Email

DMARC p=none does not stop phishing. Here's what to do instead.

Published 2026-04-01 · Last updated 2026-04-01 · Vantyris editorial

What this means for your business

• Anyone can send email from your domain to a Gmail or Outlook user, and it will land in their inbox looking legitimate. Your customers can be phished through your domain right now.
• p=none was designed as a staging mode. You publish it for 4 to 8 weeks and read the aggregate reports until you're sure none of your own legitimate mail is failing SPF or DKIM (newsletters, transactional mail, third-party senders). After that you graduate to p=quarantine, and eventually to p=reject.
• If you've been on p=none for more than 90 days, you almost certainly should have moved on. Most owners get stuck there because nobody read the aggregate reports and they were nervous about breaking legitimate mail.

How to fix

Once your aggregate reports are clean (no legitimate mail failing), change the TXT record from p=none to p=quarantine. Stay there for another month. If nothing broke, move to p=reject.

1. Read your DMARC aggregate reports. Set up a free DMARC aggregator (Postmark, Dmarcian's free tier, or Easydmarc) and send your rua= reports there for 2-4 weeks. Confirm every sender that appears in the report is legitimate (your transactional ESP, your newsletter tool, your accountant's CRM if it sends in your name). Make sure each one is SPF-authorised and DKIM-signed.
2. Change the DMARC TXT record. At your DNS provider, edit the existing TXT record at _dmarc.<yourdomain>. Change p=none to p=quarantine, and keep rua= so the reports keep flowing. Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100.
3. Wait 30 days and confirm no legitimate mail broke. Watch the aggregate reports. If a third-party sender shows up failing alignment, fix that sender's SPF or DKIM. Don't move to p=reject until everything in the report is either authenticated or known junk.
4. Move to p=reject. Final step. Edit the record again and change p=quarantine to p=reject. Unauthenticated mail claiming to come from your domain now bounces outright. The impersonation hole is closed.

Owner: Your DNS administrator. Most domain registrars have a DNS panel, and your web host's support team will know where it is. · Time: 10 minutes per DNS edit, with 4-8 weeks of monitoring between edits.

Common gotchas

• Don't skip the monitoring period. Going straight from p=none to p=reject can break legitimate mail, and you'll get blame-emails from people whose receipts vanished.
• Make sure rua=mailto: points at a real address you check. Without aggregate reports, you're flying blind.
• Don't set the SPF record to ~all and call it good. SPF alone doesn't protect against impersonation. DMARC is the part that enforces.

How to verify the fix

Run a free Vantyris teaser scan to confirm the new record is published and parses cleanly. Any DMARC checker works too. Paste your domain into mxtoolbox.com/dmarc.aspx and check the policy reads quarantine or reject. After a week, your aggregate reports should show more than 99% of mail authenticated.

Cyber Essentials alignment

This finding informs the following Cyber Essentials control areas (the UK government's baseline scheme, a sound checklist in any country):

• A1. Firewalls: boundary protection between the internet and your services.
• A2. Secure configuration: devices and services hardened against the weaknesses they ship with by default.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• NCSC: email security and anti-spoofing NCSC
• RFC 7489: DMARC IETF RFC
• RFC 7489 §6.3: DMARC policy actions IETF RFC

Related explainers

• SPF records, explained: the first line of defence against email spoofing.
• What is DMARC, and why every business with a domain needs one.