DMARC p=none is a starting point, not protection
A DMARC record with p=none tells receivers to deliver spoofed email anyway. It is the right first step, as long as you plan the next two.
Offensly Team··2 min read
Many domains publish a DMARC record and stop there:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"The record is valid, the checkbox is ticked, and anyone can still send email that looks like it came from example.com. With p=none you ask receivers to deliver a message that fails DMARC exactly as if there were no record at all. What you get in return is reports.
What the three policies do
| Policy | What the receiver does with a failing message |
|---|---|
p=none | Delivers it. You only get reports. |
p=quarantine | Treats it as suspicious, usually the spam folder. |
p=reject | Refuses it during the SMTP session. It never reaches the inbox. |
A message passes DMARC when SPF or DKIM passes and the domain it checked matches the visible From: domain. That second part, alignment, is where most legitimate mail fails when you first look.
For the business
With p=none, an invoice that looks like it came from your finance team is delivered like any other email. Mail providers also expect more than that: since 2024, Google and Yahoo require a DMARC record from anyone sending in bulk, and reject is what actually stops the spoofing. Moving there takes weeks, not a project, and the risk of losing real email is low if you follow the reports.
A safe path to reject
- Collect reports. Keep
p=nonewith anruaaddress for two to four weeks. The aggregate reports list every server that sent mail as your domain and whether it passed. - Fix your own senders. Your mail provider, CRM, help desk and invoicing tool each need either an SPF
includeor, better, DKIM signing with your domain. A sender that only passes SPF for its own bounce domain is not aligned. - Quarantine. Switch to
p=quarantineand watch the reports for another week or two. Anything legitimate that still fails shows up there before anyone misses it. - Reject. Switch to
p=reject. Keep theruaaddress so you notice when someone adds a new tool without telling you.
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Subdomains inherit the policy unless you set sp=. If a subdomain never sends mail, leave it covered by reject.
What to check first
- Exactly one DMARC record at
_dmarc.your domain. Two records means receivers ignore both. - An SPF record that ends in
-allor~all, with no more than 10 DNS lookups. - DKIM signing for every service that sends as your domain.
The free check on Offensly reads your SPF, DKIM, DMARC and MX records and tells you what each one allows, with the exact record to publish. No sign-up, public DNS data only.
Check your own domain in seconds
The free check reads your SPF, DKIM, DMARC and MX records and tells you exactly what to fix. No sign-up.