DMARC is not enforcing (p=none)

Check id: dmarc.policy_none · fix effort: medium

What it means

Your DMARC policy says to accept forged mail and just report it. Monitoring mode is a fine place to start, but it's not protection. Plan the move to enforcement.

The technical detail

p=none delivers alignment failures normally. Step up to p=quarantine, then p=reject once aggregate reports look clean.

How to fix it

1. Confirm aggregate reports (rua) are flowing and reviewed.
2. Verify all legitimate senders pass SPF or DKIM with alignment.
3. Step up: p=quarantine; pct=10 → pct=100 → p=reject.