Why Monitoring-Only DMARC Is a False Sense of Security
A DMARC record at p=none ticks the box on a checklist and blocks nothing. If your domain has been at monitoring for more than a few months, it is not protected.
Here is the position, stated plainly: a DMARC record at p=none is not protection. It is a monitoring tool. If your domain has been sitting at monitoring for more than a few months, criminals can still send email as you, and every major mailbox provider has been told by you to deliver it.
What p=none actually instructs
The policy tag tells receiving servers what to do with mail that fails DMARC. p=none means: take no action. Deliver it exactly as you would have anyway, and send me a report. Forged invoices, fake payment requests and impersonation attempts arrive in your clients’ inboxes carrying your real address, just as they would with no DMARC at all.
The only thing that changes is that you get told about it afterwards, and only if someone is reading the reports. On most domains stuck at p=none, nobody is.
Why so many domains stop there
Nobody sets out to leave a domain unprotected. It happens for predictable reasons.
- A checklist asked for DMARC, not enforcement. An audit or a supplier form asked whether a DMARC record exists. The answer became yes, and the item was closed.
- Fear of breaking email. This is legitimate. Moving to reject before every sender is aligned will block real mail. But the answer is to do the alignment, not to stay unprotected indefinitely.
- The reports are unreadable. Aggregate reports arrive as XML from dozens of providers every day. Without a tool or a person to interpret them, they pile up in a mailbox nobody opens.
- Nobody owns it. The web developer published the record, the IT provider manages the mail platform, marketing runs the newsletter tool. Enforcement needs all three, and none of them has it on their list.
What it costs to wait
Every month at p=none is a month in which your domain can be used against your clients and suppliers with no resistance from you. Invoice redirection fraud does not need to succeed often to be expensive; one redirected payment can cost more than years of properly managed DMARC. There is also the reputational cost when a client asks why an email carrying your exact address was delivered to them at all, and the answer is that you told their mail server to deliver it.
A monitoring-only record is also visible to anyone who looks. Attackers check. So do increasingly security-aware clients, insurers and procurement teams. You can see what they see with our DMARC checker.
The honest exceptions
There are good reasons to be at p=none, and they are all temporary.
- You have just started. Monitoring is the correct first step. The reports are what make safe enforcement possible.
- You are mid-migration. A move between mail platforms or a big new sending service can justify holding at monitoring while it settles.
- A domain has a genuinely complex sending estate. Large organisations with many business units can take longer. Longer, though, is still a project with an end date.
What these have in common is a plan and a date. p=none is a phase. The failure is treating it as a destination.
How to move forward
The path out is methodical. Use the reports to list every source sending as your domain. Align SPF and DKIM for each legitimate one. Move to p=quarantine, watch for anything unexpected, then move to p=reject. We walk through each step in our guide to rolling out DMARC from p=none to p=reject.
If your domain has been at monitoring for longer than you would like to admit, that is exactly the situation MailMarq was built for. We start from the reports you already have, or begin collecting them properly, and take the domain to enforcement with every step approved by you.
Frequently asked questions
Is p=none better than no DMARC record at all?
Yes, if someone is reading the reports. A monitoring policy with reporting gives you the visibility needed to reach enforcement. Without anyone reviewing the reports, it provides almost nothing.
How long should a domain stay at p=none?
Long enough to capture your normal email patterns and align every legitimate sender. For a simple set-up that can be a matter of weeks. Staying there for years is a sign the project stalled, not that the domain is uniquely complex.
Will moving to p=reject hurt our deliverability?
Not if your legitimate senders are aligned first. Enforcement often helps, because receivers can trust mail from your domain more when forgeries are being refused.
Sources and standards
- RFC 7489, section 6.3: General Record Format. The p, sp, pct, rua and ruf tags, and their defaults.
- Google Workspace Admin Help: Set up DMARC. Google guidance on publishing DMARC and moving to enforcement.
- Microsoft: Outlook’s new requirements for high-volume senders. The April 2025 announcement of SPF, DKIM and DMARC enforcement for domains sending more than 5,000 messages a day.
MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.
Keep reading
What Is DMARC, and Why It Is No Longer Optional
DMARC is the record that decides whether criminals can send email as your business. Here is how it works, what the three policies really do, and why monitoring alone protects nothing.
How Email Spoofing Leads to Invoice Fraud and CEO Impersonation
Most business email fraud is not technically sophisticated. It relies on one thing: a message that appears to come from someone you trust. Here is how the main variants work and which defences stop each one.
Rolling Out DMARC Safely: From p=none to p=reject
Enforcement is where DMARC protects you and where it can hurt you. This is the sequence that gets a domain to p=reject without blocking the invoices, statements and bookings your business depends on.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.