What does DMARC p=none mean, and when should you change it?
A DMARC record tells receiving mail servers what to do with a message that claims to come from your domain but fails SPF and DKIM. The first stage is p=none. This article explains what it means and when you should change it.
The three policies
- p=none: Monitoring only. Receivers take no action on failing mail. You still get reports.
- p=quarantine: Failing mail is treated as suspicious and usually goes to spam.
- p=reject: Failing mail is rejected.
A record that only monitors looks like this:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
You can create the record with the DMARC generator.
Why start with p=none
With p=none you can see who sends email as your domain: your own servers, your newsletter tool, your help desk, and possibly forged mail. The reports (rua) show this. A stricter policy could block legitimate mail that you did not know about.
When to change it
Move to p=quarantine when all legitimate sources pass SPF or DKIM in the reports, you have checked the reports for a few weeks, and you know which sources you do not control. Move on to p=reject only after another period of checks. The steps are explained in SPF, DKIM and DMARC explained.
The pct tag
The pct tag sets the share of failing mail the policy applies to. Use it to test a stricter policy on part of your mail first. Without the tag the policy applies to all mail (100 percent). The tag only matters for quarantine and reject, not for p=none. A draft revision of the standard replaces pct with a t= tag, so check the current standard before you rely on either.