MediumPolicy · usually medium
DMARC policy is set to none
The policy monitors but does not act — failing mail is still delivered.
Check your own domain
What causes this
p=none is the monitoring mode. Receivers evaluate DMARC and send you reports, but they take no action when a message fails: it is delivered exactly as it would have been with no DMARC record at all. This is the correct starting point, and it is where a great many domains stop, because nothing visibly breaks and the next step requires confidence that every legitimate sender is authenticated.
What it breaks
You get visibility, but no protection. Mail forging your domain is not quarantined or rejected on the strength of your policy.
How to fix it
Work through the reports, then raise the policy to quarantine and then reject.
- Confirm you are receiving and reading aggregate reports at the rua address.
- Identify every legitimate source in those reports and make sure each one passes SPF or DKIM with alignment.
- Move to p=quarantine, optionally with pct= to ramp gradually.
- Once quarantine causes no legitimate mail to be held, move to p=reject.
Specification: RFC 7489 — DMARC
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- External reporting address is not authorisedReports are directed to another domain that has not published the required authorisation record.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- Subdomain policy is weaker than the domain policysp= is set to a laxer value than p=, leaving subdomains less protected.
- Non-sending domain is not protected against forgeryThis domain appears not to send mail, but publishes no policy preventing others from doing so.