Mail Health Report

What does DMARC p=none mean?

p=none is DMARC’s monitor-only mode. Inboxes check your email and send you reports, but deliver fake messages that use your domain anyway. It’s the right place to start and the wrong place to stay.

Last reviewed 7 October 2026

What p=none does

  • Turns on reporting. With a rua= address, inboxes such as Gmail and Microsoft send daily reports listing every server that sent email using your domain, and whether it passed SPF and DKIM.
  • Meets the minimum sender requirements of Gmail, Yahoo and Outlook.com, which ask for a DMARC record of at least p=none.
  • Changes nothing about delivery. Nothing is blocked, so it can’t break your email.

What p=none doesn’t do

It doesn’t protect you. A fraudster can still send email that appears to come from your domain, such as a fake invoice to a customer or a password reset to a colleague, and inboxes will deliver it, because your policy says to take no action. Many domains sit on p=none for years in the belief that they’re protected.

How long to stay on p=none

Usually two to four weeks: long enough to collect reports covering your normal email, including monthly invoices and newsletters. You’re ready to move on when the reports show every legitimate service passing SPF or DKIM with your domain.

Why domains get stuck

  • No report address, so there’s nothing to learn from. Add rua=mailto: with a mailbox you read, or a DMARC report service.
  • Reports are hard to read. They arrive as XML. A report service turns them into a readable list.
  • Fear of blocking real email. Moving gradually removes the risk: quarantine a small percentage first.
  • Sending services not set up. Newsletter tools and CRMs often fail until you set up domain authentication.

Moving to quarantine and reject

  1. v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourdomain.com: a quarter of failing email goes to spam.
  2. Raise pct to 50, then 100, over a few weeks while watching reports.
  3. v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com: fake email using your domain is refused.

Make sure DKIM is set up first: forwarded email usually fails SPF, and DKIM is what keeps it passing. The DMARC record builder writes each stage’s record, and the none-to-reject guide covers the full plan.

Check your current policy with the DMARC checker.

Is p=none bad?

No. It’s the correct first step. It only becomes a problem when a domain stays on it indefinitely, because it gives no protection against spoofing.

Does p=none affect deliverability?

Having a DMARC record, even at p=none, helps: Gmail, Yahoo and Microsoft require one from bulk senders. The policy itself doesn’t block or junk anything.

Can I go straight to p=reject?

Only if you’re certain every service that sends email using your domain passes SPF or DKIM with alignment. Otherwise you risk blocking your own invoices, newsletters or system emails.

What does sp=none mean?

It sets a monitor-only policy for subdomains, even when your main policy is stricter. Leave sp out unless you need different rules for subdomains.