Email

DMARC p=none does not stop phishing. Here's what to do instead.

Published 2026-04-01 · Last updated 2026-04-01 · Vantyris editorial

What this means for your business

• Anyone can send email from your domain to a Gmail or Outlook recipient and it will land in their inbox looking legitimate. Your customers can be phished through your domain right now.
• DMARC p=none was designed as a staging mode: you publish it for 4 to 8 weeks while you collect aggregate reports and confirm none of your own legitimate mail (newsletters, transactional, third-party senders) is failing SPF or DKIM. After that period, you graduate to p=quarantine and eventually p=reject.
• If you've been on p=none for more than 90 days, you almost certainly should have moved on. Most owners get stuck on p=none because nobody monitored the aggregate reports and they were nervous about breaking legitimate mail.

How to fix

Once your DMARC aggregate reports are clean (no legitimate mail failing), change the TXT record from p=none to p=quarantine. Stay there for another month, confirm nothing broke, then move to p=reject.

1. Read your DMARC aggregate reports. Set up a free DMARC aggregator (Postmark, Dmarcian's free tier, or Easydmarc) and pipe your `rua=` reports there for 2-4 weeks. Confirm every sender that appears in the report is legitimate (your transactional ESP, your newsletter tool, your accountant's CRM if it sends in your name). Make sure each one is SPF-authorised and DKIM-signed.
2. Change the DMARC TXT record. At your DNS provider, edit the existing TXT record at `_dmarc.<yourdomain>`. Change `p=none` to `p=quarantine`. Keep `rua=` so reports keep flowing. Example: `v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100`.
3. Wait 30 days, confirm no legitimate mail broke. Watch the aggregate reports. If a third-party sender shows up failing alignment, fix that sender's SPF or DKIM. Don't move to p=reject until everything in the report is either authenticated or known-junk.
4. Move to p=reject. Final step. Edit the record again, change `p=quarantine` to `p=reject`. Now any unauthenticated mail claiming to be from your domain is bounced outright. You've closed the impersonation hole.

Owner: Your DNS administrator. Most domain registrars have a DNS panel; your web host's support team will know. · Time: 10 minutes per DNS edit; 4-8 weeks of monitoring between edits.

Common gotchas

• Don't skip the monitoring period. Going straight from p=none to p=reject can break legitimate mail and you'll get blame-emails from people whose receipts vanished.
• Make sure you have `rua=mailto:` set to a real address you check. Without aggregate reports, you're flying blind.
• Don't set the SPF record to `~all` and call it good. SPF alone doesn't protect against impersonation; DMARC is what enforces.

How to verify the fix

Use Vantyris's free teaser scan to confirm the new record is published and parses cleanly. Or use any DMARC checker: paste your domain into mxtoolbox.com/dmarc.aspx and confirm the policy reads `quarantine` or `reject`. After a week, your aggregate reports should show >99% authenticated mail.

Cyber Essentials alignment

This finding informs the following UK NCSC Cyber Essentials control areas:

• A1. Firewalls — boundary protection between the internet and your services.
• A2. Secure configuration — devices and services hardened against the inherent default vulnerabilities.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• NCSC: email security and anti-spoofing NCSC
• RFC 7489 — DMARC IETF RFC
• RFC 7489 §6.3 — DMARC policy actions IETF RFC

Related explainers

• SPF records, explained: the first line of defence against email spoofing.
• What is DMARC, and why every business with a domain needs one.