You added DMARC in February 2024 because Google sent a scary email.

Remember when everyone in the ClickFunnels world was freaking out about it? Something about new sender requirements.. bulk email rules.. your messages would stop being delivered if you didn't comply. So you (or your tech person) added a record somewhere, checked the box, and moved on.

That's where most people stopped.

Here's what you actually did — and what it was supposed to do.

Your domain has a kind of public phone book entry on the internet. It's called DNS — Domain Name System. It's a set of records that tells the world things about your domain: where your website lives, where your email goes, and who's allowed to send email on your behalf.

A DMARC record is one line in that phone book. Its whole job is to tell every receiving mail server on the planet: "Here's what to do if someone sends an email pretending to be from my domain."

The full setup looks like this. First you add the DMARC record with a reporting address — that's an email where receiving servers send you daily summaries of who's sending mail as you. Then you read those reports to make sure your own legitimate email is passing authentication. Then you tighten the policy to actually block the bad stuff.

Google only required step one. Add the record. Set it to p=none .

Here's where everyone stopped — and why it's a problem.

p=none  is monitor mode. It's the equivalent of installing a security camera with no recording and no alarm. It watches. It does nothing else.

When your policy is set to p=none , you've told every mail server in the world: if an email claiming to be from my domain fails authentication.. deliver it anyway. Take no action.

Scammers can send email as you. To your list. To your customers. To your JV partners. And your DMARC record will not stop a single one of them.

Most people also skipped the reporting address entirely — so there's not even a camera feed. The record exists, Google is happy, and that's where it ends.

Here's what happens when you don't go any further.

When bad actors spoof your domain — and they do, it's automated, it happens to every domain — those emails generate spam complaints. Those complaints are attributed to your domain, not to the spoofer. Your sender reputation takes the hit.

Gmail, Yahoo, and Microsoft all maintain a reputation score for your domain. It's invisible to you, but it governs where your email lands. Inbox, spam folder, or blocked entirely.

As that score degrades, your open rates drop. Not dramatically at first. A few points. Then a few more. You attribute it to list fatigue or a bad subject line or an algorithm change. You test new angles. Nothing moves the number.

The actual problem is your domain reputation has been accumulating damage for months from spoofed emails you never knew were being sent.

The FBI's Internet Crime Complaint Center reported $2.9 billion in losses from Business Email Compromise attacks in 2023 alone — attacks that work precisely because p=none  domains are easy to impersonate. And in 2025, Microsoft joined Google and Yahoo with their own bulk sender enforcement. It's no longer one inbox provider tightening the rules. It's all of them, simultaneously.

Here's what changes when you actually finish the job.

Moving to p=quarantine  and then p=reject  closes the door. Emails that fail authentication get filtered to spam or refused entirely before they reach an inbox. Spoofed emails using your domain stop getting through.

Gmail, Yahoo, and Microsoft all use DMARC enforcement as a positive trust signal. Domains running p=reject  with clean authentication records consistently land in the inbox more reliably than domains sitting in monitor mode.

The less measurable but equally real benefit: you stop being an easy target. The spoofing attempts don't stop — every domain gets them — but they stop working.

Here's exactly how to do it.

Step 1 — Check what you've actually got.

Go to MXToolbox.com. Search your domain. Look for your DMARC record. It'll look something like this:

v=DMARC1; p=none; rua=mailto:[email protected] 

Check three things: what your p=  is set to, whether you have an rua=  tag with an email address, and whether that inbox is actually receiving anything.

If there's no rua=  tag, you've been generating reports that are going nowhere.

Step 2 — Read your reports.

The reports arrive as XML files. Nobody reads raw XML. Use a free tool — dmarcian, EasyDMARC, or Postmark's free DMARC analyzer all work. Connect your domain and look for two things:

IPs you don't recognize sending mail as your domain — that's spoofing.

Legitimate senders that are failing authentication — meaning they're sending as your domain but haven't been properly set up to prove it.

Here's the good news for CF2 users: if you connected your domain using ClickFunnels' domain integration wizard, DKIM was set up automatically. Your broadcasts, sequences, and workflow emails coming through CF2 should be passing clean. That's one less thing to worry about.

The ones to watch are everything else. Your autoresponder if you use one outside CF. Your helpdesk tool. Calendly confirmation emails. Zapier-triggered sends. Any SaaS tool where you typed your domain email into a "From" field and never thought about it again.

Every one of those services has its own mail servers. Every one of them needs its own DKIM configuration — set up separately in your DNS — or they'll show up in your reports as failing authentication.

Fix those before you tighten your policy. If a legitimate sender is failing and you jump to p=reject , you'll block your own emails.

Step 3 — Upgrade the policy in stages.

Once your legitimate email is passing cleanly, update your DNS record to:

v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected] 

The pct=10  applies quarantine to 10% of failing mail. It lets you test enforcement without going all-in. Watch for a week. If nothing breaks, increase pct=  toward 100.

Step 4 — Move to reject.

v=DMARC1; p=reject; rua=mailto:[email protected] 

Done. Spoofed emails using your domain are now refused at the server level. They don't reach an inbox, a spam folder, or anywhere else.

The DNS change itself takes thirty seconds. The prep work in steps 1 and 2 is the actual job — and most people can get through it in an afternoon.

Funnel Pulse monitors your DMARC policy as part of the Email Domain Health signal. If your policy drops back to p=none , if your record disappears, or if your RUA tag goes missing — the signal fires. You don't have to remember to check it. The check runs automatically.

Go look at your record today. The fix is a DNS update. The cost of leaving it at p=none  is your domain reputation quietly paying for spoofed emails you never sent.

🚀

​- James