Your DMARC says p=none. Here is what that actually means.
If you ran your domain through our exposure checker and it came back p=none, you are in the same position as most organisations that have configured DMARC at all. The record exists. It is doing almost nothing.
What the three policies actually do
DMARC tells a receiving mail server what to do when a message claiming to be from your domain fails authentication. There are three possible instructions:
- p=none — deliver it anyway. Send me a report about it.
- p=quarantine — treat it as suspicious. Usually the spam folder.
- p=reject — refuse it outright. It never reaches the recipient.
With p=none, an attacker sending invoices that appear to come from your finance address will have those invoices delivered to the inbox. The DMARC record does not stop it. It only tells you afterwards, and only if you configured a reporting address.
So why does p=none exist?
Because turning on enforcement blindly breaks things. Most organisations send legitimate mail from more systems than they realise — the CRM, the invoicing platform, the recruitment tool, the marketing service, the monitoring alerts. Every one of those needs to be authorised in SPF or signed with DKIM.
p=none is a monitoring mode. You publish it, collect aggregate reports for a few weeks, and discover which senders exist. It is a legitimate first step. The failure is not starting there — it is stopping there. A record published two years ago and never revisited is providing the reporting nobody reads and the protection nobody has.
How to move to enforcement without breaking mail
- Add a reporting address to the record:
rua=mailto:dmarc@yourdomain.com. Without it, p=none is doing literally nothing. - Collect reports for two to four weeks. Aggregate reports are XML; a parser or a DMARC platform makes them readable.
- Identify every legitimate sender in those reports. Expect surprises.
- Authorise each one properly — SPF include, or DKIM signing. Watch the SPF 10-lookup limit as you add includes.
- Move to
p=quarantinewithpct=25. That applies the policy to a quarter of failing mail, limiting the blast radius if you missed something. - Raise the percentage gradually to 100, watching reports at each step.
- Move to
p=reject. This is the goal, and it is where your domain stops being usable for impersonation.
While you are in there: SPF
Our checker also flags an SPF record ending in ~all rather than -all. The tilde is a soft fail: unauthorised senders are marked but generally still delivered. The hyphen is a hard fail. Once DMARC is at enforcement and your senders are all authorised, -all is the correct end state.
The thing worth internalising
Email spoofing is the delivery mechanism for most business email compromise and a great deal of ransomware. The controls that stop it are three DNS records, cost nothing, and take a few weeks of careful work. There are very few places in security where the return is that lopsided.