DMARC none to reject with MailAuth Doctor
Check your domain to see your current DMARC policy, then read your reports and move to enforcement in steps. p=none is a monitoring stage, not a finish line.
- Publish p=none with a rua address and collect reports for a few weeks.
- Read the reports and fix every legitimate sender that fails alignment.
- Move to p=quarantine with a low pct, such as 10, and raise it in steps.
- Move to p=reject once reports are clean, and keep reading them.
What to know
p=none asks receivers to take no action on mail that fails DMARC. It is the right start because it lets you find every service that sends as your domain, but it does not stop spoofing. Many domains stay on it for years because nobody finishes the steps.
The ramp is: collect reports; fix senders until the legitimate ones pass and align; set p=quarantine with pct=10 and watch for complaints; raise pct to 25, 50 and 100 over weeks; then p=reject. pct applies the policy to that share of failing mail only, so it limits the damage of a missed sender. Every step should be driven by the reports, which is why the rua address matters.
Subdomains inherit the policy unless you set sp. If a subdomain should never send mail, sp=reject protects it. Mailbox providers, Google included, ask bulk senders to publish DMARC, and Google states that the policy may be none, so enforcement is your decision for protection against spoofing rather than a delivery prerequisite.
Updated · Cosmovex
Questions
How long should I stay on DMARC p=none?
Until your reports show every legitimate sender passes and aligns, usually a few weeks to a few months. Staying there indefinitely gives no protection.
What does pct do in DMARC?
It applies the policy to only that percentage of failing messages, which lets you ramp up enforcement gradually.
Will p=reject break my email?
It can if a legitimate sender fails DMARC. That is why you read reports and fix senders first, and ramp with quarantine and pct.
Does Google require p=reject?
No. Google's sender guidelines for bulk senders require DMARC to be set up and say the enforcement policy can be none.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
