auth.dmarc.none

DMARC Policy Is 'none'

What we check

We read the p= tag of the DMARC record. The policy tells receivers what to do with mail that fails authentication: none (monitor only), quarantine (treat as suspicious), or reject (refuse outright). This finding means the policy is p=none.

What this finding means

A DMARC record exists, but its policy is none. Under RFC 7489, none requests no action against failing mail — receivers deliver it normally and simply report on it. You get visibility, but no enforcement: a forgery of your domain still lands in the inbox.

p=none is the correct starting policy. Its purpose is to collect aggregate reports so you can find every legitimate sender before you tighten. Left in place indefinitely, it protects nothing.

Why it matters

How to fix

  1. Use the reporting window to inventory senders. With rua= set, review the aggregate reports and confirm every legitimate source passes SPF or DKIM alignment.

  2. Advance to quarantine, then reject once your legitimate mail is aligned:

    _dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
    

    Then, when quarantine is clean:

    _dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
    

How it's graded

p=none sets the Authentication category's DMARC-policy baseline to 59 before other deductions — reflecting an effective monitoring-only posture. Moving to quarantine raises the baseline to 89, and reject to 100. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
            ^^^^ monitoring only — no enforcement against failing mail

Provider guides

References