p=none and p=quarantine are useful transitional states, but they still allow many spoofed messages to reach users. They provide telemetry and some filtering, yet they do not create the hard refusal that blocks impersonation. If teams stay in those states too long, they create the illusion of progress while leaving the organisation open to abuse.
Why these DMARC rollout states feel safer than they are
p=none and p=quarantine are both transitional policy states, so they can improve visibility without yet forcing consistent enforcement. That makes them useful for measuring sender coverage, authentication alignment, and false positives, but it also means spoofed mail can still land with users, especially when recipients trust the display name, brand, or message context more than the policy signal.
They are best understood as calibration stages, not a security finish line. A domain can look “covered” because reports are flowing and some messages are being filtered, while the larger impersonation problem remains intact. If an organisation treats either state as the destination, it gets telemetry without the hard refusal that actually changes attacker economics.
What exposure remains while policy is not enforcing rejection
The remaining exposure is not abstract: mailbox users still see unauthenticated or weakly authenticated messages, phishing still benefits from brand impersonation, and business email compromise attempts still have a route to the inbox. The policy may reduce volume or surface some failures in reports, but it does not reliably stop abuse across all receivers, forwarding paths, or misaligned senders.
DMARC, SPF and DKIM Guide is the right operational reference when you are moving from observation to enforcement, because the rollout path has to account for alignment gaps, legacy senders, and subdomains before a reject posture is safe.
One common trap is assuming that quarantine alone removes the risk of impersonation. In practice, filtering decisions vary by receiver, and messages that are not rejected may still be delivered, diverted to spam, or surfaced inconsistently. That inconsistency gives attackers room to continue testing which brands, senders, and message patterns still reach the organisation.
How to move from monitoring to actual protection
The practical goal is to use p=none and p=quarantine to identify every legitimate sender that must authenticate correctly, then close the gaps until enforcement will not break business mail. That means reviewing all sending systems, third-party platforms, delegated services, and any legacy workflows that still produce mail under the protected domain.
At the same time, validate that the reports show the pattern you expect, not just that reports exist. If authenticated mail is still failing alignment, or if non-authorised senders are still active, enforcement should wait until those sources are understood and either fixed or removed. The right question is not whether you have started DMARC, but whether you have reduced the attacker’s ability to impersonate your domain at scale.
NIST Cybersecurity Framework 2.0 supports that discipline by framing this as a protect-and-detect maturity issue, where measured rollout and control validation matter more than symbolic policy adoption.
Risk and Threat Considerations
These transitional states can create a false sense of security because they produce evidence of progress while leaving the core impersonation path available. That gap matters most when users, service desks, or finance teams still treat mail as trusted if it appears to come from a known domain.
Failure mechanism: Attackers exploit the fact that reporting and partial filtering do not equal refusal, so spoofed messages may still be delivered, forwarded, or acted on before enforcement is in place.
Impact: The organisation remains exposed to phishing, brand impersonation, and business email compromise, and a delayed move to rejection can let abuse continue long after the rollout should have closed the door.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | DMARC rollout depends on authenticated sender trust and control enforcement. |
| DE.CM-01 — Networks and Systems Monitored | p=none and p=quarantine rely on monitoring reports to find spoofing and alignment gaps. | |
| Recommendation — Tighten sender authentication and enforce the approved mail trust model. Monitor authentication reports for unauthorised or failing sender paths. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Authentication assurance is central to preventing impersonation and trust abuse in message flows. |
| Recommendation — Validate the authentication path before increasing enforcement strength. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Email impersonation is a core control problem addressed by email protection practices. |
| Recommendation — Harden email handling and enforce anti-impersonation controls. | ||
| NIST SP 800-53 Rev 5 | SC-16 — Transmission of Information | DMARC governs trust in transmitted email and whether messages are accepted or rejected. |
| Recommendation — Apply sender authentication checks before accepting protected messages. | ||
Practitioner Guidance
What to prioritise: Treat p=none as measurement only and p=quarantine as a controlled transition state. The decision point is whether all legitimate senders are known, aligned, and explainable in reports, not whether the policy has been published.
What to verify: Confirm that every approved sender path can pass SPF or DKIM alignment as intended, including third-party senders and subdomains. If any business-critical sender still depends on exceptions, document the exception and clear it before moving further toward enforcement.
Practitioner takeaway: The safe endpoint is not “DMARC deployed,” but “unauthorised lookalike mail no longer has a credible path to users.”
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org