How to fix a DMARC p=none record and stop domain spoofing

If your domain publishes a DMARC record that ends in p=none, you have email authentication switched on and doing almost nothing. Anyone can still send mail that appears to come from your domain, and receiving servers will deliver it to the inbox. This is one of the most common gaps we find, and it is straightforward to close.

What p=none actually does

DMARC tells receiving mail servers what to do with a message that fails authentication, meaning it was not sent by a server your domain approved. The policy has three settings. p=none says take no action, just deliver it and send me a report. p=quarantine says put it in spam. p=reject says refuse it outright.

p=none is meant to be a temporary first step. You publish it to collect reports and see who sends mail as your domain, legitimate services included, before you start enforcing. The problem is that most domains stop there. The record looks complete, security scanners see DMARC present, and everyone assumes the domain is protected. It is not. Until you move past p=none, a spoofed message is delivered exactly like a real one.

Why this matters

Domain spoofing is how business email compromise starts. An attacker sends an invoice or a password-reset lure that passes every casual check because it really does come from your domain in the From line. Your customers and staff have no easy way to tell it apart. Moving to an enforcing DMARC policy is what removes that option from the attacker.

The safe way to move to enforcement

Do not jump straight to reject. A domain usually has more legitimate senders than its owner remembers: the marketing platform, the invoicing tool, the help desk, the CRM. Turn on enforcement in stages and watch the reports between each step.

1. Confirm SPF and DKIM are set up for every service that sends mail as your domain. DMARC enforcement relies on them, so a legitimate sender that is not covered will start failing.
2. Start at p=quarantine with pct=100. Failing mail goes to spam rather than being refused, so a missed sender is recoverable.
3. Read the aggregate reports for one to two weeks. They show every source sending as your domain and whether it passes. Add SPF or DKIM for any legitimate sender that is failing.
4. Once the reports are clean, move to p=reject. Now spoofed mail is refused at the door.

The record to publish

DMARC is a single TXT record on the _dmarc subdomain of your domain. A safe enforcing record, once your senders are verified, looks like this:

_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100; sp=reject; aspf=r; adkim=s"

Replace example.com with your domain and set the rua address to a mailbox you watch. The sp tag applies the same policy to subdomains, and pct=100 applies it to all mail. Publish it at your DNS provider as a TXT record named _dmarc, then confirm it resolves.

A quick check: look up your current _dmarc TXT record. If it contains p=none, or if there is no DMARC record at all, your domain can be spoofed today.

See where your domain stands

PhantomStrike reads your live DMARC, SPF, and DKIM records and tells you exactly what to change, with the record ready to paste. The scan is free and needs no account, and it never sends mail or touches your servers.

See your domain the way an attacker does

Run a free scan for your exposure score and the exact records that fix each finding. No account, and we never touch your systems.

Common questions