A DMARC setting that records authentication results but does not instruct receivers to take protective action. It is useful for discovery and tuning, but by itself it does not prevent spoofed messages from reaching inboxes, which is why it should be treated as a temporary stage.
What p=none Means in Practice
A p=none policy tells receivers to collect DMARC alignment data without enforcing rejection or quarantine. That makes it a visibility stage, not a protective control, so messages that fail authentication can still reach users while you gather evidence and tune SPF and DKIM.
Because the policy is intentionally non-blocking, it is often used while organisations learn which legitimate senders are still failing alignment. The staged rollout approach described in the DMARC, SPF and DKIM Guide fits this use case, since the goal is to stabilise authentication before moving to stronger enforcement.
Why p=none Exists
p=none is useful when an organisation needs telemetry before it can safely enforce policy. DMARC reports can reveal whether mail sources are properly aligned, where forwarding breaks authentication, and which third-party services still need remediation.
That discovery value matters because DMARC decisions are only as good as the domain inventory behind them. If a sending source is unknown, misconfigured, or unmanaged, moving too quickly to enforcement can disrupt valid business mail and obscure which systems actually send on the domain’s behalf.
How Receivers Treat a p=none Policy
With p=none, receivers still evaluate SPF and DKIM and still generate DMARC reports, but they are not directed to apply protective handling based on the DMARC result. In other words, the domain owner gets measurement, not mailbox-side intervention.
This is why p=none is often treated as an intermediate state. It gives a sender time to correct alignment problems, confirm that legitimate mail streams are authenticating correctly, and reduce the risk of accidental disruption before moving toward quarantine or rejection.
When p=none Becomes a Problem
Left in place indefinitely, p=none creates a false sense of control. The domain may appear to have a DMARC policy, but the policy does not stop spoofed mail from being delivered, so the brand and users remain exposed to impersonation and phishing.
It can also hide operational drift. New SaaS senders, marketing tools, forwarding paths, or delegated mail services may start failing alignment without anyone noticing until users report spoofing or authentication noise becomes too large to ignore.
Risk and Threat Considerations
p=none reduces none of the abuse potential associated with domain spoofing, it only improves visibility into it. Attackers can still send messages that appear to come from the domain, and users may still receive them if other mailbox controls do not intervene.
Failure mechanism: The receiver has reporting data but no enforcement instruction, so spoofed or misaligned mail can continue through the delivery path while the organisation assumes DMARC is doing more than it actually is.
Impact: Phishing, brand impersonation, and fraudulent mail can remain reachable to users, while the organisation delays the transition to an enforcement policy that would actually reduce exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | DMARC reports provide security telemetry that must be reviewed and analysed. |
| IA-5 — Authenticator Management | DMARC depends on the lifecycle and integrity of authentication material used by SPF and DKIM. | |
| SI-8 — Spam Protection | DMARC enforcement helps reduce spoofed and malicious email delivery. | |
| Recommendation — Review DMARC report data to identify unauthorised senders and authentication failures. Manage SPF and DKIM credentials and keys so aligned mail can be authenticated reliably. Combine DMARC telemetry with anti-spoofing and spam protections to reduce fraudulent mail exposure. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | DMARC is an email anti-spoofing and authentication control that supports safer mail handling. |
| Recommendation — Implement anti-spoofing email controls and move from monitoring to enforcement when ready. | ||
| ISO/IEC 27001:2022 | A.5.14 — Information transfer | DMARC governs the security of externally transmitted email messages and trusted sending paths. |
| Recommendation — Define and enforce secure email transfer rules for domain-aligned outbound and inbound mail. | ||
Practitioner Guidance
Why practitioners should care: p=none should be treated as a controlled transition state, not a destination. Its value is in surfacing authentication and alignment gaps early enough to fix them before enforcement, not in providing ongoing protection.
What to watch for: Repeated reporting from the same unauthorised sources, unresolved third-party senders, or a long-running p=none policy without a clear migration plan usually means the domain has stalled in discovery mode.
Practitioner takeaway: Use p=none to prove that SPF, DKIM, and sender ownership are stable, then move deliberately toward enforcement once the reports show the domain is ready.