The “DMARC policy not enabled” error returned during a reverse DNS lookup indicates the absence of a defined policy for your domain’s DMARC record. In a case where this error exists, your domain is not protected against spoofing and impersonation threats.

Through this article, we are going to take you through the various steps you need to implement to configure DMARC and set up the right policy for your domain so that you never have to come across the “DMARC policy is not enabled” prompt again!

Step 1: Define a Policy for Your DMARC Record

To fix the “DMARC Policy not enabled” error we need to understand what a policy like such does and what are the different types we can configure for our DMARC authentication system.

1. Reject emails that are unauthorized 

You can configure your failure mode to be of maximum enforcement by rejecting all emails that fail authentication by setting the p= tag in your DMARC record to “reject“.

2. Book your unauthorized emails for review later 

Keep your unauthorized emails on hold in the receiver’s quarantine box, if you don’t want to discard them outright. This can be achieved by setting your p= tag to “quarantine“.

3. Do nothing, let unauthorized emails get delivered as is 

You may not want to take any action against emails failing DMARC. In that case, simply set your p= tag to “none“.

The primary requirement of these modes is to offer domain owners the flexibility to choose how they want their recipients to react to emails that may be malicious or originate from sources that haven’t been specifically provided authority. It is an important step toward stopping domain impersonation. 

Step 2 – Republish/Publish Your Record With Your Chosen Policy

Once you are happy with your selected policy mode, publish your DMARC record, this time making sure you fill in the “p” parameter. Once you define this parameter email receiving servers will now be able to parse your record to receive instructions on which action to take against unauthorized messages. The “DMARC policy not enabled” error should now be resolved for your domain. 

Why should you Enable DMARC policy in the first place?

DMARC, which is the abbreviation for Domain-based Message Authentication, Reporting, and Conformance, is a standard for authenticating outbound email messages, to ensure that your domain is adequately protected against BEC and direct-domain spoofing attempts. DMARC works by aligning the Return-path domain (bounce address), DKIM signature domain, and From: domain, to look for a match. This helps to verify the authenticity of the sending source and stops unauthorized sources from sending emails that appear to be coming from you.

Your company domain is your digital storefront that is responsible for your digital identity. Organizations of all sizes make use of email marketing to gain reach and engage their clients. However, if your domain gets spoofed and attackers send out phishing emails to your customers, that drastically impacts not only your email marketing campaigns, it also takes a toll on the reputation and credibility of your organization. This is why adopting DMARC becomes imperative to safeguarding your identity.

In order to start implementing DMARC for your domain:

• Open your DNS management console
• Navigate to the records section
• Publish your DMARC record which you can generate easily using our free DMARC record generator tool and specify a DMARC policy to enable it for your domain (this policy will specify how the receiving MTA responds to messages failing authentication checks)
• It can take 24-48 hours for your DNS to process these changes, and you’re done!
• You can verify the correctness of your record using our free DMARC record lookup tool after configuring it for your domain

How to Fix “DMARC Quarantine/Reject Policy Not Enabled”

When you get a warning of “DMARC Quarantine/Reject policy not enabled” or sometimes just “DMARC policy not enabled” or “ No DMARC protection” that simply indicates that your domain is configured with a DMARC policy of “none” that allows monitoring only.

If you are just starting out on your email authentication journey, and you want to monitor your domains and email flow to ensure smooth email delivery, then we recommend you start off with a DMARC policy of none. However, a none policy offers zero protection against spoofing, and hence you will come across the frequent prompt: “DMARC policy not enabled”, where you are reminded that your domain isn’t adequately protected against abuse and impersonation.

In order to fix this, all you need to do is modify the policy mechanism (p) in your DMARC record from p=none to p=reject/quarantine, thereby shifting to DMARC enforcement. If your DMARC record was previously:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected];

Your optimized DMARC record will be:

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected];

Or, v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected];

Fixing “DMARC Policy Not Enabled Cloudflare” Error

If you are using Cloudflare as your DNS hosting provider, to get rid of this error in you must access your Cloudflare DNS management console to publish a DMARC record with the policy parameter defined. Use an automated tool to generate your record for best results.

• Login to your Cloudflare account to view your DNS management console
• Select your domain name
• From the left-hand side menu bar, select “DNS”
• Under the DNS management section for your domain, click on “Add Records”

Generate your record using our DMARC generator tool. It only takes a few seconds! [Copy your record value after generating it]

NOTE: while creating your DMARC record, make sure you choose an appropriate policy mode. The p= field shouldn’t be blank for your record. 

• In the add records section, set Type as “TXT”, TTL “Auto”, Name “_dmarc” and in the value field paste the value generated by the tool.
• Save changes

I Fixed “DMARC Policy Not Enabled”, What Next?

After resolving the “DMARC policy not enabled” prompt, monitoring domains should be a continuous process to ensure DMARC deployment doesn’t affect your email deliverability but rather improves it. DMARC reports can help you gain visibility on all your email channels so that you never miss out on what’s going on. After opting for a DMARC enforcement policy, PowerDMARC helps you view your email authentication results in DMARC aggregate reports with easy-to-read formats that anyone can understand. With this, you might be able to see a 10% increase in your email deliverability rate over time.

Moreover, you need to ensure that your SPF doesn’t break due to too many DNS lookups. This can lead to SPF failure and impact email delivery. Dynamic SPF is an easy fix to stay under the SPF hard limit as well as updated on any changes made by your ESPs at all times.

Make your DMARC deployment process as seamless as it can get, by signing up with our free DMARC analyzer today!

*** This is a Security Bloggers Network syndicated blog from PowerDMARC authored by Ahona Rudra. Read the original post at: https://powerdmarc.com/dmarc-policy-not-enabled/