Risk level is flagged as Medium due to DMARC not enforcing
The DMARC record is missing a rua= reporting address
SPF and DKIM may already be valid — the issue is that DMARC
How urgent is this? DMARC on p=none is high priority. It means anyone can send emails that appear to come from your domain right now, and recipients will receive them without any warning. For organisations that handle donations or financial transactions, this is a real and active phishing risk.
Who does this?
The person holding the Domains & DNS role in your organisation (via your domain registrar or hosting provider).
Background: what do these records do?
Record
Purpose
SPF
Lists which mail servers are allowed to send email for your domain
DKIM
Adds a cryptographic signature to emails so recipients can verify authenticity
DMARC
Tells receiving servers what to do when SPF or DKIM fails — and where to send reports
When DMARC is set to p=none, it only monitors — it does not block or quarantine anything. Switching to p=quarantine or p=reject activates enforcement.
Step 1: Update the DMARC record
In the DNS settings for the domain, find the TXT record named _dmarc.[clientdomain].
Replace THEIR-EMAIL@clientdomain.com with an address the client monitors regularly (e.g. it@ or beheer@). This rua tag enables aggregate reports showing who is sending email from their domain.
Do not jump straight to p=reject unless you are confident all legitimate mail flows are covered by SPF and DKIM. Start with p=quarantine as a safe intermediate step.
Step 2: Wait and monitor (2–4 weeks)
After the change, check with the client whether any legitimate emails are landing in spam. Ask them to check:
Their own outbound mail (newsletters, notifications, transactional email)
Any third-party tools that send on behalf of the domain (e.g. Mailchimp, Brevo, Salesforce)
With p=reject, spoofed emails are fully blocked by receiving mail servers. This is the recommended end state.
Step 4 (optional): Tighten SPF
If the SPF record ends in ~all (soft fail), consider changing it to -all (hard fail) for stricter enforcement:
Before:v=spf1 ... ~all
After:v=spf1 ... -all
Only do this if you are certain all sending sources (Google Workspace, newsletters, CRM, etc.) are already listed in the SPF record. When in doubt, leave ~all in place.