What does p=none actually do?

Nothing, to the mail itself. Receivers evaluate DMARC and send you reports, but deliver failing messages exactly as they would with no DMARC record at all. It is the correct place to start, and it only becomes useful once you read the reports and move to quarantine or reject.

Do I need a DMARC record?

Google, Yahoo and Microsoft require bulk senders to publish at least p=none, and enforcement is active. Beyond that requirement, without DMARC you have no visibility into who is sending mail using your domain and no way to tell receivers what to do about forgeries.

Why am I not receiving DMARC reports?

Either the record has no rua tag, or the reporting address is at a different domain that has not published an authorisation record. In the second case the DMARC record looks perfectly valid, which is why it is so easy to miss.

Free toolDMARC

DMARC record checker

Look up and validate a domain's DMARC record, read back what its policy actually does, and see what is needed to move to enforcement.

Run the checkFree · no account

Problems this finds

Your instructions for fake emails only cover some of them: Receivers apply your instructions to only a share of fake emails. That's normal while testing. Once you're confident, covering all of them finishes the job.
Fake emails pretending to be you are still delivered: Your instructions for fake emails are set to watch only. That's the right first step, but fakes in your name still get through. Once your real emails are confirmed to pass, you can tell receivers to block fakes.
Your instructions for fake emails have a typo: Receivers can't read them, so they may throw them out entirely. Fake emails in your name then aren't blocked, even though your settings look like they should be.
You're not getting reports on who sends email as you: Without reports you can't see which services send in your name, or know when it's safe to start blocking fakes. Adding an address for reports doesn't change how your email is delivered.
Your instructions for fake emails use the standard matching setting: Emails from variations of your address, like news.yourbusiness.com, count as yours. This is the default and suits most businesses. Nothing to do.
Your reports are going somewhere that hasn't agreed to accept them: Your reports are addressed to another domain that hasn't confirmed it accepts them, so receivers quietly don't send them. The fix is made on that other domain; if it's a reporting service, ask them.
Your instructions for fake emails are being ignored: You have two sets of instructions where only one is allowed, so receivers ignore both. Any protection you set up is effectively switched off, and your reports stop arriving.
Nothing tells receivers to block fake emails pretending to be you: Without instructions for fake emails, scammers can email your customers in your name with nothing from you standing in the way, and you get no reports showing who is sending as you.
Fakes from addresses like billing.yourbusiness.com aren't blocked: Your main address is protected, but variations of it have weaker instructions. Scammers can invent one (it doesn't need to exist) and use it to send fake emails in your name.

Common questions

What does p=none actually do?: Nothing, to the mail itself. Receivers evaluate DMARC and send you reports, but deliver failing messages exactly as they would with no DMARC record at all. It is the correct place to start, and it only becomes useful once you read the reports and move to quarantine or reject.
Do I need a DMARC record?: Google, Yahoo and Microsoft require bulk senders to publish at least p=none, and enforcement is active. Beyond that requirement, without DMARC you have no visibility into who is sending mail using your domain and no way to tell receivers what to do about forgeries.
Why am I not receiving DMARC reports?: Either the record has no rua tag, or the reporting address is at a different domain that has not published an authorisation record. In the second case the DMARC record looks perfectly valid, which is why it is so easy to miss.