Why p=none is not protection
A DMARC record with p=none tells receivers to take no action on mail that fails — it only sends you reports. Spoofed mail still reaches inboxes. Monitoring is a useful first stage, but it is not the goal.
Real protection begins at p=quarantine and p=reject, where receivers actually withhold or block forged mail.
Before you enforce
Enforcement blocks any mail that fails DMARC — including your own, if a legitimate sender is not set up correctly. So first make sure every real sender passes SPF or DKIM in alignment with your domain.
Use your aggregate reports for a few weeks to build a complete inventory of who sends as you: your mailbox provider, marketing platform, CRM, invoicing tool, help desk, and so on. Each must be authenticated before you tighten the policy.
The staged rollout
Move in steps, watching reports at each stage:
- Publish p=none with a rua address and collect reports for 2–4 weeks.
- Fix every legitimate sender until it passes SPF or DKIM with alignment.
- Move to p=quarantine, optionally with pct=25 to apply it to a fraction of mail first.
- Raise the percentage to pct=100, then drop pct entirely.
- Switch to p=reject once quarantine shows no legitimate mail failing.
Common breakage and fixes
Third-party senders that are not aligned are the usual culprit. Add the provider's SPF include, set up custom DKIM signing with them, or send their mail from a dedicated subdomain with its own policy.
Forwarding breaks SPF because the forwarding server becomes the sender — but DKIM survives forwarding, which is exactly why DMARC accepts a pass from either. Making sure DKIM is solid protects you here.