Why a p=none DMARC policy gives a false sense of security

Why p=none is often misunderstood

Many organizations say they have DMARC in place. Technically that can be true, but with p=none your domain can still be spoofed at scale.

p=none tells receivers to monitor and report. It does not instruct them to quarantine or reject unauthenticated mail.

Today, p=none may satisfy the minimum DMARC requirement for some sender guidelines, but it should not be confused with protection. It gives visibility, not enforcement. For production domains, the goal should be a controlled path toward quarantine or reject once legitimate mail sources are aligned.

What p=none actually does

• Publishes a valid DMARC policy for visibility.
• Collects aggregate reports through rua.
• Leaves enforcement disabled.

Why domains stay on p=none

• Fear of breaking legitimate business mail.
• DMARC reports are hard to interpret without context.
• Many third-party senders create alignment complexity.
• Temporary monitoring becomes permanent by inertia.

Business impact of staying in monitoring mode

• Higher phishing and impersonation exposure.
• Brand trust erosion with customers and partners.
• Deliverability damage from abuse signals.
• Longer incident response due to noisy reporting.

How to move safely to enforcement

Enforcement should be phased and controlled: map all legitimate sources, align SPF and DKIM, move from monitoring to quarantine and then reject, and keep continuous monitoring in place.