My DMARC is set to p=none: is that enough?

Short answer: no. p=none tells receiving servers to take no action on mail that fails, so anyone can still send email pretending to be your domain. It's the right first step, because the reports show who sends as you, but it isn't protection until you move to p=quarantine or p=reject.

How to check it yourself

1. Look up the TXT record at _dmarc. plus your domain and find p=.
2. If it's p=none, make sure it has an rua= address so you receive the reports.
3. Read the reports for a few weeks: every legitimate service that sends as you should pass SPF or DKIM.
4. Fix any that don't, then change to p=quarantine, and later to p=reject.

What Preventionlabs shows

Every report checks DMARC and whether it's actually enforced. For example, from a real report: "DMARC is set to p=none: the domain owner 'requests no specific action be taken' on mail that fails, so DMARC itself stops none of it (RFC 7489)." It shows this alongside the SPF lookup count and DKIM keys, so you can see whether it's safe to tighten.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers

• Why are my website contact form emails going to spam?
• Is DNSSEC set up properly on my domain?
• When does my Cloudflare SSL certificate expire?
• All questions