The "DMARC quarantine/reject policy not enabled" error occurs when your domain's DMARC record is not configured to take action against emails that fail authentication checks. This error means that unauthorized emails using your domain may still reach recipients' inboxes, putting your business at risk for phishing attacks, spoofing, and reputational harm.

The most common reasons for getting this error include:

• Policy Set to None: The DMARC policy (p) is set to none, meaning no actions are taken against unauthenticated emails.
• Misaligned SPF or DKIM: SPF or DKIM records are not properly aligned, causing legitimate emails to fail DMARC checks.
• Lack of Monitoring: The DMARC record lacks proper reporting (rua or ruf), making it difficult to assess and adjust email authentication practices.

In this article, we'll explain why this error happens, why it is important to resolve it, and how you can fix it to secure your email system.

‍

What Does "DMARC Quarantine/Reject Policy Not Enabled" Mean?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is like the bouncer at a club—it helps domain owners prevent unauthorized use of their domain by kicking out shady emails. It provides visibility into email activity and tells receiving mail servers whether to let an email in or throw it out.

The "quarantine/reject policy not enabled" error indicates that your current DMARC record is not configured to take action against unauthorized emails. Without an effective quarantine or reject policy, phishing emails using your domain may pass through to recipients' inboxes, leaving your customers and partners vulnerable to scams. Properly configuring your DMARC policy is vital to protect both your brand and your contacts.

‍

Why You Need to Enable a Quarantine or Reject Policy

A DMARC policy without quarantine or reject settings is like having a guard dog that just watches burglars walk by without barking or biting. Here's why enabling these policies matters:

• Protect Brand Reputation: Phishing attacks often impersonate trusted brands. Without a strong DMARC policy, cybercriminals can misuse your domain to target individuals, causing significant reputational damage.
• Avoiding Blacklisting: Mail servers that receive phishing emails from your domain may categorize it as unsafe, reducing email deliverability.
• Customer Trust: A visible, strong email security strategy reassures customers and business partners that you are serious about data security.

The quarantine policy sends suspicious emails to the spam folder—like putting them in time-out—while the reject policy stops them from even getting through the door. Implementing these policies is crucial to keeping your domain's reputation squeaky clean. You can also check the status of email security using the Palisade Email Security Score tool.

‍

How to Fix the "DMARC Quarantine/Reject Policy Not Enabled" Error

If you're seeing the "DMARC quarantine/reject policy not enabled" error, follow these steps to correct it and secure your email system:

1. Check Your Current DMARC RecordStart by checking the current DMARC record for your domain. This can be done using online tools like the Palisade DMARC Checker or command-line utilities like dig. Look for a policy tag (p) in the record that specifies either "none," "quarantine," or "reject."
2. Update Your DMARC Policy
   • If your current policy (p) is set to "none," it means no actions are being taken against potentially malicious emails.
   • Before updating your DMARC record to quarantine or reject, ensure that your DKIM and SPF records are properly aligned. DKIM alignment means that the domain in the "d=" tag of the DKIM signature matches the domain in the "From" address. SPF alignment ensures that the domain used in the SPF check matches the domain in the "From" address. Misalignment can lead to legitimate emails getting flagged as imposters, causing delivery issues and harming your organization's ability to communicate effectively. Imagine sending important invitations, only to have them lost because your security gatekeeper is confused.
   • To simplify the process of aligning your SPF and DKIM records and ensure you're ready to change your policy from none to quarantine or reject, consider using the Palisade app. Proper alignment will help maintain high deliverability rates and avoid critical emails being marked as spam or rejected altogether.
   • Update your DMARC record to set the policy to either quarantine or reject. This can also be done automatically using the Palisade app. For instance:
   • v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com;
   • Quarantine Policy: Suspicious emails are marked as spam and sent to recipients' junk folders.
   • Reject Policy: Emails that fail DMARC checks are blocked from being delivered at all.
3. Monitor Your ReportsUse the reporting feature (rua and ruf) in your DMARC record to receive data on email activity. This visibility allows you to fine-tune your policy over time, ensuring legitimate emails are delivered while unauthorized ones are stopped. The Palisade app will monitor your reports automatically and notify you if anything requires your attention.
4. Use a DMARC Management ToolManaging and optimizing DMARC records can feel like juggling flaming torches—especially as your email volume grows. Using a tool like Palisade can make it much simpler and safer.

‍

Best Practices for Setting Up a Strong DMARC Policy

Configuring DMARC effectively requires more than simply setting the policy to quarantine or reject. Here are some best practices to consider:

• Start with "Quarantine": If you are just beginning, setting the policy to quarantine lets you monitor the impact while still mitigating threats.
• Gradually Move to "Reject": Once you are confident that your legitimate emails are correctly authenticated, transition to a reject policy for maximum protection.
• Ensure SPF and DKIM Alignment: For DMARC to work properly, ensure that both SPF and DKIM are correctly configured and aligned.
• Test Before Implementing: Use a staged approach by first publishing a record with p=none and carefully analyzing the reports before advancing to more aggressive policies.

‍

Common Challenges and How to Overcome Them

Implementing DMARC can come with its own set of hurdles, like:

• Misconfigured SPF or DKIM: Think of SPF and DKIM as your ID checkers. If they're not set up correctly, DMARC won't be able to verify who’s legit. Double-checking their setup will help avoid mishaps.
• False Positives: Moving from a none policy to quarantine or reject might mean some good guys get caught in the crossfire. Keep an eye on reports and tweak as needed to avoid legitimate emails being wrongly flagged.

‍

The Next Step Towards Secure Email Communication

Addressing the "DMARC quarantine/reject policy not enabled" error is more than a technical adjustment—it's an essential step in protecting your organization's reputation, improving deliverability, and ensuring that customers trust your communications. By taking action now and enabling an effective DMARC policy, you set a solid foundation for a safer email environment.

If you haven't already, consider testing your domain's security with the Palisade Email Security Score tool. It offers a simple way to evaluate your current setup, identify risks, and enhance the overall security of your emails.

To easily setup and monitor your DMARC security, consider using the Palisade App

Secure your email, secure your brand.

‍