Skip to content
Webmaster Tools
EmailEmail DeliverabilityDMARC p=none

DMARC p=none

What a DMARC policy of p=none means, what it does and doesn't protect, how to read the reports it brings, and when to move on to quarantine or reject.

What p=none means

p=none is the DMARC monitoring policy. It tells receivers: check SPF and DKIM alignment for mail that claims to come from this domain, send me reports, but deliver failing mail as you normally would. It gives you visibility, not protection. Anyone can still spoof your domain, and receivers won't treat that mail any differently because of your policy.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

DMARC is defined in RFC 7489. The record always lives at _dmarc. plus the domain in the visible From address. See the DMARC record page for every tag.

What you see in the headers

A receiver records the DMARC result and the policy it found in the Authentication-Results header. Gmail writes it like this:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=s1;
       spf=pass smtp.mailfrom=bounce.example.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com

dis=NONE is the disposition the receiver applied. With p=none it stays NONE even when the result is dmarc=fail. Paste a full header block into the Email Header Analyzer to see each result explained.

Why start with p=none

Most domains send mail from more places than anyone remembers: the main mailbox provider, a newsletter tool, a CRM, a helpdesk, invoices from the billing system, a website contact form. Going straight to p=reject would bounce whatever isn't set up correctly yet. With p=none and a rua address you get daily aggregate reports (XML) from large receivers listing every IP that sent as your domain and whether SPF and DKIM passed and aligned. You fix the gaps first, then tighten the policy.

Gmail and Yahoo require bulk senders to publish a DMARC record, and p=none meets that minimum. See Gmail and Yahoo sender requirements.

What p=none does not do

  • It doesn't stop spoofing or phishing that uses your exact domain.
  • It doesn't fix anything by itself. Mail that fails DMARC is just as likely to land in spam as it was without the record.
  • It doesn't trigger BIMI. Brand logos in the inbox need p=quarantine or p=reject.

Reading the reports

Aggregate reports are hard to read raw, so most people send them to a report service or parse them with a script. For each source in the report, ask:

Source is SPF / DKIM aligned Action
Yours Both pass Nothing to do
Yours Fails Add it to SPF or turn on DKIM signing with your domain
Unknown Fails Likely spoofing or a forgotten service; investigate

The DMARC alignment page explains why a pass can still fail DMARC.

Moving on

When every legitimate source passes for a couple of weeks of reports, move to p=quarantine, optionally with pct= to start with a fraction of failing mail, and then to p=reject. Keep the rua address the whole time.

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

Don't stay on p=none for years. It is meant as a stage, not a destination.

Check your current record with the DMARC Checker, or check SPF, DKIM and DMARC together in the Email Checker.