DMARC p=none: What It Means and How to Move to Enforcement Safely

If your DMARC record looks like this, your domain is in “monitoring mode”:

v=DMARC1; p=none; rua=mailto:[email protected]

That’s a perfectly good place to start. It’s also where a huge number of businesses stop, often for years, without realising what it leaves open.

What p=none actually does

DMARC has three policies. Each tells receiving mailbox providers what to do with email that claims to be from your domain but fails authentication:

Policy	What happens to failing email	Protects against spoofing?
p=none	Delivered as normal; you just get reports	No
p=quarantine	Sent to spam/junk	Mostly
p=reject	Refused outright	Yes

So with p=none, someone can send a fake invoice “from” your domain to your customers and it will still be delivered. What you get in return is visibility: the reports sent to your rua address show every server sending as your domain and whether it passes SPF and DKIM.

Is p=none enough?

For delivery, mostly yes. Google, Yahoo and Microsoft all require bulk senders to have a DMARC record, and p=none meets that minimum. If you were seeing errors like Microsoft’s 550 5.7.515, a p=none record (plus passing, aligned SPF or DKIM) is what clears them.

For protection, no. Your domain can still be used in phishing and invoice fraud, which damages your reputation with customers and with mailbox providers.

For BIMI, no. If you want your logo to appear next to your emails in Gmail and other inboxes, BIMI requires an enforcement policy: p=quarantine or p=reject.

Why businesses get stuck on p=none

The fear is reasonable: “If I switch to reject and I’ve missed something, my own emails will stop arriving.” That’s exactly what happens when a business moves too fast. A payroll system, a website contact form, a CRM or an old marketing platform is still sending as the domain without being authenticated, and those emails disappear.

The way out is not to stay on p=none for ever. It’s to use the reports to find every sender first.

A safe path from p=none to p=reject

1. Make sure reports are arriving, and actually read them

DMARC aggregate reports arrive as zipped XML files, usually daily from each provider. They’re not meant to be read by humans in their raw form. Use a DMARC reporting service (or ours) to turn them into a readable list of sending sources.

2. List every legitimate sender

Go through each source in the reports and label it: Microsoft 365 or Google Workspace, your email marketing platform, CRM, helpdesk, accounting software, website, and so on. Anything you don’t recognise is either a forgotten tool or someone spoofing you.

3. Fix authentication and alignment for each one

For every legitimate sender, set up DKIM signed with your domain, and add it to SPF where the platform supports it. DMARC passes when SPF or DKIM passes and matches the domain in your From address. DKIM is the more reliable of the two, because it survives forwarding.

4. Move to p=quarantine

Once your reports show your legitimate mail passing consistently (we suggest at least two to four weeks of clean data), update the record:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

Keep watching the reports. If a legitimate source starts failing, it goes to spam rather than vanishing, so you can catch it and fix it.

5. Move to p=reject

After another few weeks with no surprises, go to full protection:

v=DMARC1; p=reject; rua=mailto:[email protected]

6. Don’t forget subdomains and parked domains

Your subdomains inherit your policy unless you set sp=. Domains you own but never send from (old brand names, .ie or .com variants of your .co.uk) should be locked down with v=spf1 -all and p=reject straight away, because they’re easy targets for spoofing.

How long should the whole process take?

For most small and medium-sized businesses, six to twelve weeks from p=none to p=reject is realistic. The time goes mainly on tracking down the senders nobody remembered.