Fix "DMARC Quarantine/Reject Policy Not Enabled"

What the warning means

Checkers show "DMARC Quarantine/Reject policy not enabled" when the DMARC record exists but has p=none. With p=none receivers take no action on mail that fails DMARC, so anyone can still spoof your From address. If there is no record at _dmarc.yourdomain at all, the message is usually "No DMARC record found".

Check your current record first.

Fix it in four steps

Make sure you receive reports. Your record needs a rua=mailto: address. Aggregate reports are XML files; a DMARC reporting service makes them readable.
Find every legitimate sender. In the reports, list every source IP and service sending as your domain. Typical ones: Google Workspace or Microsoft 365, a newsletter platform, CRM, help desk, invoicing.
Authenticate each one. Turn on DKIM signing with your own domain in each service (custom DKIM or domain authentication), and add its SPF include if it uses your domain as Return-Path. Watch the 10-lookup SPF limit.
Raise the policy. Change p=none to p=quarantine, watch reports for a week or two, then move to p=reject.

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Common mistakes

Publishing a second DMARC record instead of editing the first. Two records make DMARC invalid.
Adding the record at the root (@) instead of host _dmarc.
Jumping to reject before checking that marketing and transactional platforms sign with your domain.
Forgetting parked domains: domains that never send should publish v=DMARC1; p=reject; and v=spf1 -all.