Skip to content
Severity: Medium

Finding: DMARC Policy Is Monitoring Only (p=none)

This finding means your domain publishes a DMARC record, but its policy is p=none— reports are collected, but mail that fails authentication is still delivered exactly as if DMARC weren't there at all.

Last updated August 9, 2026.

What it means

p=noneis DMARC's measurement stage, not its protection stage. Aggregate reports flow to the address in rua=, giving visibility into who is sending mail as your domain — but nothing is enforced. Spoofed mail that fails SPF and DKIM still reaches inboxes.

Why it matters

Many domains publish DMARC once, see it in a checklist, and stop — sitting at p=nonefor years while believing they're protected from spoofing. They aren't. A domain with no DMARC record and a domain at p=none are functionally identical to a receiver deciding whether to deliver spoofed mail; the only difference is that the p=none domain owner is (or should be) receiving reports that say so.

What Nivaronix checks

Nivaronix performs a live TXT lookup at _dmarc.<your-domain>, isolates the record beginning with v=DMARC1, and reads its p= tag. This finding fires when that tag is present and equals none.

Example evidence (illustrative — not live scan data)

TXT _dmarc.example.com: v=DMARC1; p=none; rua=mailto:[email protected]

How to fix it

  1. If you've had p=none for at least a week or two, open the aggregate reports sent to your rua=address (a DMARC report viewer or your mail provider's built-in one makes these readable — raw XML aggregate reports are not meant to be read by hand).
  2. Confirm every legitimate sending source — your mail provider, helpdesk, marketing platform, invoicing tool — is passing SPF or DKIM alignment.
  3. Update the record: change p=none to p=quarantine. At most DNS hosts this means editing the existing TXT record on the _dmarcsubdomain — look for a "DNS records" or "DNS management" section and edit the record whose host/name is _dmarc.
  4. Watch for any legitimate mail landing in spam; adjust SPF/DKIM alignment if so.
  5. Move to p=reject once quarantine has run clean.

How to verify the fix

Re-run the SPF & DMARC checker and confirm the finding now reports an enforcing policy (p=quarantine or p=reject) rather than monitor-only.

Related

Check your DMARC policy

Scan your domain free