DMARC p=none: what to do next, and DMARC missing or invalid
DMARC policy high Email authentication · 15 of 100 points
What it inspects
The TXT record at _dmarc.<domain>; if none exists there, the record at the organisational domain (RFC 7489 section 6.6.3). In that fallback case the subdomain policy sp applies if present, otherwise p. Verdicts: PASS for p=quarantine or p=reject with pct absent or 100. WARN for p=none, for pct below 100, and for sp=none under a stricter p. FAIL when no DMARC record exists, when more than one is published, or when the syntax is invalid.
Why it matters
DMARC is what makes SPF and DKIM enforceable: it tells receivers what to do with mail that pretends to be you. With p=none, spoofed mail is delivered anyway. Large mailbox providers also expect bulk senders to publish DMARC.
How to verify by hand
# bash
dig +short TXT _dmarc.example.com
# PowerShell
Resolve-DnsName -Name _dmarc.example.com -Type TXT | Select-Object -ExpandProperty Strings
Expect a single record starting v=DMARC1; p=...How to fix
Publish one TXT record at _dmarc, starting at p=quarantine with rua reports. Read the reports, fix any legitimate sender that fails, then move to p=reject.
-
Publish a policy with reporting:
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" -
Review the aggregate reports and fix any legitimate sender that fails SPF and DKIM alignment.
-
Move to full enforcement:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Leave pct out (or set it to 100) and do not set sp=none.