The fix, in one snippet
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100"Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
When a valid DMARC record is present, Scan.now reads its p= tag and reports a low-severity finding for p=none. It also examines the modifiers that weaken an enforcing policy: pct below 100 with quarantine or reject (only that percentage of failing mail is acted on), and sp=none on a domain whose main policy is reject, which leaves every subdomain spoofable. A p=none record without any rua= address is called out specifically, because monitoring mode that nobody monitors accomplishes nothing. The report shows the full record and which tags triggered the note. The existence and syntax of the record are covered by dmarc-record; this check is only about the strength of what it asks for.
Why it matters
p=none tells receivers "check, report to me, but deliver everything". It is the intended starting point, and it is also where a large number of domains stop, because moving on requires reading the reports and fixing the senders they reveal. While the policy is none, a phishing message that fails both SPF and DKIM lands in the inbox exactly as it would without DMARC at all. Some providers apply their own heuristics to unauthenticated mail, but that is their choice, not your instruction. Subdomains matter too: with p=reject on example.com but sp=none, an attacker sends from billing.example.com, which most recipients read as legitimate. The SPF, DKIM and DMARC guide describes how to read aggregate reports and what "clean" looks like before you enforce. The phishing guide shows what recipients face in the meantime.
How to fix it
Move to enforcement in stages, reading the aggregate reports between each step:
- Confirm every legitimate sending service passes SPF or DKIM with an aligned domain. Fix the ones that do not (usually by enabling DKIM at the provider).
- Switch to quarantine for a fraction of failing mail and watch for complaints:
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]" - Raise
pctto 100, then change the policy:_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]"
adkim=s and aspf=s require exact domain alignment rather than allowing any subdomain; use them once you know no sender relies on relaxed alignment. In the Cloudflare DNS dashboard, edit the existing _dmarc TXT record. Reports arrive as XML attachments; Cloudflare DMARC Management, Postmark's free DMARC digests or any of the commercial analysers turn them into readable summaries. For a domain that sends no mail, go straight to p=reject with v=spf1 -all in SPF. Re-check with the email security checker after each change.
Where this fits
DMARC policy is p=none (monitoring only) is check 5 of 8 that the website vulnerability scanner runs under dns and email authentication, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits CAA record (low), where no CAA record limits which certificate authorities may issue certificates for the domain, so any of the hundred-plus publicly trusted CAs could be induced to issue one. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
DMARC policy is p=none (monitoring only) closes one route in. Immediately below it: DNSSEC signing, where the domain's DNS zone is not signed with DNSSEC, so a resolver cannot verify that the answers it receives for your domain are genuine, or the zone is signed but validation is failing; DKIM selector discovered, where no DKIM public key was found under the common selector names, or the key found is weak or revoked; MX records, where a review of the domain's MX records: Whether mail is deliverable, whether every mail host resolves, and whether a domain that sends no mail says so with a Null MX.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Certificate chain and hostname validation, where the certificate presented for this hostname did not validate: The chain does not reach a trusted root, an intermediate is missing, the name does not match, or the certificate is self-signed or expired, and Exposed .env configuration file, where a .env configuration file is served from the web root. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: DMARC policy is p=none (monitoring only) (low severity)
Scanner check id: dmarc-policy-noneThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
9 min read · Updated Sep 10, 2026
SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain
Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...
Read the guide
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide