you and has to pass first. I find every service that sends as your domain (a test email from each, plus your DMARC reports), write the exact record for each one with the clicks for your DNS host, and re-check until SPF, DKIM and DMARC pass. Then you get dated steps to move DMARC to quarantine and reject without losing mail.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed after you follow the steps, full refund.

Who does the work: me, Ashish, the owner of this site, based in India. My public code and tools are on GitHub: github.com/Donrulezz.

Check what actually matters

SPF, DKIM and DMARC decide whether Gmail, Outlook and Yahoo accept your mail.

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Sources

Did this fix it?