AI Summary
Did a domain scan just flag “DMARC policy not enabled” on your site? Fixing it stops scammers from sending email that looks like it came from you.
Most DMARC records start in monitoring mode, which is safe but doesn’t block anything. The catch? Switching to enforcement too early can send your own emails to spam.
In this guide, I’ll show you how to fix this warning safely with WP Mail SMTP.
What the DMARC Policy Not Enabled Warning Means
The DMARC policy not enabled warning means your domain doesn’t block fake email. Either you have no DMARC record, or your record uses p=none.
Tools like MXToolbox show this warning until your policy is quarantine or reject.
Some scanners word it as “DMARC Quarantine/Reject policy not enabled.” It’s the same problem.
Here’s what each policy tells mail servers to do with failing email:
| Policy | What happens to failing email | Triggers the warning? |
|---|---|---|
p=none | Delivered as normal. You only get reports. | Yes |
p=quarantine | Sent to the spam or junk folder | No |
p=reject | Blocked before it reaches the inbox | No |
No DMARC Record at All
If a lookup says “No DMARC record found,” you need to create one first. Start with p=none so you can collect reports safely.
A DMARC Record Set to p=none
This is a common cause. You published a record, but it’s still in monitoring mode.
That’s the right place to start.
Since February 2024, Google and Yahoo require bulk senders to publish at least p=none. That’s why many domains never move past it.
The downside is that anyone can still spoof your domain. Mail servers see the failure, report it to you, then deliver the fake email anyway.
How to Fix DMARC Policy Not Enabled
To fix DMARC policy not enabled, change your record’s p= tag from none to quarantine. Later, move it to reject.
First, confirm every service that sends as your domain passes SPF or DKIM.
That check matters most. Skip it, and your contact form notifications could land in spam.
Prerequisites
Before you start, you’ll need:
- Access to your DNS settings: at your registrar, host, or a service like Cloudflare.
- A DMARC record: already in place (see above if you don’t have one).
- WP Mail SMTP: installed on your WordPress site. The free version is enough for this.
Step 1: Look up Your Current DMARC Record
First, check what your domain publishes right now. Your DMARC record is a TXT record at _dmarc.yourdomain.com.
You can look it up with the MXToolbox DMARC lookup. A record that triggers the warning looks something like this:
v=DMARC1; p=none; rua=mailto:[email protected]
The rua tag is the address that receives your aggregate reports. Keep it, because you’ll need those reports in the next step.
Step 2: Confirm Every Sender Passes SPF or DKIM
Next, make a list of every service that sends email as your domain. For a typical WordPress site, that’s usually:
- Your WordPress site: contact forms, WooCommerce receipts, and password resets.
- Your inbox provider: Google Workspace or Microsoft 365.
- Marketing tools: your newsletter or CRM platform.
Each one needs to pass SPF or DKIM on your domain. Here’s how SPF, DKIM, and DMARC work together. If one doesn’t, enforcement will send its email to spam.
For your WordPress site, I use the built-in test in WP Mail SMTP.
Go to WP Mail SMTP » Tools » Email Test. Enter an address and click Send Email.
If WP Mail SMTP finds a problem with records like SPF, DKIM, or DMARC, it shows Domain Check Results with steps to fix each one. The exact checks depend on your mailer.
If you see “Test email sent successfully!” instead, your WordPress site passed.
For your other senders, check your DMARC aggregate reports. Give them 2 to 4 weeks, then look for any legitimate service that’s failing.
If your WordPress emails fail here, fix that before you touch your DMARC policy. One fix is to send them through a proper mailer with WP Mail SMTP.
Step 3: Change the Policy to Quarantine
Once every sender passes, edit the _dmarc TXT record at your DNS provider. Change p=none to p=quarantine:
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Leave the other tags as they are. Save the record.
That’s enough to clear the warning. Mail servers will now send failing email to spam instead of the inbox.
Step 4: Move to Reject Once Reports Are Clean
Keep quarantine in place for another 2 to 4 weeks. Watch your reports and ask your team if any real email went to spam.
If everything looks clean, change the policy to reject:
v=DMARC1; p=reject; rua=mailto:[email protected]
This is full protection. Mail servers now block spoofed email from your domain outright.
Read Also: DMARC Policy: None vs Quarantine vs Reject
Step 5: Recheck Your Domain
Finally, confirm the change is live. Run the MXToolbox DMARC lookup again, and the warning should be gone.
Then send another test from WP Mail SMTP » Tools » Email Test. You should still see the success message, not Domain Check Results.
DNS changes can take a few minutes to 48 hours to show up. If the old record still appears, wait and check again.
Troubleshooting Common DMARC Enforcement Problems
Most problems after a policy change have 3 causes: a cached record, a failing sender, or a duplicate.
The Warning Still Shows After You Changed the Record
The scanner is probably reading a cached record. Wait for DNS to update, then run the lookup again.
Also check that you edited the record at _dmarc.yourdomain.com, not the root domain.
Legitimate Email Started Going to Spam
One of your senders isn’t passing SPF or DKIM. Switch back to p=none while you fix it.
Your aggregate reports will show which service is failing. Add it to your SPF record or set up DKIM for it.
Your Scanner Shows Two DMARC Records
Delete the extra one so only a single v=DMARC1 record remains. Then merge any tags you need into it.
Frequently Asked Questions
How do I enable my DMARC policy?
Edit your DMARC TXT record at _dmarc.yourdomain.com and change p=none to p=quarantine or p=reject. Check that all your senders pass SPF or DKIM first. That way, mail servers won’t block your own email.
Is p=none bad?
No. p=none is the right starting point, because it lets you collect reports without affecting delivery.
It just doesn’t protect your domain from spoofing, which is why scanners flag it.
Will switching to p=reject stop my emails from being delivered?
Only if a legitimate sender fails DMARC. That’s why you should move to quarantine first and watch your reports.
Once every sender passes, reject only blocks fake email.
How long does a DMARC change take to work?
The DNS change usually shows up within a few hours. It can take up to 48.
Plan on 2 to 4 weeks at each policy level before moving on.
Next, Create Your DMARC Record the Right Way
If your lookup showed no DMARC record at all, that’s the place to start.
How to Create a DMARC Record covers every tag. It also shows you how to publish your first record.
Once it’s live, come back here and move it to enforcement.
Ready to fix your emails? Get started today with the best WordPress SMTP plugin. If you don’t have the time to fix your emails, you can get full White Glove Setup assistance as an extra purchase, and there’s a 14-day money-back guarantee for all paid plans.
If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.
