What is p=none?

Publishing it costs nothing and buys visibility. Within a day the aggregate reports start arriving, listing every IP that sent mail claiming to be you and how each one authenticated.

Most organizations find something surprising in the first two weeks. An old CRM, a contractor's mail merge, an invoicing tool from three years ago, all sending as you and none of them authenticated.

Google and Yahoo's 2024 bulk-sender rules accept it, which is why most DMARC records in the wild sit here. Requirement met, protection absent.

The point is to leave. Use the reports to authenticate every legitimate sender you find, then move to quarantine once the list has stopped producing surprises.

Say you publish v=DMARC1; p=none; rua=mailto:dmarc@acme.example on a Monday. By Tuesday or Wednesday the first aggregate reports arrive as zipped XML attachments, one per reporting provider per day. Each file lists source IPs, how many messages each sent as your domain, and whether SPF and DKIM passed and aligned.

Imagine the week totals 14 source IPs. Nine belong to Google Workspace and pass everything. Three belong to your marketing platform, passing DKIM and failing SPF alignment. Two sit at a hosting company you've never used, sent 40 messages between them, and fail both. Those 40 are either a forgotten tool or someone spoofing you, and the report alone can't say which.

Raw XML is miserable to read past the first few files. A report parser, hosted or open source, groups the rows by sender so you're looking at a table of services instead of a folder of attachments.

Set an exit test on day one, or p=none becomes permanent by default. A reasonable one: every source you recognize passes DMARC through an aligned path, and the unrecognized remainder has stayed small and unexplained for two reporting weeks in a row. At that point the remaining failures are mail you'd want filtered anyway.

Don't wait for forensic reports to help you decide. The ruf tag asks for per-message failure samples, and most large mailbox providers, Gmail included, don't send them. Aggregate data is what you'll get, so plan around it.

Watch for forwarding in the numbers. A steady trickle of failures from university or ISP mail servers, each sending a handful of messages, is usually your real mail being auto-forwarded by recipients. That traffic passes on DKIM if you sign with your own domain, which is one more reason to get DKIM aligned for every sender before you move up to quarantine.