Mailient Research · Guide
It means a forged email with your domain in the From: line will usually be delivered. With no DMARC record, a receiving server that spots the forgery has no instruction from you. With p=none, your instruction is to deliver it and send you a report. Only p=quarantine or p=reject tells receiving servers to act on a failed check.
Updated
SPF and DKIM are checks. SPF says which servers may send for a domain; DKIM signs the message so a receiver can confirm it was not altered and came from a domain holding the key. Neither one tells the receiving server what to do when a message fails.
DMARC does. It lives in a TXT record at _dmarc.yourdomain.com, and its p= tag is an instruction for mail whose From: domain fails alignment: none (deliver and report), quarantine (treat as suspicious, usually the spam folder) or reject (refuse it).
It is the safe first step. Publishing p=none with a reporting address (rua=) makes receiving servers send you daily aggregate reports without changing what gets delivered. Those reports show every service sending as your domain, so you can fix your own legitimate mail before you ask anyone to block anything.
The problem is that many domains stop there. A policy left at p=none keeps monitoring forever and never protects anything.
On 5 September 2026 we read the DMARC records of the top 50,000 domains in the Tranco V367N ranking. Of the 36,548 that receive email, 8,094 (22.1%) publish no DMARC record and 9,400 (25.7%) publish p=none. Together that is 17,494 domains, 47.9%, with no policy that stops a forged From: line. 23.6% are at p=quarantine and 28.6% at p=reject.
The sample is the most-visited sites, so it says more about large domains than about a typical small company. The method, the limits and the raw data are in the paper.
Read the Q3 2026 paper · per-domain results (CSV) · check a domain
Step by step, with the commands to read each record yourself: how to check if your domain can be spoofed.
For a forged message, very nearly. In both cases a receiving server that detects the forgery has no instruction to stop it and usually delivers it. The difference is reporting: with p=none and a rua address, receivers send you aggregate reports, so you can see who is sending as your domain. With no record you learn nothing.
No. SPF checks the envelope sender, the address used in the mail transfer, not the From: line a reader sees. DMARC is what ties the From: domain to SPF or DKIM results and tells receivers what to do when they fail. A domain can have a perfect SPF record and still be forgeable in the From: line without an enforcing DMARC policy.
Partly. It asks receiving servers to treat failing mail as suspicious, which usually means the spam folder rather than the inbox. A spam folder is still a folder someone opens. p=reject is the only policy that asks receivers to refuse the message outright.
There is no fixed period. Stay at p=none, with a reporting address, until the aggregate reports show every service that legitimately sends as your domain passing SPF or DKIM with alignment. Then move to p=quarantine, and to p=reject once that has run cleanly. Moving to reject first can block your own invoicing or newsletter tools.
Mailient runs this research and the free checker. Mailient is an AI inbox assistant for founders. It connects to Gmail, shows what needs a decision today, can draft replies in your writing voice — including a daily morning sweep on paid plans — and by default will not send anything until you approve it.