DMARC p=none is monitoring, not protection — how to reach enforcement
p=none asks receivers to send you reports and otherwise do nothing. It is the correct place to start and the wrong place to stop: a domain at p=none can still be spoofed exactly as freely as a domain with no DMARC at all.
Most domains stall here because nobody owns the move to enforcement. Treat it as a scheduled project with a deadline.
How to fix it
- 1Collect aggregate reports for at least two weeks.
- 2Identify every legitimate source failing alignment — helpdesks, invoicing systems and CRMs are the usual offenders.
- 3Fix alignment for each, usually by setting up DKIM signing on your own domain with that vendor.
- 4Move to p=quarantine and watch for a further two weeks.
- 5Move to p=reject. That is the configuration Google, Yahoo and Microsoft actually reward.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored