DMARC Is Set to ‘None’. So What? (More Than You Think)
DMARC tends to get added to a to-do list, implemented at the basic level, and then forgotten about. Someone adds a DMARC record with p=none, and that box gets ticked. Here’s the problem: p=none doesn’t protect you from anything.
What p=none Actually Does
A DMARC record of p=none tells receiving mail servers: “Check whether my emails pass authentication, and send me reports, but don’t do anything with emails that fail.” This is monitoring mode. It’s the right place to start, but it is only the starting point.
With p=none, if an attacker sends an email using your domain name, that email will be delivered just as if it came from you.
Why Organisations Stay at p=none Forever
- •Reports are difficult to interpret without tooling: raw XML is not user-friendly
- •Moving to enforcement feels risky: fear of breaking legitimate email
- •Nobody owns the process: implementation starts with energy and stalls
The Risk of Staying at p=none
Your domain can be spoofed by anyone. Domain spoofing is the primary enabler of Business Email Compromise attacks. The reputational risk is equally real. Attackers spoofing your domain can degrade your sending reputation, causing legitimate emails to land in spam.
Moving to Enforcement
- •Review DMARC aggregate reports to identify all legitimate sending sources
- •Ensure all senders are in your SPF record with DKIM properly configured
- •Move to p=quarantine first, monitor for legitimate email failures
- •Progress to p=reject once confident
- •Set a sensible subdomain policy (sp=)
The full journey from p=none to p=reject is achievable for most organisations within a few weeks of focused effort.