If your domain publishes p=none, anyone can send mail that appears to come from your domain and receiving servers will deliver it normally. Having a DMARC record is not the same as being protected by one.
What each policy value actually does
DMARC sits on top of SPF and DKIM. Those two decide whether a message authenticates. DMARC decides what the receiving server should do when it does not, and the p= tag carries that instruction.
p=noneDeliver failing mail normally. Monitoring only.p=quarantineSend failing mail to spam or hold it.p=rejectRefuse failing mail at the SMTP transaction.Only p=reject stops domain impersonation. p=quarantine filters most of it and still lets some through. p=none stops none of it, which is the point of the value: it exists so an operator can collect reports before enforcing.
Why so many domains sit at p=none forever
The value is correct as a starting position. You publish p=none, collect aggregate reports for a few weeks, find every legitimate sender that fails authentication, fix them, then move to quarantine and then to reject. The problem is that the middle step is real work. Marketing platforms, invoicing systems, helpdesk tools and payroll providers all send on behalf of the domain, and each one needs SPF or DKIM alignment before enforcement is safe.
So the record gets published, the reports are never read, and the domain stays at monitoring indefinitely. From the outside it is indistinguishable from having no policy at all.
Moving straight to p=reject without fixing alignment first will silently drop legitimate mail. That is why the staged path exists, and why skipping the report-reading step is the thing that keeps organisations stuck.
How we score it
Our external scan resolves the DMARC record for a domain and reports the enforcement posture directly, because the distinction between "has DMARC" and "is protected by DMARC" is where most self-assessments go wrong.
p=rejectProtected. Domain spoofing is blocked.p=quarantinePartial. Most spoofed mail is filtered, not all.p=noneOpen. Anyone can impersonate the domain.The check is passive. It reads a public DNS TXT record, the same record any receiving mail server reads on every message. Nothing is sent to the domain and no access is required.
What to do about it
Read the aggregate reports you are already receiving. They will name every sender failing authentication. Fix alignment for the legitimate ones, then move to p=quarantine with a low percentage and raise it. Only then go to p=reject.
If nobody is reading the reports, the honest position is that the domain is unprotected, and it is worth knowing that before someone else finds out.
Our free external scan reports your DMARC posture alongside credentials in public breach corpora, subdomains visible in certificate transparency logs, and internet-facing services. Passive sources only, no system access, report in 48 hours. Run a scan.