DMARC p=none does not stop fake email
Many domains have a DMARC record that looks like v=DMARC1; p=none; rua=mailto:.... It was often added to pass a checklist, or to meet the 2024 rules from Gmail and Yahoo for bulk senders, which ask for a DMARC record but accept p=none.
The p is the policy: what a receiving server should do with mail that claims to be from you and fails the checks.
| Policy | What happens to a fake |
|---|---|
p=none | Delivered as normal. You get a report about it, if the rua address works. |
p=quarantine | Sent to spam, where people still find and open it. |
p=reject | Refused. The recipient never sees it. |
So p=none is a starting point, not protection. It is meant to run for a few weeks while you read the reports and confirm all your real mail passes.
Getting to p=reject safely
- List everything that sends as your domain: your mailbox provider, the newsletter tool, the shop, invoicing, the CRM, support desk. Each one needs SPF or DKIM set up with your domain. DKIM is the one that matters most, since it survives forwarding.
- Read the reports. The address in
rua=receives daily XML reports from Google, Microsoft and others. A free report reader makes them readable. Look for real services that fail. - Fix the failures at each service, usually by turning on DKIM signing for your domain.
- Raise the policy:
p=quarantinefor a week or two, thenp=reject. You can soften the step withpct=25, then 50, then 100.
For a small business with one mail provider, this often takes an afternoon of setup and two weeks of waiting.
Domains you do not send from
Skip the waiting: go straight to p=reject. There is no real mail to lose. The three records for a domain that sends no mail.
Subdomains
The policy covers subdomains too, unless the record has sp= set to something weaker. Check that sp=none is not hiding in an otherwise strict record.
Updated 2026-10-16.