Since February 2024, Google and Yahoo have required a DMARC record from anyone sending more than 5,000 messages a day. A lot of domains added one to satisfy the requirement. The requirement was met. Most of those domains are no more protected than they were the week before.
The reason is one field.
What DMARC actually does
DMARC ties SPF and DKIM together and tells a receiving server what to do when a message claiming to be from your domain fails both checks. It has three enforcement levels, set by the p= tag:
v=DMARC1; p=none; rua=mailto:reports@yourcompany.com
p=none— monitor. Record what happens, do nothing about it.p=quarantine— send failing mail to spam.p=reject— refuse failing mail at the receiving server, before it reaches anyone.
Only two of those three protect you. The requirement Google and Yahoo imposed is for a record, not a policy. p=none satisfies the requirement completely and stops no one.
What p=none leaves open
With p=none, anyone can send mail as your domain and it will be delivered. A forged invoice from accounts@yourcompany.com, sent from a server that has nothing to do with you, fails SPF and DKIM — and lands in your customer's inbox anyway, because your policy told the receiving server to do nothing.
p=none is not protection. It is a camera pointed at the door, with the door unlocked. It can show you what came through, if you configured a reporting address — the rua= tag — which many domains on p=none never did. Without it you are not even watching. You just have the record.
Why domains get stuck there
p=none is the correct place to start. You publish it, you collect reports, and you find out — often for the first time — every system sending mail as your domain. The marketing platform. The invoicing tool. The CRM someone in sales signed up for. You need that inventory before you enforce, because the moment you move to p=reject, anything you missed stops being delivered.
So p=none is a first step that requires a second. The trouble is that the second step feels risky and the first step feels finished. The record exists, the requirement is met, the dashboard is green. Nobody comes back to read the reports, and the domain sits at p=none for years — technically compliant, practically unprotected.
Moving to enforcement without dropping real mail
The path is p=none → p=quarantine → p=reject, and the reports between each stage are the whole point. You raise the policy, you watch what fails, and if something legitimate starts failing you fix its authentication before going further. Skipping the observation is how a company moves to p=reject and silently stops delivering its own invoices.
There is a middle setting for the cautious: pct=, which applies the policy to a percentage of mail. p=quarantine; pct=25 quarantines a quarter of failing messages, so you can watch the effect at small scale before committing.
You can read your own policy in four seconds: check your domain. If it comes back p=none, you have a DMARC record and no protection — and closing that gap is a decision, not an accident waiting to be discovered.