auth.dmarc.pct_partial

DMARC Policy Not Fully Enforced

What we check

We read the pct= tag, which controls the percentage of failing messages the declared policy actually applies to. Values below 100 mean part of your spoofed mail is treated as if the policy were none.

What this finding means

Your DMARC policy is set to quarantine or reject, but pct= is below 100 — so only that percentage of failing messages gets the enforcement action. The rest are handled as p=none: delivered and reported, not quarantined or rejected.

The pct= tag was designed as a gradual-rollout throttle (apply enforcement to 10%, then 50%, then 100%). It's meant to be a temporary step on the way to full enforcement, not a permanent setting.

Note: pct= was removed from DMARC by RFC 9989 (DMARCbis). Newer receivers apply the policy in full regardless of the value, while older ones still honour it — so a pct below 100 produces inconsistent enforcement across receivers.

Why it matters

Partial protection. At pct=50, half of the mail spoofing your domain still reaches inboxes at receivers that honour the tag.
Inconsistent across receivers. Because DMARCbis dropped pct, some receivers enforce fully and some partially — you can't predict which, which makes the real-world result hard to reason about.
A rollout artifact. A pct below 100 usually means a rollout that was started and never finished.

How to fix

Once monitoring confirms no legitimate mail is affected, raise pct= to 100 — or remove the tag entirely, since 100 is the default:
```
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
```
Don't rely on pct for new rollouts. Under DMARCbis it no longer works uniformly; stage enforcement by moving p=none → quarantine → reject instead.

How it's graded

A partially-enforced policy sets the Authentication baseline lower than a full one: a quarantine policy with pct below 100 baselines at 74 instead of 89. Raising pct to 100 (or removing it) restores the full-enforcement baseline. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com"
                         ^^^^^^ only 25% of failing mail is quarantined