auth.dmarc.none
DMARC Policy Is 'none'
What we check
We read the p= tag of the DMARC record. The policy tells receivers what to do with mail that fails authentication: none (monitor only), quarantine (treat as suspicious), or reject (refuse outright). This finding means the policy is p=none.
What this finding means
A DMARC record exists, but its policy is none. Under RFC 7489, none requests no action against failing mail — receivers deliver it normally and simply report on it. You get visibility, but no enforcement: a forgery of your domain still lands in the inbox.
p=none is the correct starting policy. Its purpose is to collect aggregate reports so you can find every legitimate sender before you tighten. Left in place indefinitely, it protects nothing.
Why it matters
- No spoofing protection. With
p=none, receivers take no action on mail that fails DMARC — phishing that spoofs your domain is delivered like any other message. - Reporting only. The value of
p=noneis theruareport stream, not enforcement. It's a diagnostic stage, not a destination. - Deliverability pressure. Major providers increasingly expect enforced DMARC. A stalled
p=noneleaves that benefit on the table.
How to fix
Use the reporting window to inventory senders. With
rua=set, review the aggregate reports and confirm every legitimate source passes SPF or DKIM alignment.Advance to
quarantine, thenrejectonce your legitimate mail is aligned:_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"Then, when quarantine is clean:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
How it's graded
p=none sets the Authentication category's DMARC-policy baseline to 59 before other deductions — reflecting an effective monitoring-only posture. Moving to quarantine raises the baseline to 89, and reject to 100. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
^^^^ monitoring only — no enforcement against failing mail