DMARC p=none Policy Leaves Domains Open to Spoofing and Phishing Attacks

DMARC is an email authentication protocol that instructs mail servers how to handle messages failing authentication, but its initial 'p=none' policy takes no enforcement action against such emails. Under p=none, fraudulent emails spoofing a legitimate domain are still delivered to recipients, making organizations vulnerable to phishing, business email compromise, and brand impersonation. While p=none does generate useful aggregate and forensic reports that help identify sending sources and misconfigurations, it offers no actual protection against malicious actors. Security experts warn that relying on p=none creates a false sense of security, as having a DMARC record without enforcement does not meaningfully reduce risk. Organizations are advised to transition to stricter policies — p=quarantine or p=reject — after verifying that their SPF and DKIM records are correctly configured for all legitimate email sources.