p=none Is Not Protection: Why “We Have DMARC” Still Leaves You Exposed

Ask most organisations whether they “have DMARC,” and many will say yes. Ask whether anyone can forge mail that looks like it came from their exact domain, and the honest answer is often still yes.

The gap is usually one policy tag: p=none.

That setting is a valid — and recommended — starting point. It is not a finished security control. Treating it as done is how brands collect reports for years while spoofers keep using the company name.

What p=none actually does

With p=none, receiving mail systems are told:

• evaluate SPF and DKIM against your DMARC policy
• do not quarantine or reject failures on your instruction
• optionally send you aggregate reports so you can see what is happening

You gain visibility. You do not instruct the world to block forged mail using your domain.

That is useful for discovery. It is not the same as stopping domain spoofing.

Policy	What receivers are asked to do with failing mail	Spoofing defence
p=none	Deliver as usual (monitor only)	Weak — you watch
p=quarantine	Prefer spam / junk for failures	Medium — friction for attackers
p=reject	Refuse failures at the door	Strong — real enforcement

For the staged path through those policies, use Deploy DMARC safely: none → reject. For publishing the first record: DMARC setup.

Why teams get stuck on monitoring forever

The reasons are predictable:

1. Fear of breaking mail — legitimate platforms still fail alignment
2. No owner — DNS was a project; operations never became a job
3. Reports nobody reads — rua points at a mailbox that is effectively a black hole
4. Checkbox compliance — “record exists” satisfied an audit question once
5. Bulk-sender minimums — Gmail, Yahoo, and Microsoft accept a published policy for high-volume rules; monitoring can look “compliant” while security stays off

None of those are reasons to stay forever. They are reasons to finish the inventory, then move.

The business cost of permanent p=none

While you monitor:

• attackers can still spoof your exact domain for phishing and invoice fraud
• customers and partners have no policy-based reason to distrust forgeries that look perfect
• finance still needs process controls for lookalike domains — and now also for exact-domain forgeries DMARC could have reduced
• leadership hears “we deployed DMARC” and underestimates residual risk

Visibility without enforcement is risk documentation, not risk reduction.

How to know you are ready to leave p=none

You do not need perfection. You need confidence on the mail that matters.

Ready signals:

• aggregate reports arrive and someone reviews them on a schedule
• high-volume legitimate senders are identified and mostly pass with alignment
• unknown or hostile sources are labelled, not ignored
• DNS ownership is clear for the next policy change
• marketing and IT agree which domains are in scope

Not ready signals:

• “we have a record” but no report review in 90 days
• multiple ESPs and SaaS tools send as the brand with no inventory
• SPF is over the lookup limit or DKIM is “configured” but not signing live mail
• nobody can roll policy back quickly if something breaks

Learn the triage questions in how to read DMARC aggregate reports. Fix sender sprawl with the SaaS onboarding checklist before you tighten policy under pressure.

A sane next step (without a big-bang outage)

1. Confirm reports work — if rua is dead, fix that first
2. Build a one-page sender inventory — known good, needs setup, suspicious
3. Repair alignment on the top legitimate sources
4. Move to quarantine when the important streams are clean (staging with pct is optional and useful for cautious estates)
5. Move to reject when quarantine no longer surprises you with real business mail

Rollback is allowed. Silent permanent monitoring is the real anti-pattern.

What “done” looks like for leadership

A useful status update is not “DMARC is published.” It is:

• policy level on the primary brand domain
• whether reports are reviewed
• percent of volume that is known and aligned
• date of the last policy change and the next planned step
• residual risks (lookalikes, compromised mailboxes) that DNS alone cannot fix

That framing keeps security, IT, and marketing on the same page.

Final takeaway

p=none is a phase, not a posture. It is how responsible teams discover senders without breaking production mail. Staying there forever leaves your exact domain open for impersonation while creating false confidence in audits and board updates.

Next step: check whether your public record is still monitoring-only with a free domain check, then use the enforcement path to plan the first move toward quarantine — after reports and inventory, not before.