Fix DMARC Policy Stuck at p=none (No Enforcement)

What's happening

DMARC's p= tag controls receiver behavior on authentication failure. p=none tells receivers to take no action — just report. p=quarantine tells receivers to route failing mail to spam. p=reject tells receivers to bounce failing mail outright. RFC 7489 Section 6.3 defines all three.

Many domains publish v=DMARC1; p=none; rua=... and never advance from monitoring to enforcement. Aggregate reports flow in, but spoofed mail still reaches recipients because no receiver acts on the failures. The domain is monitored but unprotected.

Google's February 2024 bulk-sender requirements specify p=none as the minimum; Yahoo agrees. But best practice — and most enterprise security policies — require enforcement (quarantine or reject) for meaningful brand-impersonation protection. p=none alone is insufficient against active phishing.

Why it matters

Phishing succeeds. With p=none, a spoofed message sent from an attacker's server passes through receivers and lands in customer or partner inboxes. The attacker harvests credentials or initiates wire-fraud, and the only signal you have is the aggregate report 24 hours later.

Brand reputation suffers when customers receive phishing in your name and lose money. The reputational damage outlasts the phishing campaign itself, and large customers may demand DMARC enforcement before continuing to do business.

Procurement and compliance reviews fail. SOC 2, ISO 27001, and CISO-led security questionnaires increasingly require p=quarantine or p=reject as a control. p=none is a finding.

Common causes

• Initial rollout to p=none was never followed up with enforcement.
• Operator team lost confidence after seeing legitimate mail in DMARC failure reports.
• Multiple ESPs make alignment complex and the team postponed enforcement indefinitely.
• No DMARC report parser is in place, so the team cannot confidently advance.
• Concerns about subdomain mail (corporate notifications from internal apps) blocking enforcement on the apex.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Confirm aggregate reports show clean authentication

   Open the last 14 days of DMARC reports. Every legitimate source IP must show spf=pass + dkim=pass + alignment. Any failures must be either misconfigured legitimate senders (fix them) or unauthorized senders (which you want to block).

2. 2

   Plan a staged rollout

   Move from p=none to p=quarantine; pct=10 first. Then quarantine pct=50. Then quarantine pct=100. Then p=reject; pct=100. Each step lasts two weeks under normal traffic. Faster only if you have very high volume and confidence in alignment.

3. 3

   Update the DMARC record at TTL 300

   Lower the TTL on the _dmarc record to 300 seconds before the first ramp step. This lets you roll back within 5 minutes if reports show unexpected legitimate-mail impact. Raise TTL back to 3600 once at p=reject and stable.

4. 4

   Move to quarantine pct=10

   Update the record to v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@example.com; fo=1. Watch reports daily. The quarantined-message count should be small and entirely from senders you intend to block.

5. 5

   Ramp pct to 50 then 100

   Each two weeks, raise pct (10 → 50 → 100). At each step, verify with stakeholders (support, marketing, sales) that no legitimate mail is missing. Postmaster Tools and Microsoft SNDS should show stable reputation.

6. 6

   Move to p=reject

   Final step: v=DMARC1; p=reject; rua=mailto:dmarc@example.com; fo=1. Mail that fails DMARC is now rejected by every conforming receiver. Brand-impersonation defense is fully active. Enforce sp= (subdomain policy) explicitly to match.

7. 7

   Maintain ongoing monitoring

   Continue parsing aggregate reports weekly. New ESPs, internal apps, or vendor changes can introduce alignment failures that go silent under p=reject (mail bounces, customers complain, you scramble). Monthly dashboard review is the minimum sustainable cadence.

Example

; Step 1 — current state
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Step 2 — soft enforcement
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@example.com; fo=1"

; Final — full enforcement with explicit subdomain policy
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-fail@example.com; fo=1; adkim=r; aspf=r"

DMARC ramp from monitoring to full enforcement with explicit subdomain policy.

Related fixes