None Policy (DMARC)

What Is a None Policy in DMARC?

A None Policy in DMARC is the most basic policy setting that tells receiving mail servers not to take any specific action when a message fails DMARC authentication.

It is represented by the tag p=none in a DMARC DNS record. When this mode is active, email that fails SPF or DKIM checks is delivered to recipients, and the domain owner receives aggregate reports that provide visibility into how their domain is being used for email.

How Does a None Policy Work?

In a DMARC record, the policy (p=) tag defines what a receiving mail server should do when a message does not pass authentication.

Example of a DMARC record with a None Policy:

Here’s what happens under a None Policy:

1. The recipient’s mail server checks SPF and DKIM authentication.
2. If the message fails, it is still accepted for delivery.
3. The server sends a DMARC aggregate report to the address specified in the rua tag.

This allows domain owners to monitor and understand their current email-sending landscape before enforcing stricter policies.

Why Do Organizations Start with a None Policy?

A None Policy is typically used as the first phase of a DMARC rollout. It provides valuable insights without disrupting email delivery. By collecting DMARC reports, administrators can identify:

• Which legitimate services send mail for their domain
• Which IP addresses or third-party tools may need SPF or DKIM setup
• Whether spoofing or unauthorized mail is being attempted

Once enough data has been gathered and legitimate sources are properly authenticated, the policy can be upgraded to p=quarantine and later p=reject for stronger protection.

None Policy and DMARCeye

DMARCeye helps organizations take full advantage of the None Policy phase by turning complex XML DMARC reports into clear, visual insights.

When a domain uses p=none, DMARCeye automatically processes all incoming data to show which senders are legitimate, which fail authentication, and how often spoofing attempts occur.

This makes it easier to plan a safe transition from monitoring to enforcement, ensuring your domain achieves strong protection without interrupting valid mail flow.