The “DMARC policy not enabled” error returned during a reverse DNS lookup indicates the absence of a defined policy for your domain’s DMARC record. In a case where this error exists, your domain is not protected against spoofing and impersonation threats.

Through this article, we are going to take you through the various steps you need to implement to configure DMARC and set up the right policy for your domain so that you never have to come across the “DMARC policy is not enabled” prompt again!

Step 1: Define a Policy for Your DMARC Record

To fix the “DMARC Policy not enabled” error we need to understand what a policy like such does and what are the different types we can configure for our DMARC authentication system.

1. Reject emails that are unauthorized

You can configure your failure mode to be of maximum enforcement by rejecting all emails that fail authentication by setting the p= tag in your DMARC record to “reject“.

2. Book your unauthorized emails for review later

Keep your unauthorized emails on hold in the receiver’s quarantine box, if you don’t want to discard them outright. This can be achieved by setting your p= tag to “quarantine“.

3. Do nothing, let unauthorized emails get delivered as is

You may not want to take any action against emails failing DMARC. In that case, simply set your p= tag to “none“.

The primary requirement of these modes is to offer domain owners the flexibility to choose how they want their recipients to react to emails that may be malicious or originate from sources that haven’t been specifically provided authority. It is an important step toward stopping domain impersonation.

Step 2 – Republish/Publish Your Record With Your Chosen Policy

Once you are happy with your selected policy mode, publish your DMARC record, this time making sure you fill in the “p” parameter. Once you define this parameter email receiving servers will now be able to parse your record to receive instructions on which action to take against unauthorized messages. The “DMARC policy not enabled” error should now be resolved for your domain.

Why should you Enable DMARC policy in the first place?

DMARC, which is the abbreviation for Domain-based Message Authentication, Reporting, and Conformance, is a standard for authenticating outbound email messages, to ensure that your domain is adequately protected against BEC and direct-domain spoofing attempts. DMARC works by aligning the Return-path domain (bounce address), DKIM signature domain, and From: domain, to look for a match. This helps to verify the authenticity of the sending source and stops unauthorized sources from sending emails that appear to be coming from you.

Your company domain is your digital storefront that is responsible for your digital identity. Organizations of all sizes make use of email marketing to gain reach and engage their clients. However, if your domain gets spoofed and attackers send out phishing emails to your customers, that drastically impacts not only your email marketing campaigns, it also takes a toll on the reputation and credibility of your organization. This is why adopting DMARC becomes imperative to safeguarding your identity.

In order to start implementing DMARC for your domain:

Open your DNS management console
Navigate to the records section
Publish your DMARC record which you can generate easily using our free DMARC record generator tool and specify a DMARC policy to enable it for your domain (this policy will specify how the receiving MTA responds to messages failing authentication checks)
It can take 24-48 hours for your DNS to process these changes, and you’re done!
You can verify the correctness of your record using our free DMARC record lookup tool after configuring it for your domain

How to Fix “DMARC Quarantine/Reject Policy Not Enabled”

When you get a warning of “DMARC Quarantine/Reject policy not enabled” or sometimes just “DMARC policy not enabled” or “ No DMARC protection” that simply indicates that your domain is configured with a DMARC policy of “none” that allows monitoring only.

If you are just starting out on your email authentication journey, and you want to monitor your domains and email flow to ensure smooth email delivery, then we recommend you start off with a DMARC policy of none. However, a none policy offers zero protection against spoofing, and hence you will come across the frequent prompt: “DMARC policy not enabled”, where you are reminded that your domain isn’t adequately protected against abuse and impersonation.

In order to fix this, all you need to do is modify the policy mechanism (p) in your DMARC record from p=none to p=reject/quarantine, thereby shifting to DMARC enforcement. If your DMARC record was previously:

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected];

Your optimized DMARC record will be:

v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected];

Or, v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected];

Fixing “DMARC Policy Not Enabled Cloudflare” Error

If you are using Cloudflare as your DNS hosting provider, to get rid of this error in you must access your Cloudflare DNS management console to publish a DMARC record with the policy parameter defined. Use an automated tool to generate your record for best results.

Login to your Cloudflare account to view your DNS management console
Select your domain name
From the left-hand side menu bar, select “DNS”
Under the DNS management section for your domain, click on “Add Records”

Generate your record using our DMARC generator tool. It only takes a few seconds! [Copy your record value after generating it]

NOTE: while creating your DMARC record, make sure you choose an appropriate policy mode. The p= field shouldn’t be blank for your record.

In the add records section, set Type as “TXT”, TTL “Auto”, Name “_dmarc” and in the value field paste the value generated by the tool.
Save changes

I Fixed “DMARC Policy Not Enabled”, What Next?

After resolving the “DMARC policy not enabled” prompt, monitoring domains should be a continuous process to ensure DMARC deployment doesn’t affect your email deliverability but rather improves it. DMARC reports can help you gain visibility on all your email channels so that you never miss out on what’s going on. After opting for a DMARC enforcement policy, PowerDMARC helps you view your email authentication results in DMARC aggregate reports with easy-to-read formats that anyone can understand. With this, you might be able to see a 10% increase in your email deliverability rate over time.

Moreover, you need to ensure that your SPF doesn’t break due to too many DNS lookups. This can lead to SPF failure and impact email delivery. Dynamic SPF is an easy fix to stay under the SPF hard limit as well as updated on any changes made by your ESPs at all times.

Make your DMARC deployment process as seamless as it can get, by signing up with our free DMARC analyzer today!

2021 has been quite an eventful year when it comes to email security and authentication. From major ransomware attacks that ended up costing businesses billions of dollars to COVID-19 vaccination phishing lures in the form of fake emails, security professionals had a lot to deal with.

Today we are looking back at the major email security attacks of 2021, talking about what the future holds, and sharing some handy tips on tackling threats in 2022.

Major email security attacks in 2021

1. Direct-domain spoofing

Spoofing attacks continue to rise as we progress into 2022, with attackers impersonating brands including but not limited to well-known industry names like DHL, Microsoft, and Amazon.

2. Phishing attacks

The FBI’s Internet Crime Complaint Center received the most complaints against phishing attacks in 2021.

3. Ransomware

Using phishing as the most common attack vector, several systems were affected by malware and ransomware files this year.

4. Man-in-the-middle attacks

SMTP email security loopholes are easily exploited by Man-in-the-middle attackers to intercept and eavesdrop on email communications.

How to build cyber resilience against these attacks?

Deploying SPF, DKIM, and DMARC

DMARC can help you minimize phishing and spoofing attacks. It also acts as the first line of defense against ransomware. Other benefits of DMARC include improved email deliverability, reduced spam complaints, and boosts your domain’s reputation.

BIMI

If your client’s ESP supports BIMI, it is a good idea to deploy it today. BIMI helps your customers visually identify you in their inbox even before they get around to opening the message.

MTA-STS

MTA-STS is an effective solution against MITM attacks, helping secure your emails in transit and overcome SMTP security issues.

What to expect in 2022?

With various organized internet crime groups resurfacing in recent times with upgraded tactics, it wouldn’t be a surprise to anyone if the intensity and frequency of email-based attacks increase even further in 2022.
Brand impersonations and ransomware attacks will continue to surge as cybercriminals exploit remote working environments. To make situations worse, the cost associated with these attacks is predicted to also rise in the following year.

Final Thoughts

Security experts recommend that organizations take email security more seriously in the years to come, due to the alarming increase in cyberattacks. A popular myth that security professionals are now debunking is that only MNCs and enterprise-level companies need DMARC. This, of course, is not true as in the past year almost 50% of the organizations that were hit by internet attacks were in fact startups and small businesses.

Another important thing to consider while implementing security standards is that a relaxed policy for your protocols will provide your domain with very little to zero protection.

While social engineering attacks continue to evolve and get more and more complex and undetectable, companies should evolve with them. Email authentication protocols, while there is no silver bullet, definitely reduce the chances of falling prey to email-based attacks and strengthen the overall email security posture at your organization. It also provides deeper insight into attacks and vulnerabilities, reducing the incident response time.

Tag Archive for: 2022

How do I fix “DMARC Policy is Not Enabled” in 2023?