Skip to content
DomainGrade

What we checkEmailEM-05

Your DMARC policy is p=none

You are collecting reports about forgery, and asking receivers to deliver it anyway.

Area
Email
Check
EM-05
Included
Free in every scan

What we check

Your DMARC record is published and its policy is p=none.

Why it matters

p=none is monitoring mode. A message that fails every authentication check still lands in your customer's inbox.

This is the most common state for a domain that has 'done DMARC': the record is there, it reads as protection on a checklist, and it blocks nothing.

There is a second cost, less obvious: while you are at p=none, you cannot tell the difference between a domain nobody is forging and one being forged constantly. The reports show both as sources that failed authentication and were delivered anyway.

How to fix it

  1. 1

    Read your aggregate reports until every sending source is one you recognise.

  2. 2

    Move to p=quarantine, then to p=reject.

  3. 3

    Use pct= if you want to ramp gradually.

  4. 4

    Watch the first week after each step closely. If something legitimate breaks, it will break immediately and visibly, which is easier to act on than a slow decline.

The next step
_dmarc.yourcompany.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com"

Common questions

How long should I wait before tightening?
Long enough to see a full cycle of your own mail — two to four weeks for most organisations.
What if I have no rua?
Add one first. Moving off p=none without reports means enforcing a policy you cannot observe.
Is quarantine enough?
It is a real improvement. reject is better: a quarantined forgery can still be retrieved from spam by someone who half-believes it.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks