What does a DMARC record that is 'p=none' and 'pct=100' mean?
Matthew Whittaker
Co-founder & CTO, Suped
Published 22 Jan 2025
Updated 19 Oct 2025
8 min read
When you encounter a DMARC record with both p=none and pct=100, it signals a specific phase in an organization's email authentication journey. This combination isn't about enforcing a strict policy, but rather about gathering comprehensive data to understand email flows without impacting deliverability. It's a critical first step for any domain implementing DMARC to secure their email ecosystem.
At its core, DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol designed to protect your domain from impersonation, phishing, and other forms of email abuse. It builds upon existing protocols like SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) by providing instructions to receiving mail servers on how to handle emails that fail authentication, and offering a mechanism for reporting on those failures. This particular combination of tags is central to the initial deployment strategy.
The meaning of 'p=none'
The p tag in a DMARC record specifies the policy for handling emails that fail DMARC authentication. When it's set to p=none, it instructs receiving mail servers not to apply any specific action (like quarantining or rejecting) to emails that fail DMARC checks. Essentially, none means monitor only. The primary purpose of this policy is data collection. Receiving servers will still perform DMARC checks, but instead of blocking non-compliant emails, they will simply report their findings back to the domain owner.
This monitoring phase is crucial for understanding your email ecosystem. It allows you to see all sources sending email on behalf of your domain, including legitimate ones you might not be aware of, as well as any unauthorized senders or spoofing attempts. Without p=none, jumping straight to enforcement policies like p=quarantine or p=reject could inadvertently block legitimate emails, leading to significant deliverability issues. However, it's important to note that p=none itself offers no protection against impersonation, as explained in Fortinet's cyberglossary on DMARC.
While p=none is excellent for initial discovery, it means you're not yet leveraging DMARC's full security capabilities. Attackers can still spoof your domain with emails that fail authentication, and these emails will be delivered to the recipient's inbox. This highlights the importance of transitioning to a stronger policy once your sending sources are identified and properly configured. Understanding the implications of a DMARC policy of p=none is key to a robust email security strategy.
The role of 'pct=100'
The pct tag, short for percentage, determines what percentage of emails failing DMARC authentication should have the specified DMARC policy applied to them. When you set pct=100, it means that 100% of emails that fail DMARC authentication will be subject to the policy defined by the p tag.
In the context of p=none, a pct=100 setting ensures that you receive DMARC aggregate reports for all emails that fail authentication. This is vital for obtaining a complete picture of your domain's email traffic. If you used a pct value less than 100 with p=none, you would only receive reports for a fraction of your failing emails, giving you an incomplete view. So, in the monitoring phase, pct=100 is the standard approach to ensure maximum visibility, as explained when p and sp are set to none.
The combination of p=none and pct=100 essentially means, send me reports for 100% of my emails that fail DMARC, but don't do anything else with them. This is the safest way to deploy DMARC, as it guarantees that no legitimate email will be blocked due to misconfiguration or unknown sending sources while you are still gathering data.
Why start with p=none and pct=100?
Starting with this DMARC configuration is a best practice recommended for almost all organizations. It allows you to:
Identify all legitimate senders: DMARC reports show you every IP address sending email from your domain, helping uncover shadow IT or forgotten services.
Assess authentication compliance: You can see which of your legitimate senders are failing SPF or DKIM, and then take steps to fix those issues.
Monitor for malicious activity: Even without enforcement, you'll get insights into spoofing attempts targeting your domain.
This initial phase, often called the monitoring phase, is indispensable. Without it, moving directly to an enforcement policy could disrupt your email operations and lead to missed or undelivered critical communications. For a detailed walkthrough, you can review simple DMARC examples on how to start with a p=none policy.
By diligently analyzing the DMARC reports during this phase, you are building a strong foundation for your domain's email security. This careful preparation ensures that when you eventually transition to an enforcement policy, you do so with confidence, knowing that all your legitimate email sources are correctly authenticated and will reach their intended recipients without interruption.
Get full visibility with DMARC reports
To effectively analyze DMARC reports (XML files) received during the p=none phase, you need a robust DMARC monitoring tool. Suped offers advanced DMARC monitoring that transforms raw XML data into understandable, actionable insights. With our AI-powered recommendations, you get clear guidance on how to fix issues and strengthen your policy, streamlining your path to DMARC enforcement.
Transitioning from monitoring to enforcement
Once you have a clear understanding of your email landscape, with all legitimate sending sources identified and properly authenticated with SPF and DKIM, the next step is to gradually move towards an enforcement policy. This typically involves changing your p tag to p=quarantine or ultimately p=reject. During this transition, the pct tag becomes invaluable. You can reduce its value from 100% to a smaller percentage (e.g., pct=10, then pct=25) to gradually apply the new policy, minimizing risk. This method is crucial for safely transitioning your DMARC policy to quarantine or reject.
Monitoring policy: p=none
Action: No direct action on failed emails; they are delivered.
Purpose: Collect reports and identify all sending sources.
Risk: No protection against spoofing or phishing attempts.
Visibility: Full visibility into email flows and authentication failures (especially with pct=100).
Enforcement policies: p=quarantine or p=reject
Action: Failed emails are quarantined (spam folder) or rejected (bounced).
Purpose: Prevent spoofing and protect recipient inboxes.
Benefit: Significant reduction in email fraud and improved brand reputation.
The transition process is critical. You'll want to carefully monitor your DMARC reports at each stage, checking for any unexpected failures. Adjusting the pct value allows for a controlled rollout, ensuring that you catch and resolve any issues before they affect a large portion of your email traffic. This methodical approach minimizes disruption and maximizes the security benefits of DMARC.
When you're ready to deploy DMARC, or improve your current setup, Suped offers the most comprehensive DMARC reporting and monitoring tools available. Our generous free plan provides everything you need to start gaining visibility and control over your email security, with intuitive dashboards and real-time alerts.
Summary: A foundation for email security
In essence, a DMARC record configured as p=none and pct=100 means you are actively monitoring all email authentication failures for your domain, without imposing any immediate impact on email delivery. It's the essential first step in a DMARC implementation strategy, providing the data needed to make informed decisions about tightening your email security. This combination is a foundational component for ensuring your domain is protected against email impersonation and abuse.
Moving beyond this monitoring phase is crucial for full protection. The insights gained from these reports allow you to identify and rectify any legitimate sending issues, gradually moving your policy to quarantine or reject, and thus fully secure your email channel. This progressive approach ensures email deliverability remains high while enhancing security.
