Skip to content

Scan rule · RSC-SEC-087

DMARC with `p=none`

SecuritySeverity: LowCWE-290

Checks whether the DMARC record is still at `p=none`, telling receivers to deliver forged mail anyway.

Why this matters

`p=none` is DMARC's monitoring mode: you receive reports, but receivers are told to deliver forged mail regardless. Right as a starting point — ineffective as a permanent state.

Many domains stay there for years because the second step was never planned. The order: read reports for two to four weeks, add every legitimate sender to SPF or DKIM, then `p=quarantine`, then `p=reject`.

Check it yourself: `dig TXT _dmarc.your-domain.com +short` — if it says `p=none`, the protection is not enforced yet.

Scan tier

External scan (anonymous)

How to fix it

Review DMARC reports, cover every legitimate sender in SPF/DKIM and raise the policy to `p=quarantine`, later `p=reject`.

Scan your own app for free