What is the difference between DMARC monitoring and enforcement?

Monitoring (p=none) collects data without affecting delivery. Enforcement (p=quarantine or p=reject) tells receiving servers to isolate or refuse messages that fail authentication.

How can I move from p=none to enforcement without losing legitimate email?

Ramp gradually through p=quarantine and read your reports at each step, so you catch a misconfigured sender before it affects real mail. The enforcement guide covers the full sequence.

Why do SPF and DKIM need to be aligned for DMARC to work?

Alignment checks that the domain in the visible From address matches the domain that SPF and DKIM authenticated. Without it, a spoofed From address can still pass the underlying checks.

Can enforcement be automated?

Yes. Palisade handles report parsing, sender alignment, and staged policy escalation, which removes the manual work that causes most domains to stall.

Does staying at p=none satisfy Gmail and Yahoo's sender rules?

No. Publishing a record is the starting line, not the finish. The bulk-sender requirements assume a working DMARC setup, and a domain at p=none still leaves its From address open to spoofing — the exact risk enforcement exists to remove.

Why do corporations struggle with DMARC enforcement?

Most organizations that adopt DMARC never turn it on. They publish a record, leave the policy at p=none, and stop. That gap between publishing and enforcing is where the protection actually lives, because p=none blocks nothing. Understanding why so many domains stall there is the first step to getting past it.

This is the problem-side companion to our step-by-step guide, how to simplify the journey to DMARC enforcement. If you already know why enforcement matters and just want the route, start there.

What "stuck at p=none" looks like

A domain at p=none is in monitoring mode. It collects reports about who is sending mail using its name, but it tells receiving servers to do nothing when a message fails authentication. Spoofed mail still reaches inboxes exactly as before. Many teams publish the record, see reports arriving, and assume the job is done. It is not: email authentication only protects a domain once the policy reaches p=quarantine or p=reject.

Comparison of DMARC monitoring at p=none versus enforcement at p=quarantine or p=reject.

Records left at p=none only observe. Enforcement is where spoofing actually stops.

Why enforcement lags behind adoption

The stall is rarely about DMARC itself. It comes from four recurring obstacles:

Configuration spread. SPF and DKIM have to be correct across every mail flow, from marketing platforms to billing systems, before the policy can tighten safely.
Fear of dropping real mail. Teams worry that moving to enforcement will reject legitimate messages, so they never move.
Limited in-house expertise. Email authentication is a niche, and the people who own DNS are often not the people who understand alignment.
Unclear guidance on the edges. Alignment failures and subdomain policies (the sp tag) are where confusion concentrates, and confusion becomes an excuse to wait.

The result is a "set and watch" posture: reports pile up, the policy never changes, and the domain stays exposed.

What the data shows

The pattern is well documented. The Online Trust Alliance audit of roughly a thousand high-profile domains found SPF and DKIM adoption climbing steadily, from 56% of the top 500 retailers in 2013 to 85% in 2016. DMARC publication rose too, from 3% to 21% of those retailers over the same span. Enforcement is the number that stays low: across sectors, the share of domains actually running p=quarantine or p=reject sat under 25%. Adoption is easy; enforcement is where organizations stall.

Why the stall is now more expensive

Staying at p=none used to be merely a missed opportunity. It is now a liability. Gmail and Yahoo's bulk-sender rules — in force since February 2024 and tightened through Gmail's enforcement ramp in November 2025 — expect any domain sending 5,000 or more messages a day to authenticate with SPF, DKIM, and DMARC. Microsoft applied the same bar to Outlook.com senders in 2025. A domain parked at p=none still technically publishes a DMARC record, but it forfeits the protection those rules were designed to deliver and leaves its brand fully spoofable. The gap between publishing and enforcing, once quietly tolerated, is exactly what these mailbox requirements are built to close.

How domains get unstuck

The fix for every obstacle above is the same: replace guesswork with data, and take the policy up in stages rather than one cutover. That is precisely what the enforcement guide walks through, from publishing p=none to a staged ramp toward p=reject.

Five steps for moving a domain from DMARC monitoring at p=none to full p=reject enforcement.

Policy tightens step by step, using real-time data to avoid losing legitimate mail.

Automation removes the two obstacles that stall teams most. Palisade parses every aggregate report, names each unaligned sender, generates the hosted records to fix it, and tightens the policy toward p=reject once the data confirms it is safe. That turns the fear of dropping mail into a measured, reversible process. Check your domain's current posture with the free Email Security Score.

At a glance

Quick takeaways

Publishing a DMARC record is not protection. Only p=quarantine or p=reject stops spoofing.
Enforcement stalls on fear of dropping legitimate mail, not on DMARC being hard.
Industry audits consistently show enforcement well below adoption, under 25% of domains.
A staged ramp backed by report data removes the risk that keeps teams at p=none.
The step-by-step route to p=reject is the companion to this article.