Tripline

DMARC policy: p=none

Your DMARC policy is p=none, so fake mail still gets through.

p=none asks receivers for reports and nothing else. It's the right first step, and a poor place to stay. Here's how to tighten it without bouncing your own mail.

Free, with no sign-up. Takes a few seconds.

What it means

DMARC tells receivers what to do with mail that claims to be from your domain but fails both SPF and DKIM for it. p=none means do nothing special, p=quarantine means treat it as spam, p=reject means refuse it.

Google and Yahoo have required a DMARC record from bulk senders since 2024, and p=none meets that rule. It doesn't stop anyone sending invoices or password resets that look like yours.

Why it happens

_dmarc.yourdomain.comv=DMARC1; p=none

A policy that only watches

Mail that fails is delivered as normal. It's what most setup guides tell you to start with, and most domains never move on.

No reportsv=DMARC1; p=none;

Watching with nobody looking

Without a rua= address the reports go nowhere, so p=none tells you nothing.

Forgotten senderFrom: billing@yourdomain.com
via invoicing tool

Senders that would fail

The invoicing tool or CRM nobody set up DKIM for. These are what a stricter policy would block, so they are what to fix first.

Subdomainssp=none

A gap for subdomains

Subdomains follow p= unless sp= says otherwise. An explicit sp=none leaves every made-up subdomain open to spoofing.

How to fix it

  1. Collect reports.

    Add rua=mailto:dmarc@yourdomain.com (or a report service's address) to the record. Receivers send a daily summary of who sent mail as your domain.

  2. Find every real sender.

    Read two to four weeks of reports. List each service that sends as you: your mailbox provider, newsletter tool, helpdesk, invoicing, website forms.

  3. Make each one pass.

    For each sender, switch on DKIM signing with your domain, or add it to SPF, so it passes and matches your From address. DKIM is the sturdier choice because it survives forwarding.

  4. Move to quarantine.

    Change to p=quarantine. Some people step up with pct=25, then 50, then 100. Keep reading the reports.

  5. Then reject.

    When reports show only fakes failing, set p=reject. A domain that never sends mail can go straight to p=reject, with v=spf1 -all as its SPF.

Common questions

Will p=reject break mailing lists or forwarding?

It can for mail that relies on SPF alone, because forwarding breaks SPF. Mail with a valid DKIM signature usually survives, which is why fixing DKIM comes first.

Is p=none safe to leave in place?

It is harmless but it protects nobody. It is fine while you collect reports, which usually takes a few weeks.

What's the difference between quarantine and reject?

Quarantine asks receivers to treat failing mail as suspicious, usually the spam folder. Reject asks them to refuse it outright, so it never arrives.

Will Tripline tell me if someone weakens the policy?

Yes. If you ask us to watch your domain, a change from reject or quarantine back to none is sent as a problem alert, as is a DMARC record that disappears.

Other fixes

SPF PermError: too many DNS lookupsYour SPF record needs more than 10 DNS lookups. Excluded by ‘noindex’ tagGoogle says your page is excluded by a noindex tag. Blocked by robots.txtGoogle says a page is blocked by robots.txt.