What p=none really means and why it protects nobody

You publish a DMARC record. You check it with a tool, the tool says DMARC is present, and you move on. Somewhere in that record is a tag called p=, and for most small businesses it reads p=none. That single word is doing almost nothing, and it is worth ten minutes to understand why.

What the p= tag actually says

A DMARC record is a short line of text published in your domain's DNS. It has several parts, but the one that matters most is the policy tag, written as p=. It has exactly three possible values:

• p=none, do nothing to the message. Deliver it as if DMARC did not exist.
• p=quarantine, treat a failing message with suspicion, usually by sending it to spam.
• p=reject, refuse the message outright. It never reaches an inbox, not even a spam folder.

That's the whole idea. The tag is an instruction to every mail server in the world that receives mail claiming to be from your domain: here is what to do if a message fails our checks.

p=none gives that instruction, and the instruction is "do nothing."

Why none doesn't stop anything

Say someone sends a forged email claiming to be from yourcompany.com. It doesn't have valid SPF or DKIM, because the sender doesn't control your domain. The receiving mail server checks your DMARC record, sees p=none, and delivers the message anyway. Whatever happens next, spam folder or inbox, is decided by that receiver's own spam filtering, not by anything you published.

This is the part that catches business owners off guard. They assume that having a DMARC record at all is the protection. It isn't. A record with p=none is a monitoring instruction, not a defence. It asks receiving servers to tell you about failures. It does not ask them to act on those failures.

Google, Yahoo and Microsoft's 2024 sender requirements made SPF, DKIM and a published DMARC record mandatory for anyone sending more than 5,000 messages a day. A record set to p=none satisfies that requirement on paper. It does not stop anyone from impersonating your domain, and it does not protect your customers from a fake invoice that looks like it came from you.

Research from EasyDMARC's 2026 adoption report, which tracked 1.8 million domains along with the Inc. 5000, found that more than half of Inc. 5000 companies are still sitting at p=none (EasyDMARC, 2026 DMARC Adoption & Enforcement Report). These are fast-growing, well-funded companies, not neglected small shops. Publishing the record is the easy part. Moving past p=none is the part almost everyone skips.

The report you're generating but not reading

Here's the useful part of p=none. Every day, mail providers that receive messages claiming to be from your domain send you a report: how many messages passed, how many failed, and where the failing ones came from. That report is the entire point of starting at p=none. It's a safe way to see what's actually happening before you ask receivers to start rejecting mail.

The problem is that almost nobody reads these reports. They arrive as zipped XML files, addressed to an inbox nobody checks, in a format nobody was ever taught to open. If you've never seen one of your own, I've written a separate guide on reading a DMARC report without buying any software. It takes about ten minutes once you know where to look.

Skipping this step is why so many domains stay at p=none indefinitely. Nobody looks at the reports, so nobody finds out whether moving to enforcement would be safe, so the record sits at "do nothing" forever, quietly satisfying a checklist while protecting no one.

Moving from none to quarantine safely

You do not go straight from p=none to p=reject. That's how a business finds out, the hard way, that its own invoicing tool or a marketing platform it forgot about was never properly authenticated, and now that mail is being blocked too.

The sequence that actually works:

1. Publish p=none and let reports collect for two to four weeks.
2. Read the reports. Identify every source sending mail as your domain: your own mail provider, your invoicing software, your CRM, your marketing tool, anything.
3. Confirm each legitimate source is passing SPF or DKIM. Fix the ones that aren't.
4. Once every legitimate source passes cleanly, move to p=quarantine with a low percentage, using the pct= tag to apply the policy to only a fraction of mail at first.
5. Watch reports for another few weeks. If nothing legitimate is being caught, raise the percentage to 100, then move to p=reject.

This is slow by design. The slowness is what prevents you from blocking your own mail.

What reject actually buys you

At p=reject, a forged message claiming to be from your domain doesn't just get filtered into someone's spam folder, where a curious employee might still open it. It gets refused before it's delivered anywhere. That's the difference between a policy that reports on impersonation and one that stops it.

This matters most for the exact scenario that costs small businesses money: someone forges an invoice from your domain, changes the bank details, and sends it to a client who has paid you before and trusts your name. If your domain is at p=reject, that forged invoice cannot reach the client's inbox at all, because their mail server refuses it on your instruction before delivery.

At p=none, the same forged invoice sails through, and the only thing standing between your client and a fraudulent payment is whatever spam filtering their provider happens to apply that day.

What to do next

Look up your own domain's DMARC record and find the p= value. If it says none, you are in the monitoring stage, which is fine as a starting point but not as a permanent state. Pull your reports, check who's actually sending mail as your domain, fix anything that fails, and start moving the percentage up. If you've never pulled a report before, or you're not sure your record exists at all, run the free checker on this site first. It will tell you exactly what's published for your domain right now, including that p= value, in under a minute.