Why domains stall at p=none

Publishing a DMARC record takes fifteen minutes. Reaching enforcement, the state where forged mail is actually refused, takes most organizations months, and the majority never arrive. Analyses published by email authentication vendors consistently find that fewer than one in five domains with a DMARC record ever reach a reject policy. Even among large public companies, with security teams and budgets, only about half are at full enforcement.

The gap between the record and the protection is the subject of this brief.

The first step feels like the last step

DMARC deployments begin, correctly, at p=none. Monitoring mode. The record collects reports on who is sending as the domain without changing anything about delivery. It is the right starting point, and it is also a trap: once the record exists, the task feels handled. A scanner shows a record. A checklist gets a tick. The domain remains exactly as forgeable as it was the day before.

The reports arrive as XML

At p=none, mailbox providers begin sending aggregate reports, zipped XML files, one per provider per day. They contain everything needed to move forward: every source sending as the domain, and whether each passes authentication. Almost nobody reads them, because almost nobody can. Without a parsing tool and someone assigned to watch it, the reports accumulate in an inbox until someone sets up a rule to delete them. The observation step runs forever because no one is observing.

Fear does the rest

Moving from none to quarantine to reject means that mail failing authentication stops arriving. If every legitimate sender has been found and configured, that is precisely the goal. If one has been missed, an invoicing tool, a scheduling system, the newsletter platform someone signed up for three years ago, the firm’s own mail starts silently disappearing. The people responsible for the change usually cannot enumerate every system that sends as the domain, they know it, and so the safest-feeling action is no action. The policy stays at none indefinitely.

The alignment problem

There is also a technical reason attempts fail late. A sending service can pass authentication against its own domain and still fail DMARC for yours, because the domain that authenticated does not match the address the recipient sees. This is called alignment, it is the mechanism most first attempts miss, and discovering it after enforcement is how firms end up bouncing their own mail and rolling the whole project back, this time with organizational scar tissue.

What finishing actually requires

Inventorying every sending system, watching reports long enough for the infrequent senders to appear, authenticating each source with alignment, and then raising the policy in stages while someone reads the results. It is not conceptually difficult. It is sustained, and sustained is what busy firms do not have. Which is why the most common DMARC state on the internet is a record that watches a domain being forged and delivers the forgery anyway.

Plenty of firms push through to enforcement on their own. If yours would rather have it handled, that is what we do.