Your DMARC record says p=none. Here is what that actually permits.
A DMARC policy of p=none permits everything. It tells receiving mail servers you have no preference about mail that fails authentication, so spoofed messages still land. Red Sift found 29.1 percent of 5,000 US domains at p=none. The DMARC standard treats it as a one-month starting position, not a destination.
- p=none is monitoring only. It publishes a policy that asks receiving servers to take no action on mail that fails authentication, so forged invoices still reach your customers.
- The DMARC standard suggests at least one month at p=none before moving to quarantine. CISA gave federal agencies one year to reach reject. Years at p=none is an abandoned project.
- Google and Yahoo's bulk sender rules both accept p=none, so passing them proves your mail gets delivered, not that forgeries get blocked.
- Red Sift measured 5,000 US domains in 2026 and found 29.1 percent at p=none, 22 percent at quarantine, 38.4 percent at reject and 10.5 percent with no record at all.
- Even full enforcement does not stop display-name impersonation, because the DMARC standard puts that attack out of scope. Dual approval on payment changes still matters.
What does a DMARC policy of p=none actually permit?
A DMARC policy of p=none permits every forged message to be delivered anyway. The standard says so plainly. RFC 9989, the May 2026 specification that replaced the original DMARC document, defines the none policy as a state in which the Domain Owner offers no expression of preference. Your DMARC record is live, valid, and passes the compliance checkbox. It also asks receiving mail servers for nothing.
The mechanism is simple. A DMARC record is a public DNS TXT record you publish at _dmarc plus your domain name. It does two jobs. It tells receiving servers what to do when a message fails to authenticate, and it asks them to report back what they saw. At p=none only the second job runs. RFC 9989 calls that state Monitoring Mode. You collect evidence. Nobody acts on it.
At p=none you have asked Gmail and Outlook to watch someone spoof your domain, then send you a summary afterwards.
Monitoring is useful, and it is not protection. Email spoofing works because the From address a reader sees is just text anyone can type. DMARC closes that gap only when you ask receivers to quarantine or reject the forgeries. Until then a fraudulent invoice carrying your exact domain reaches your customer looking identical to a real one.
How do you check which DMARC policy your domain publishes?
To check your DMARC policy, look up the DNS TXT record at _dmarc followed by your domain name and read the value after p=. Any free DNS lookup tool shows it in seconds. The record is public, so you need no login to verify it yourself.
Four states exist, and each one permits something different.
- p=none. Monitoring only. Receivers deliver mail that fails authentication and send you an aggregate report instead. This is the state a security scan reports as DMARC policy not enabled.
- p=quarantine. Suspicious mail goes to the spam or junk folder. A recipient can still dig it out, so a configuration mistake does not silently destroy a real order.
- p=reject. Receivers refuse the message outright. This is what people mean by DMARC enforcement, and it is the only state that blocks someone sending as your domain.
- No record at all. No policy, no reports, no visibility. Red Sift found 10.5 percent of 5,000 US domains publish no DMARC record whatsoever.
Write the answer down with the date you checked. That one line is the whole audit. If it reads p=none, the rest of this article is about your domain.
Why was p=none only ever meant to be temporary?
p=none was designed as a measurement phase with an end date, and the standard puts about a month on it. RFC 9989 tells a domain owner heading for enforcement to start by publishing p=none for at least a month, followed by publishing p=quarantine for a comparable period, then compare what happened to the mail. One month to monitor. One month to quarantine. Then reject.
Government practice sets the same expectation at a slower pace. CISA's Binding Operational Directive 18-01, issued in October 2017, gave federal agencies 90 days to publish p=none and one year to set a DMARC policy of reject. One year, from a standing start, across thousands of federal domains.
So the honest reading of your record is a question about elapsed time, not technology. Three months at p=none is a project in progress. Three years at p=none is a project somebody abandoned and nobody told you. Ask when it was set.
Being stuck there is normal. Red Sift measured 5,000 US domains in mid-2026 and found 29.1 percent at p=none against 38.4 percent at p=reject. Valimail reported in February 2026 that enforcement has plateaued at just 42 percent of domains, a 36-point gap behind the share that publish a record at all. Normal is not the same as safe.
Does passing Google and Yahoo's bulk sender rules mean you are protected?
No. Both sets of bulk sender requirements accept p=none as the minimum, so passing them proves your email deliverability is compliant and proves nothing about whether forged mail gets blocked. Google requires DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, then states plainly that your DMARC enforcement policy can be set to none. Yahoo asks bulk senders to publish a valid DMARC policy with at least p=none.
That allowance explains why so many records stop there. The rules took effect in February 2024, and the fastest compliant setup was SPF, DKIM and a DMARC record at p=none. A deliverability ticket that reaches p=none is finished. A security project that reaches p=none has barely started. One record satisfies both, so the ticket closes and the security half never gets scheduled.
Delivery is real money, which is why it got done. Google reports that the number of unauthenticated messages Gmail users receive fell by 75 percent once it began requiring authentication, and it asks bulk senders to keep spam rates below 0.30 percent. When your own quotes and invoices fail to authenticate, they land in spam and somebody chases a payment nobody read. Security was the half nobody finished.
What does DMARC not stop, even at p=reject?
DMARC at p=reject stops mail that forges your domain in the From address, and it stops nothing else. Three attacks survive full enforcement.
- Display-name impersonation. The attacker types your CEO's name into the display field and sends from any mailbox at all. RFC 9989 states that such attacks, known as display name attacks, are out of scope for DMARC.
- Look-alike domains. A message from a domain that merely resembles yours passes its own authentication perfectly, because your DMARC record and your subdomain policy govern your domain only.
- A compromised mailbox. Mail sent from inside your tenant with a stolen password authenticates and aligns correctly. It is genuine mail carrying a fraudulent instruction.
That is why business email compromise stays expensive while authentication spreads. The FBI's Internet Crime Complaint Center recorded $55,499,915,582 in exposed losses across 305,033 BEC incidents between October 2013 and December 2023. Enforcement removes one route in. The control that catches the rest is a dual approval rule on any change to bank details, run by a human who dials a number from the file, not from the email.
One further limit keeps you honest. RFC 9989 tells receivers they MUST NOT reject incoming messages solely on the basis of a p=reject policy. Your policy is a strong request, not a guarantee. Nobody can promise absolute protection here, and a provider who does is selling you something.
What should you ask your IT provider this week?
Ask six questions, write down the answers, and put a date beside each one. None of them needs you to understand DNS, so a non-technical owner can run the whole check in four minutes.
- Read me the p= value in our DMARC record today, out loud.
- Name the date it was set, and who set it.
- Show me last month's aggregate report, and how many sending sources failed.
- List every system that sends mail as our domain, including payroll, invoicing and the CRM.
- Commit to a date for p=quarantine, in writing.
- Confirm our subdomain policy, and that domains we no longer use cannot send mail.
A strong answer is measurable. It contains a date and a number. A weak answer names a product, says DMARC is configured, or calls enforcement risky without naming the risk or the date the caution ends. Red Sift found 22 percent of 5,000 US domains already at p=quarantine, so the middle step is well-trodden rather than exotic. If nobody can read you the p= value inside a minute, nobody has opened that record since it was created.
Why do DMARC projects stall at p=none?
DMARC projects stall because enforcement needs a complete inventory of everything that sends mail in your name, and almost nobody owns that list. Alignment is the rule that makes the inventory unavoidable. For a message to pass, the domain a reader sees in the From address has to align with the domain that passed SPF or DKIM, and strict alignment demands an exact match. Every tool that sends on your behalf must authenticate properly, or legitimate mail starts failing the moment you enforce.
The list runs longer than people expect. Payroll, invoicing, the CRM, the booking system, e-signature and the marketing platform all send as you. Miss one and the first thing p=reject blocks is your own payroll notice. A careful provider therefore moves to quarantine first, and that instinct is correct. Caution with a date on it is judgement. Caution with no date is drift.
Two details are worth holding a provider to. Aggregate reports are the data that drives the decision, and RFC 9989 says they exist to help an owner determine whether and when to transition from Monitoring Mode. A forensic report, which carries individual failed messages, is rarely sent at all for privacy reasons, so its absence is no reason to wait. And if you are told the domain is at p=reject with a percentage tag limiting how much mail it covers, look again. RFC 9989 removed the pct tag because it was usually not accurately applied, replacing it with a simple test flag. Partial enforcement is not enforcement, and the tag it leans on has left the standard.
None of this is work you do. It is work you verify, on a date you set. Read Email Security Best Practices next, then Business Email Security for what a filtering and authentication service should cover.
FAQ
What does p=none mean in a DMARC record?
p=none means monitoring only. RFC 9989 defines it as a state in which the Domain Owner offers no expression of preference, so receiving servers deliver mail that fails authentication anyway and send you an aggregate report instead. Your record is published and valid. It blocks nothing.
Is p=none better than having no DMARC record at all?
Yes, slightly. p=none returns aggregate reports showing who sends mail as your domain, which is the data you need to reach enforcement. Red Sift found 10.5 percent of 5,000 US domains publish no DMARC record at all. Visibility beats blindness, and neither state stops a spoofed invoice.
How do you fix a DMARC policy not enabled warning?
To fix a DMARC policy not enabled warning, move the record from p=none to p=quarantine, then to p=reject once aggregate reports show every legitimate sender passing. RFC 9989 suggests at least a month at p=none and a comparable period at quarantine. Ask your provider for the date, not the theory.
Should you go straight to p=reject?
No. Move to p=quarantine first. Jumping to reject before every sending system authenticates correctly blocks your own payroll and invoicing mail. RFC 9989 warns that p=reject can cause interoperability problems to indirect message flows such as mailing lists. Quarantine sends failures to spam rather than deleting them.
What is the difference between DMARC, SPF and DKIM?
SPF lists which servers may send mail for your domain. DKIM signs each message so a receiver can verify it was not altered. DMARC ties both to the From address a reader sees and tells receivers what to do when neither aligns. Google requires all three from bulk senders.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, paid placement is always labelled, and we do not sell IT services. Take the six questions above to three merit-ranked providers in your city and compare the answers side by side.