Is p=none better than having no DMARC record?

Yes, but only because of the reports. It gives you visibility of who is sending as your domain, which is the information you need in order to enforce safely. It provides no protection in itself.

How long should I stay at p=none?

Long enough to see a full business cycle in the reports: typically two to four weeks, longer if you have monthly or quarterly processes that send mail. The measure is whether the reports have stopped surprising you, not the number of days elapsed.

Does p=none affect my deliverability?

Not directly, since receivers take no action on the result. Indirectly it can matter: some receivers view an enforcing DMARC policy as a positive signal, and bulk sender requirements at the major mailbox providers increasingly expect one.

Can I go straight from none to reject?

You can, and it is how legitimate mail gets rejected. Quarantine with a percentage tag exists so that mistakes surface as mail in a spam folder rather than as messages that were refused outright and never arrived.

MediumPolicy

DMARC policy is set to none

The DMARC policy is p=none, which asks receivers to take no action on mail that fails authentication. It produces reports and nothing else. Monitoring is the correct first stage of a DMARC rollout, but a record left at p=none provides no protection against someone sending mail that displays your domain in the From: address.

Check your own domainDMARC checker

What causes this

p=none is the monitoring mode. Receivers evaluate DMARC and send you reports, but they take no action when a message fails: it is delivered exactly as it would have been with no DMARC record at all. This is the correct starting point, and it is where a great many domains stop, because nothing visibly breaks and the next step requires confidence that every legitimate sender is authenticated.

What it breaks

You get visibility, but no protection. Mail forging your domain is not quarantined or rejected on the strength of your policy.

What the receiving server does

At p=none a receiver performs the full DMARC evaluation (checking SPF and DKIM, testing alignment against the From: domain) and then applies no policy to the outcome. A failing message is delivered exactly as it would have been without DMARC. The evaluation still happens, which is why reports arrive and why the data is useful, but the result is advisory. Anyone can send mail displaying your domain and it will not be quarantined or rejected on DMARC grounds.

The three policies and what each asks for

Moving through these in order, with a reporting period at each step, is the entire method. The percentage tag lets you apply an enforcing policy to a fraction of failing mail first, which is the safest way to make the final move.

p=nonemonitorevaluate and report, take no action (where you are now)

p=quarantinetreat as suspiciousfailing mail goes to spam rather than the inbox

pct=25partial enforcementapply the policy to a quarter of failing mail while you watch

p=rejectrefusefailing mail is rejected at the SMTP conversation, never delivered

How to fix it

Work through the reports, then raise the policy to quarantine and then reject.

Confirm you are receiving and reading aggregate reports at the rua address.
Identify every legitimate source in those reports and make sure each one passes SPF or DKIM with alignment.
Move to p=quarantine, optionally with pct= to ramp gradually.
Once quarantine causes no legitimate mail to be held, move to p=reject.

If you send with

Before moving to quarantine: Read several weeks of aggregate reports and confirm that every source producing volume is one you recognise and that it passes alignment. The sources that catch people out are rarely the mail platform: they are invoicing systems, survey tools, applicant tracking systems and anything else that sends on your behalf from its own infrastructure.
Third parties that send as you: Any service sending with your domain in the From: header needs to be aligned, either through a DKIM key you publish for them or through a custom return path. A service that cannot do either will fail DMARC once you enforce, and that has to be resolved before the move rather than after.
If you also want BIMI: BIMI requires DMARC at quarantine or reject. A domain sitting at p=none cannot display a brand logo in participating mailbox providers regardless of what else is configured, so this is often the commercial argument that gets enforcement prioritised.

Confirming the fix worked

Confirm aggregate reports are arriving and that you can read them, either directly or through a reporting service.
Identify every sending source in the reports and confirm each one is legitimate and aligned.
Move to p=quarantine with pct=25, wait a fortnight, and watch for any drop in legitimate mail.
Raise the percentage in stages to 100, then move to p=reject once quarantine at full coverage has been uneventful.

Common questions

Is p=none better than having no DMARC record?: Yes, but only because of the reports. It gives you visibility of who is sending as your domain, which is the information you need in order to enforce safely. It provides no protection in itself.
How long should I stay at p=none?: Long enough to see a full business cycle in the reports: typically two to four weeks, longer if you have monthly or quarterly processes that send mail. The measure is whether the reports have stopped surprising you, not the number of days elapsed.
Does p=none affect my deliverability?: Not directly, since receivers take no action on the result. Indirectly it can matter: some receivers view an enforcing DMARC policy as a positive signal, and bulk sender requirements at the major mailbox providers increasingly expect one.
Can I go straight from none to reject?: You can, and it is how legitimate mail gets rejected. Quarantine with a percentage tag exists so that mistakes surface as mail in a spam folder rather than as messages that were refused outright and never arrived.