DMARC p=none: What It Means and How to Move to Enforcement

Why it matters

Because p=none instructs receivers to do nothing on failure, a domain sitting at p=none can still be freely spoofed: an attacker can forge your exact domain in the From: header for phishing, invoice fraud, or BEC, and receivers will not quarantine or reject it on your behalf. You also gain no protection benefit from the SPF/DKIM you have already published. Just as important today, mailbox providers increasingly treat enforcement as a signal: Google, Yahoo, and Microsoft bulk-sender rules require a valid DMARC record (p=none minimum) and reward domains that reach quarantine/reject, so staying at none indefinitely both leaves you exploitable and caps your sender reputation. This is governed by RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC).

Common causes

• The domain is new to DMARC and was intentionally started at p=none to collect reports first, but nobody ever advanced it (the most common cause: 'set and forgot').
• Aggregate (rua) reports were never configured or never read, so the owner has no visibility into which legitimate senders would break under enforcement and is afraid to tighten the policy.
• Unknown or forgotten sending sources (marketing platforms, ticketing/helpdesk, ERP, CRM, a third-party MTA) are still failing alignment, so raising the policy would bounce real mail, the fix work was never finished.
• SPF or DKIM alignment is broken: mail authenticates but under a different domain (e.g. the ESP's return-path domain), so it passes SPF/DKIM yet fails DMARC alignment, discouraging enforcement.
• A subdomain or parked domain is sending mail that would fail, and no sp= (subdomain policy) plan exists.
• Fear of collateral damage from forwarding and mailing lists, which can break SPF and (less often) DKIM, causing owners to leave the policy at none 'to be safe.'

How to fix DMARC p=none

1. Confirm your current record: query the TXT record at _dmarc.yourdomain.com (e.g. `dig +short TXT _dmarc.example.com`). Verify it starts with v=DMARC1 and note the p= value. There must be exactly one DMARC record.
2. Make sure you are actually collecting data before changing anything: add a reporting address with rua=mailto:[email protected] (and optionally ruf=). If the reporting domain differs from your own, publish the cross-domain authorization record (example.com._report._dmarc at the report host, with value v=DMARC1). Feed these XML aggregate reports into a parser/dashboard rather than reading raw XML.
3. Run in p=none for a real monitoring window (typically 2–4 weeks, longer for complex mail) and inventory EVERY legitimate sending source from the reports: your own mail servers, M365/Google Workspace, and all third parties (marketing, invoicing, helpdesk, CRM, etc.).
4. For each legitimate source, get it to DMARC-aligned pass: publish/repair SPF so the sending IPs are authorized AND the Return-Path domain aligns with your From domain, and enable DKIM signing with a d= that matches (or shares the same Organizational Domain as, under relaxed alignment) your From domain. Aim for at least one aligned mechanism (DKIM is the more forwarding-resilient one) per source.
5. Decide alignment strictness: keep aspf=r and adkim=r (relaxed, the default: allows same-Organizational-Domain/subdomain matches) unless you have a specific reason for strict (s), which requires an exact FQDN match. Relaxed is right for almost everyone.
6. Move to enforcement gradually. Change p=none to p=quarantine, optionally ramping exposure with pct (e.g. p=quarantine; pct=25 then 50, 100). Watch aggregate reports for any legitimate source now failing and fix it before increasing.
7. Once quarantine is clean at pct=100, advance to p=reject to fully block spoofing. Reject is the end state that stops unauthorized use of your domain.
8. Set the subdomain policy explicitly: add sp=reject (or sp=quarantine) so subdomains inherit protection, and publish a p=reject DMARC record on any non-sending/parked domains to prevent them being abused.
9. Keep monitoring after enforcement, DMARC is not set-and-forget. New SaaS senders will appear in reports over time and must be aligned before they are silently blocked.

Related