Skip to content
DomainGrade

What we checkEmailEM-05

DMARC policy

p=none collects reports but blocks nothing. Only quarantine or reject protect anyone.

Area
Email
Check
EM-05
Included
Free in every scan

What we check

We read the p= value in your DMARC record, and sp= if you have set one.

Why it matters

p=none is monitoring mode. It is the right first step and the wrong permanent state: a forged message that fails every check is still delivered to your customer's inbox.

Most domains that are 'doing DMARC' are sitting at p=none years later, which reads as protection on a compliance checklist and is not.

There is also a reporting consequence. Receivers send aggregate reports regardless of the policy, but the volume and usefulness of what they tell you about *blocked* mail only appears once something is being blocked — so staying at p=none also keeps you from learning what enforcement would have caught.

How to fix it

  1. 1

    Read your aggregate reports until every source you see is one you recognise.

  2. 2

    Move to p=quarantine — failures go to spam rather than the inbox.

  3. 3

    After a few weeks with no surprises, move to p=reject.

Common questions

What is the difference between quarantine and reject?
Quarantine delivers the message to the spam folder; reject refuses it at the door. Reject is stronger and gives a forged message no chance of being fished out of spam by a curious recipient.
Can I roll it out gradually?
Yes — pct= applies your policy to a percentage of failing mail. p=reject; pct=10 is a cautious way in.
What does sp= do?
It sets the policy for subdomains separately. If nothing legitimate sends from your subdomains, sp=reject closes an easy avenue.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks