Scan rule · RSC-SEC-087
DMARC with `p=none`
Checks whether the DMARC record is still at `p=none`, telling receivers to deliver forged mail anyway.
Why this matters
`p=none` is DMARC's monitoring mode: you receive reports, but receivers are told to deliver forged mail regardless. Right as a starting point — ineffective as a permanent state.
Many domains stay there for years because the second step was never planned. The order: read reports for two to four weeks, add every legitimate sender to SPF or DKIM, then `p=quarantine`, then `p=reject`.
Check it yourself: `dig TXT _dmarc.your-domain.com +short` — if it says `p=none`, the protection is not enforced yet.
Scan tier
How to fix it
Review DMARC reports, cover every legitimate sender in SPF/DKIM and raise the policy to `p=quarantine`, later `p=reject`.