DMARC policy is p=none (monitor only)

HighConfirmedemail.dmarc.policy-none

What this check looks for

Your domain publishes a DMARC record, but it tells receivers to take no action on messages that fail authentication. Anyone can still send email pretending to be you.

Why it matters

p=none is a monitoring stage, not protection. Until you move to quarantine or reject, spoofed mail using your domain still lands in inboxes.

When the check passes, your report says: “DMARC is enforcing, so spoofed mail is quarantined or rejected”.

What it costs your score

When this check fails it removes 15 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity: high
Default confidence: confirmed
Status when triggered: fail
Deduction: 15 points
Family cap: email-auth.dmarc · 40
Category: Email authentication
Module: Email dmarc
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Move to p=quarantine, then p=reject once reports are clean.

Without enforcement, spoofed mail from your domain is delivered; BIMI also requires quarantine or reject.

Confirm all legitimate senders pass SPF or DKIM with alignment — check the rua reports for two to four weeks.
Publish the quarantine record at _dmarc.‹domain›. Expect the change to affect delivery: any sender still failing alignment will start being quarantined.
After two weeks with no legitimate failures, change p=quarantine to p=reject.

How to confirm it worked

dig +short TXT _dmarc.‹domain› — expect p=quarantine or p=reject
Send a message from each of your sending systems to an external mailbox and confirm it still reaches the inbox.
Use "Test again" on this finding.

The configuration to publish

v=DMARC1; p=quarantine; rua=mailto:{{ruaAddress}}

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Generic DNS

_dmarc.‹domain›. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:‹rua address›"

Cloudflare

DNS → Records → Edit the TXT record named _dmarc → Content: v=DMARC1; p=quarantine; rua=mailto:‹rua address›

Do not add a pct tag: RFC 9989 removed it (Appendix A.6), and the omitted-tag behaviour is full application of the policy. Rollback is editing this one TXT record back to p=none; it takes effect within the TTL.
Cloudflare's dashboard only — if ‹domain› is not on Cloudflare DNS, use the generic zone-file form.

Technical detail

The _dmarc.‹domain› TXT record sets p=none. Receivers will deliver failing mail normally and only send aggregate reports, if rua= is present. Per RFC 9989 §4.7, p=none requests no specific action and exists as the monitoring phase before quarantine and reject. BIMI additionally requires an enforcing policy, so a logo in the inbox is not available while you stay here.