A tool looked up _dmarc on your domain and did not find a policy it counts as one. Two different situations produce that line, and they need different answers.
Which of the two you have
The record lives on the _dmarc label of the domain in your From address, not on the domain itself, and one query settles which case is yours.
dig +short TXT _dmarc.example.comThe DMARC checker reads the same name and shows the record with each tag explained, if you would rather not use a terminal. An empty answer means there is no record at all. An answer that starts v=DMARC1; p=none means there is one, and it tells receivers to do nothing special with mail that fails. Several checkers report both as "not enabled", which is where the confusion starts. One of them is a missing record, and the other is a record doing its first job, collecting reports.
"DMARC Quarantine/Reject policy not enabled" usually comes from a tool that found the record and objects to p=none. A bare "DMARC policy not enabled" can mean either case, so trust the dig answer over the wording.
If there is no record ("No DMARC record found")
Publish this, on _dmarc.example.com, as a TXT record:
v=DMARC1; p=none; rua=mailto:dmarc@example.comp=none asks receivers to treat failing mail as they would have anyway. rua is where the daily aggregate reports go, and those reports are the whole point of starting here: they list every source sending as your domain, including the billing system somebody set up in 2019 and the ESP a colleague signed up for last month.
Give it a day to propagate, then check again with the same dig line.
Where the record goes
At the DNS host of the domain, which is not always the mail provider. Google Workspace, Microsoft 365 and Zoho Mail tell you to publish DMARC but do not publish it for you on a custom domain; it goes wherever the domain's DNS is managed.
Many panels append the domain to whatever you type in the name field, and there the field takes _dmarc and nothing more. Typing _dmarc.example.com into one of them produces _dmarc.example.com.example.com, a record no receiver will ever look up. If the check still says not enabled after a day, that is the first thing to look at.
A leftover second v=DMARC1 record on the same name cancels both, and the 554 5.7.5 page covers what that does at Outlook.
If the record says p=none
Then DMARC is published and you are in the stage where you read reports. Leave it there until the reports account for everything that sends as you, then move to p=quarantine and later, if you want it, p=reject.
Moving early is where real mail gets lost. A helpdesk that relays replies under the customer's own From address, or a survey tool sending as your domain from its own servers, fails DMARC the day the policy tightens, and often nobody knew it existed until it stopped arriving.
Why it is worth doing at all
Since February 2024, Gmail and Yahoo require a DMARC record on the From domain from anyone sending them bulk mail, and p=none satisfies that requirement. Since November 2025 Gmail has been ramping up enforcement on mail that misses the list, and Google says such mail will see disruptions up to temporary and permanent rejections.
The policy itself only takes effect when SPF and DKIM both fail to align with the domain your reader sees. RFC 9989 is precise about it: a message with no aligned identifier fails the check, and what happens next is what your p= tag asked for.
Two details that trip people up
Records that ramp up with pct=50 were built on a tag the current standard retired. If yours carries it, read Appendix A.6 of RFC 9989 before your next change. Receivers applied values other than 0 and 100 inconsistently, so the half you meant to quarantine was probably never half.
Subdomains have their own tags. sp= sets the policy for subdomains that exist, and the new np= applies only to names that do not exist in DNS at all, the ones a spoofer can invent at will. Without np= those names get sp=, and without sp= they get p=, so a domain at p=reject with neither tag already covers them.
What it costs in this test
Our report takes 14 points off the score out of 100 when there is no DMARC record, and another 6 when the message looks like a mailing, because the bulk sender rules apply to it. The classic ten point score charges nothing for it, which is one of the places the two numbers disagree on purpose, since the classic method predates the rules.
The two cases from the top of this page come out differently in the report. No record is a failed check headed "No DMARC record"; a record at p=none is a warning, "DMARC policy is p=none", with the record and its rua address shown beside it. The warning costs 6 points, and in a mailing a second check fails on top of it, "DMARC policy must be enforcing", for another 6. More on the check under DMARC result.