Recommendations

1. 1Upgrade your DMARC policy from p=quarantine to p=reject for full blocking▾

   With p=quarantine, spoofed emails are sent to spam instead of being blocked outright. Some recipients still check spam folders, and sophisticated attacks can be flagged as legitimate by users. p=reject ensures fraudulent emails never reach any folder.

2. 2Add rua=mailto:dmarc@yourdomain to your DMARC to receive reports▾

   Without DMARC reporting (rua=), you have no visibility into who is sending email on behalf of your domain. Aggregate reports let you detect spoofing attempts, identify misconfigured legitimate senders, and confidently tighten your policy over time.

3. 3Fix your MTA-STS policy file — it could not be fetched▾

   Your domain has an MTA-STS DNS record, but the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt is unreachable. Without a valid policy file, MTA-STS provides no protection. Check that the subdomain mta-sts.yourdomain resolves correctly and serves the policy over HTTPS.