Written by Venkat Nookala · Last updated 2026-07-23
Quick answer: p=none is DMARC's monitoring mode. It tells receivers to enforce nothing and, if you ask for them, to send you reports about who is sending as your domain. The problem is that most domains publish p=none and never ask for the reports, so they get neither protection nor information. In our scans, 44% of domains at p=none had no reporting address at all. If you are going to sit at p=none, you need rua=. If you already have it and have read the reports, you should be moving to enforcement.
A DMARC record tells receiving mail servers what to do when a message claiming to be from your domain fails authentication. It has three possible policies:
p=none - do nothing. Deliver the message as you would have anyway.p=quarantine - treat failures as suspicious. Usually the spam folder.p=reject - refuse failures outright.p=none exists for a reason. It is the safe starting point: you publish it, you collect reports on who is sending as you, you discover the legitimate senders you forgot about, you fix their authentication, and then you move to enforcement without breaking your own mail.
That is the intended path. Publish, observe, fix, enforce.
What actually happens is that most domains stop after the first step.
Reports do not arrive automatically. You have to ask for them, with a rua tag pointing at a mailbox you control:
v=DMARC1; p=none; rua=mailto:[email protected]Without rua, p=none does exactly nothing. Nothing is enforced, because that is what none means. And nothing is reported, because you never asked. The record is published, the checkbox is ticked, and no information exists anywhere.
Here is a real record from our scans, with the domain removed:
v=DMARC1; p=noneThat is the whole record. It enforces nothing and reports nothing. The domain has DMARC in the sense that a lookup returns a valid record, and in every practical sense it has nothing at all.
This is common. Across the domains we scanned that publish DMARC, 30 sit at p=none with no rua - that is 44% of all the p=none domains. Nearly half the people who took the "start with monitoring" advice are not monitoring.
We scanned 175 distinct external domains between April and July 2026 - ordinary business domains, mostly agencies and B2B companies actively sending email. That list of domains is fixed and kept on file, so every number here can be re-checked against exactly the same set.
| DMARC policy | Domains | Share |
|---|---|---|
| No DMARC record at all | 26 | 14.9% |
p=none (no enforcement) | 68 | 38.9% |
p=quarantine | 39 | 22.3% |
p=reject | 42 | 24.0% |
Only 46% have real enforcement. The other 54% either have no record or have one that enforces nothing.
Combine "no record" with "p=none and no reporting address" and you get the number that matters most:
56 of 175 domains, 32%, have neither enforcement nor visibility. No protection against spoofing, and no reports telling them it is happening. One in three.
Every one of those businesses is sending email under the 2026 Gmail and Microsoft sender rules, which expect DMARC to exist.
DMARC has a second policy tag, sp=, which controls what happens to your subdomains. If you do not set it, subdomains inherit your main policy - which is usually what you want.
But if you explicitly set sp=none while your main policy is stronger, you have created a hole. The root domain is protected. Every subdomain is wide open.
A real record from our scans:
v=DMARC1; p=quarantine; sp=none; pct=100;
rua=mailto:[redacted]; ruf=mailto:[redacted]; adkim=r; aspf=rThis domain quarantines failures on the main domain. And it explicitly tells receivers to do nothing about billing.theirdomain.com, login.theirdomain.com, or any other subdomain someone invents. An attacker does not need to spoof the protected domain. They just use a subdomain.
Six of the domains we scanned do exactly this - 7% of the domains that bothered to enforce at all. They did the work and then undercut it with one tag.
If you are enforcing, check your sp=. Either leave it out entirely so subdomains inherit your policy, or set it to match.
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100;
rua=mailto:[email protected]Reading it left to right: enforce by rejecting failures, apply the same to subdomains, use relaxed alignment for DKIM and SPF, apply to 100% of mail, and send aggregate reports here.
That is the destination. You should not start there.
1. Add rua if you do not have it. This is the single highest-value change if you are sitting at p=none. You cannot make a safe decision without data.
v=DMARC1; p=none; rua=mailto:[email protected]2. Read the reports for two to four weeks. They arrive as XML, usually daily, from each major receiver. They are hard to read raw - use a DMARC report parser, or paste one into a forensics tool. You are looking for one thing: which senders are sending as you, and which of them are failing authentication.
3. Fix your legitimate senders. The reports will surface tools you forgot about - an old CRM, a helpdesk, a billing platform. For each one that fails, publish the SPF include or DKIM key it needs. This is the step that takes the time, and skipping it is what breaks people's mail when they jump to enforcement.
4. Move to p=quarantine. Once your legitimate senders pass, quarantine failures. Watch for a week or two. If real mail starts landing in spam, something still is not aligned - go back to step 3.
5. Move to p=reject. Same check, one step further.
6. Set sp= to match, or leave it out. Do not enforce on the root and exempt your subdomains.
If you want to move slowly, pct= lets you apply the policy to a percentage of mail (pct=25 enforces on a quarter of it). It is a legitimate way to ease into enforcement.
DMARC records can carry adkim and aspf tags, which control how strictly the domain in your DKIM signature or SPF must match the domain in the visible From address. Relaxed (r, the default) allows subdomains to match. Strict (s) requires an exact match.
Strict alignment is rare. Of the domains we scanned that publish DMARC, about 9% explicitly set strict for either tag - the rest use relaxed, usually by leaving the tags out entirely.
This is an observation from reading the published records, not something our audit evaluates. Strict alignment tends to break mail sent through third-party services that cannot align exactly, which is likely why most domains leave it relaxed.
Our free audit reads your DMARC record and reports your policy, whether you have a reporting address, your subdomain policy, and what to publish to fix what is missing. It checks SPF, DKIM, MTA-STS and blacklist status at the same time.
No signup, no email required: audit.humerly.com
To check by hand:
dig +short TXT _dmarc.yourdomain.comIf nothing comes back, you have no DMARC record. If it comes back with p=none and no rua=, you are in the group this page is about.
Slightly, but only if it has a reporting address. p=none with rua gives you visibility, which is the whole point of the monitoring stage. p=none with no rua enforces nothing and reports nothing, which is close to having no record.
It can, if you move too early. Enforcement only rejects mail that fails authentication - so if a legitimate sender of yours is unauthenticated, its mail starts failing. That is why the reporting stage exists: find those senders first, fix them, then enforce.
Long enough to see a full cycle of your sending, usually two to four weeks. Longer than that is usually procrastination rather than caution, as long as you are actually reading the reports.
rua is aggregate reports: daily summaries of pass and fail counts by sender. That is the one you need. ruf is forensic reports, individual failed messages, which many receivers no longer send for privacy reasons. Start with rua.
Under the 2026 Gmail and Microsoft rules, bulk senders are expected to have it. But volume is not really the point. Without DMARC, anyone can send mail claiming to be your domain, and you will not know.
No. DMARC is an authentication policy, not a delivery guarantee. It stops others spoofing you and it is expected by the major receivers, but inbox placement depends on reputation, list quality and engagement as well. Nobody can honestly promise placement.