{"id":17457,"date":"2021-10-13T20:38:32","date_gmt":"2021-10-13T20:38:32","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=17457"},"modified":"2026-03-17T18:30:33","modified_gmt":"2026-03-17T18:30:33","slug":"dmarc-deployment-mistakes-while-implementing-dmarc","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/dmarc-deployment-mistakes-while-implementing-dmarc\/","title":{"rendered":"DMARC Deployment Mistakes"},"content":{"rendered":"\n

Interest in DMARC is growing exponentially, but most organizations implementing DMARC aren\u2019t taking advantage of its anti-spoofing benefits. Here’s how to overcome the most common <\/span>DMARC deployment<\/b> issues.<\/span><\/p>\n\n\n\n

 <\/div>\n\n\n\n
\"DMARC<\/figure>\n\n\n\n

Being Stuck on \u201cPolicy None\u201d<\/h2>\n\n\n\n

During <\/span>DMARC deployment <\/b>for our clients, we’ve come across accounts where people <\/span>think<\/span><\/i> their domain is protected. But the DMARC record<\/a> has been left at <\/span>p=none<\/b> for <\/span>years<\/span><\/i>. <\/span><\/p>\n\n\n\n

The <\/span>p=none<\/b> policy, along with <\/span>rua<\/b> and <\/span>ruf<\/b> tags, puts the domain into monitoring mode so receiving mail servers\/gateways can send back aggregate reports and authentication-failed messages back to the domain owner.<\/span><\/p>\n\n\n\n

With this policy, mail servers\/gateways only send back reports\u2014they don\u2019t prevent fraudulent, spam, or phishing emails from being delivered.  Instead, all emails go straight to the recipient\u2019s inbox, even if they  aren\u2019t validated. Monitoring is a useful and necessary first step towards <\/span>DMARC implementation<\/span><\/a>, but it doesn\u2019t protect your domain or prevent scammers, spammers, and bad actors from exploiting your company\u2019s name.<\/span><\/p>\n\n\n\n

By default, your <\/span>DMARC policy<\/span><\/a> applies to 100% of all received mail unless a percentage is specified using the <\/span>pct<\/b> tag. Unfortunately, if the DMARC record uses <\/span>p=quarantine<\/b> and the percentage is set to less than 100, email recipients can still receive fake messages in your company\u2019s name. <\/span><\/p>\n\n\n\n

There\u2019s no such thing as \u201cpartial\u201d <\/span>DMARC compliance<\/span><\/a>. Your domain isn\u2019t entirely safe if your <\/span>pct<\/b> tag indicates anything less than 100%.<\/span><\/p>\n\n\n\n

Going Full \u201cReject\u201d at Once<\/h2>\n\n\n\n

While it\u2019s easy to set your DMARC policy to \u201cReject\u201d just by changing the record syntax in your DNS, it\u2019s not something we recommend. Achieving full DMARC compliance is a methodical process that includes:<\/span><\/p>\n\n\n\n