How to fix “p=none” from policy guide

You published DMARC with p=none months ago and nothing changed: spoofing still possible, reports pile up unread.

Check your domain first — 10 seconds, free, no signup.
See your DMARC policy, SPF lookup count and every issue explained in plain English.
Run the free check →

What this means

p=none is monitoring only. It tells receivers to deliver everything normally and just send you reports. More than half of all domains with DMARC never move past it (2026 adoption data) — which means no protection at all.

How to fix it

Step 1. Collect 2–4 weeks of aggregate reports and identify every legitimate sender.
Step 2. Fix authentication for each real service (we hand you the exact steps per tool).
Step 3. Move to p=quarantine; pct=25 — a quarter of failing mail goes to spam, your fixed senders are untouched.
Step 4. Raise pct to 100, then switch to p=reject. That's the only setting that blocks spoofing.

Frequently asked

How long until fixes take effect?

DNS changes propagate within minutes to 48 hours. Mailbox providers pick up the new records on their next check — most senders see bounces stop within a day of correct configuration.

Does this apply if I send fewer than 5,000 emails a day?

Formal enforcement targets bulk senders, but partial authentication already costs you inbox placement at every volume — and spoofing protection matters regardless of how much you send.

Can I just ask my hosting provider to fix it?

Hosting support can add DNS records for you, but they don't know which services send as your domain. You (or a monitoring tool reading your DMARC reports) have to provide that list — that's the actual hard part.

Don't want to babysit DNS records?
DMARCKeeper monitors your reports, names every sender, and walks you to full p=reject protection.
Start free monitoring →