How to fix the “DMARC policy not enabled” error- Everything you need to know!

 

If you have stumbled upon this blog, then it is highly likely that you are dealing with the issue of the “DMARC policy not enabled” error. You get this message when your domain has a DMARC record, but there is no valid policy to define it. A DMARC record makes no sense without a DMARC policy. It’s like having a front desk guard in your building who smiles and nods, even when strangers walk in. Hence, the moment this message appears, you must understand that your email system is no longer protected against phishing and spoofing attacks.

With this simple and elaborate guide, you can set up the apt DMARC policy (p=none, p=quarantine, or p=reject) for your domain. Let’s get started!

 

Here’s how to define the right policy for your DMARC record!

The first step towards eliminating the “DMARC policy not enabled error” is to learn what purpose each policy serves and which one is the most suitable for your email system. 

 

 

None policy

The p=none policy offers zero protection against email phishing and spoofing attempts. Yet it can be one of the most effective policies for your domain. The primary objective of this policy is to monitor your email activities. That’s why it is also known as the “monitoring” policy. It instructs the recipient email servers to take no action against unauthenticated emails sent on your behalf. 

This monitoring policy proves helpful when you have just deployed the DMARC protocol. Its lenient nature enables domain owners to evaluate the email traffic through the DMARC reports and detect potential phishing or spoofing attempts (if any), without disrupting email deliverability. 

 

Quarantine policy

The ‘p=quarantine’ policy instructs the recipient email server to handle the unauthenticated emails with proper vigilance. The quarantine policy is a step ahead of the p=none policy and is considered to be stricter as it instructs the receiving email servers to place the unauthorized emails in spam folders. This not only safeguards the recipients from potential malicious emails, but also helps the domain owner with further details around the misuse of their domains by threat actors.

 

 

Reject policy

The p= reject policy is the strictest and most effective one that offers fool-proof protection against potential phishing or spoofing attacks. When this policy is deployed, the recipient mail server is instructed to reject the unauthenticated emails straightaway. This means that any email that fails the authentication check will not reach the recipient’s inbox or spam folder. 

But there’s a downside to implementing the reject policy. In the case of false positives, even legitimate emails can be rejected. That’s precisely why one must apply this policy only at a later stage when they are completely confident about the email activities. 

 

 

Publish/republish the DMARC record with the appropriate policy

Now that you know the purposes served by each policy, choose the one that is most suitable for your domain. Next, publish or republish the DMARC report with the policy selected as per your domain requirements. In case you do not have a DMARC record, then use an online generator tool to produce and then publish it in your domain’s DNS. However, if you already have a DMARC record, you simply need to include the correct policy (p=none, p=quarantine, or p=reject). Once you are done, you can simply republish the DMARC record.

If there is no policy tag, be aware that the DMARC setup is incomplete and serves no purpose, as it cannot protect your email system from potential threat attacks, such as phishing and spoofing. In the absence of a policy, the recipient’s email servers are not receiving any instructions on how to handle an unauthenticated email.

Once you have added the correct policy, it will automatically resolve the “DMARC policy not enabled” error message. 

 

 

How to resolve the “DMARC quarantine/reject policy not enabled” error?

If you come across pop-up messages like “DMARC Quarantine/Reject policy not enabled,” “DMARC policy not enabled,” or “ No DMARC protection,” there’s nothing to worry. All you need to do is select the appropriate policy for the DMARC record to prevent malicious emails from being delivered to recipients.

If you are new to DMARC and have recently deployed it, the best approach is to opt for the “None” policy. This policy enables you to silently observe and monitor email traffic without disrupting the email deliverability. Also, a new domain or DMARC record can easily experience instances of false negatives or false positives. By implementing p=none policy, you can easily detect unauthorized users of your domain, as well as understand whether you have missed out on enlisting genuine senders in your SPF record.

You can then shift to the “Quarantine” policy after three to four weeks of close monitoring. Once you are well-versed in your DMARC setup, you can then move to “Reject” policy. 

 

 

What’s the right way to shift from p=quarantine to p=reject policy?

If you plan to transition from quarantine to reject policy without a strategy, it can significantly impact your email deliverability. Here’s how you can plan the transition smoothly:

 

Monitor your DMARC reports regularly

Study the aggregate DMARC reports to determine whether unauthorized senders are involved or if there are instances of false positives. It also helps you spot IP addresses that you might have missed adding to the SPF record.

 

Keep an eye on authentication gaps

Ensure that SPF and DKIM protocols are configured correctly. Check for SPF updates and DKIM signatures to avoid failed authentication checks.

 

Use the “percentage” tag gradually

The “percentage” tag can be strategically used to allow the p=reject policy to be applied to a specific percentage of outgoing emails.

 

 

Keep tracking your email traffic even after shifting to p=reject policy

Transitioning to reject policy doesn’t mean that you stop evaluating the DMARC reports. Review them regularly to ensure that no legitimate emails are blocked unnecessarily.

Regular monitoring and a thorough understanding of DMARC policies will help you resolve the “DMARC policy not enabled” error efficiently. If you still need help, feel free to reach out to the experts at DuoCircle for professional guidance.