DMARC at p=none: how to move to quarantine and reject

What it means

The DMARC record says p=none. Receivers send you reports, but email that fails DMARC, including forgeries of your From address, is delivered as if there were no policy. It's the right place to start and the wrong place to stay: the protection only begins at quarantine (treat failures as suspicious, usually the spam folder) and is complete at reject (refuse them).

And pct below 100

pct= applies the policy to only part of the failing email. Under section 6.6.4 of RFC 7489, the rest gets the next policy down: reject becomes quarantine, quarantine becomes none. It's useful for a cautious first step, but a domain left at pct=10 lets nine in ten forgeries through.

How to confirm it

How to fix it

1. Make sure reports are arriving (see rua=) and give them two weeks or more, to include monthly senders such as invoicing systems.
2. List every source. For each genuine one, set up DKIM signing with your own domain, and SPF with a return path on your domain. Either one passing and aligned is enough for DMARC.
3. When every known source is passing, change the record to p=quarantine. Optionally use pct=25, then 50, then 100 over a couple of weeks.
4. After a few clean weeks at quarantine, change it to p=reject.

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

The email test is a quick way to check a single sender before you tighten the policy: send one message and see whether SPF and DKIM pass and line up with the From address.