DMARC set to monitoring only
A DMARC policy containing p=none does not ask receiving mail systems to quarantine or reject a message because it fails DMARC. It can be a deliberate starting point for rollout. Aggregate reporting is requested separately with rua; p=none alone does not prove that reports are configured, arriving or being reviewed. Other audit tools often report this finding as "DMARC monitoring mode".
Why this matters
A monitoring policy supplies no DMARC enforcement request, but it does not guarantee inbox delivery: receivers still apply their own spam and security decisions. Moving to enforcement without checking legitimate senders can disrupt business email. Passing SPF or DKIM must also align with the visible From domain for DMARC to pass.
How to fix it
Inventory every legitimate sender, including business mail, invoicing, CRM, website forms and marketing platforms. Confirm the reporting destination works and review reports across normal sending activity. For each approved sender, check aligned SPF or DKIM and investigate failures before changing policy. Have the mail administrator plan quarantine or reject only after verification, with a saved DNS record, rollback and delivery checks. Retest important mail streams and monitor reports after deployment; a public DNS observation cannot prove safe enforcement or report coverage.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit