Dmarc policy none

What it is

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail authentication checks. A policy of p=none means "do nothing — just watch." It is a starting point for monitoring, not a finished protection. Until you move to p=quarantine or p=reject, anyone on the internet can send phishing or fraud emails that appear to come from your store's domain and mail servers will deliver them without question.

Why it matters

With p=none in place, criminals can impersonate your brand in phishing emails to your customers, suppliers, or staff — and those emails will land in inboxes rather than spam folders. A successful phishing campaign erodes customer trust, can trigger payment fraud chargebacks, and may expose you to legal liability. Google and Yahoo's 2024 bulk-sender requirements made a published DMARC policy a deliverability prerequisite, so staying at p=none also risks your legitimate marketing and transactional emails being filtered or rejected. Moving to p=reject is the only setting that fully closes the spoofing window.

How to fix it

1. Confirm your DMARC reporting address is set: your existing record should already contain rua=mailto:you@yourdomain.com so you receive aggregate reports. If not, add it before anything else.
2. Review at least two to four weeks of aggregate reports (XML files sent to your rua address, or parsed by a free tool like Google Postmaster Tools, dmarcian, or MXToolbox) to identify every source that sends mail on your domain's behalf — your ESP, transactional mail service, CRM, etc.
3. Ensure every legitimate sending source has valid SPF and DKIM alignment. Add any missing sources to your SPF record and confirm DKIM keys are published in DNS.
4. Change your DMARC record's p= value from none to quarantine (failed messages go to spam). Monitor reports for one to four weeks and verify no legitimate mail is failing.
5. Once reports confirm only spoofed/unknown senders are failing, change p=quarantine to p=reject (failed messages are outright blocked). This is the target end state.
6. Optionally tighten further by adding pct=100 (applies policy to 100% of failing mail, which is the default) and a forensic reporting address ruf= if your provider supports it.

; Step 1 – current state (monitor only — fix this)
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

; Step 2 – intermediate enforcement (quarantine)
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

; Step 3 – full enforcement (target state)
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com;

Fix it on your platform

Pick your platform for the exact steps.

Frequently asked questions

Authoritative references

• OWASP Top Ten — OWASP
• OWASP Cheat Sheet Series — OWASP