What DMARC p=none does
DMARC p=none is a non-enforcement policy. When aggregate reporting is configured, it can be used to monitor authentication. The domain owner expresses no requested handling preference for messages that fail DMARC.
That makes p=none a useful deployment stage, not an enforcement policy. Moving safely requires report data, a complete sender inventory and confidence that legitimate streams pass aligned SPF or DKIM.
Why domains stay on p=none
Initial DMARC rollout
Teams commonly start with p=none to observe legitimate and unauthorized mail streams.
Unknown third-party senders
Marketing, support, billing and other tools may not yet pass aligned authentication.
Reports are not reviewed
A policy can remain in monitoring indefinitely when aggregate data has no owner or workflow.
Alignment gaps remain
SPF or DKIM may pass independently while neither authenticated domain aligns with the visible From domain.
How to move toward enforcement
- Confirm the record has a working rua destination and that aggregate reports are being processed.
- Inventory every legitimate source using the domain in its visible From address.
- Fix SPF or DKIM alignment for each legitimate stream before requesting stricter treatment.
- Review indirect flows and operational risks rather than moving directly to reject.
- Change policy deliberately, monitor receiver data and keep a rollback plan for legitimate mail failures.
FAQ
It does not ask receivers to quarantine or reject mail solely because it fails DMARC. Receivers can still apply their own filtering decisions.
Yes. It is a valid non-enforcement policy and is commonly used with aggregate reporting while authentication issues are being corrected.
No. Enforcement should follow analysis of legitimate senders, alignment and indirect mail flows. A rushed change can reject valid mail.